Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Crawl.exe

Overview

General Information

Sample name:Crawl.exe
Analysis ID:1585300
MD5:2d2c7ee748d941798466b19b53da88bb
SHA1:7c0cf86f123f2896795add3ecc7bafc30fdc87bc
SHA256:066dc9a1134b1db77c1574a52002f53b28cc29d0a3769bd5156d1e0e0a51a91a
Tags:exemalwareRansomuser-Joker
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Sigma detected: Delete shadow copy via WMIC
AI detected suspicious sample
Deletes shadow drive data (may be related to ransomware)
Machine Learning detection for sample
May encrypt documents and pictures (Ransomware)
Modifies existing user documents (likely ransomware behavior)
Overwrites Mozilla Firefox settings
Self deletion via cmd or bat file
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Sigma detected: Suspicious Ping/Del Command Combination
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Enables debug privileges
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Potential Command Line Path Traversal Evasion Attempt
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Stores large binary data to the registry
Uses 32bit PE files

Classification

Process Tree

  • System is w10x64
  • Crawl.exe (PID: 7352 cmdline: "C:\Users\user\Desktop\Crawl.exe" MD5: 2D2C7EE748D941798466B19B53DA88BB)
    • WMIC.exe (PID: 7820 cmdline: c:\eHFmDS\eHFm\..\..\Windows\eHFm\eHFm\..\..\system32\eHFm\eHFm\..\..\wbem\eHFm\eHFmD\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • conhost.exe (PID: 7832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • WMIC.exe (PID: 7964 cmdline: c:\rEFsaw\rEFs\..\..\Windows\rEFs\rEFs\..\..\system32\rEFs\rEFs\..\..\wbem\rEFs\rEFsa\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • conhost.exe (PID: 5376 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 1168 cmdline: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 2848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • PING.EXE (PID: 5368 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: B3624DD758CCECF93A1226CEF252CA12)
  • Crawl.exe (PID: 1544 cmdline: "C:\Users\user\Desktop\Crawl.exe" MD5: 2D2C7EE748D941798466B19B53DA88BB)
    • WMIC.exe (PID: 4892 cmdline: c:\wyFgSM\wyFg\..\..\Windows\wyFg\wyFg\..\..\system32\wyFg\wyFg\..\..\wbem\wyFg\wyFgS\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • conhost.exe (PID: 1404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • WMIC.exe (PID: 4412 cmdline: c:\bIEBzl\bIEB\..\..\Windows\bIEB\bIEB\..\..\system32\bIEB\bIEB\..\..\wbem\bIEB\bIEBz\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • conhost.exe (PID: 6016 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 1532 cmdline: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 3760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • PING.EXE (PID: 1404 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: B3624DD758CCECF93A1226CEF252CA12)
  • Crawl.exe (PID: 3488 cmdline: "C:\Users\user\Desktop\Crawl.exe" MD5: 2D2C7EE748D941798466B19B53DA88BB)
    • WMIC.exe (PID: 4476 cmdline: c:\pKqXjm\pKqX\..\..\Windows\pKqX\pKqX\..\..\system32\pKqX\pKqX\..\..\wbem\pKqX\pKqXj\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • conhost.exe (PID: 1760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • WMIC.exe (PID: 2720 cmdline: c:\JQLOTM\JQLO\..\..\Windows\JQLO\JQLO\..\..\system32\JQLO\JQLO\..\..\wbem\JQLO\JQLOT\..\..\wmic.exe shadowcopy delete MD5: C37F2F4F4B3CD128BDABCAEB2266A785)
      • conhost.exe (PID: 824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 5924 cmdline: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 4428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • PING.EXE (PID: 2520 cmdline: ping 1.1.1.1 -n 1 -w 3000 MD5: B3624DD758CCECF93A1226CEF252CA12)
  • notepad.exe (PID: 6736 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt MD5: 27F71B12CB585541885A31BE22F61C83)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Operating System Destruction

barindex
Sigma detected: Delete shadow copy via WMIC
Source: Process startedAuthor: Joe Security: Data: Command: c:\eHFmDS\eHFm\..\..\Windows\eHFm\eHFm\..\..\system32\eHFm\eHFm\..\..\wbem\eHFm\eHFmD\..\..\wmic.exe shadowcopy delete, CommandLine: c:\eHFmDS\eHFm\..\..\Windows\eHFm\eHFm\..\..\system32\eHFm\eHFm\..\..\wbem\eHFm\eHFmD\..\..\wmic.exe shadowcopy delete, CommandLine|base64offset|contains: (, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: "C:\Users\user\Desktop\Crawl.exe", ParentImage: C:\Users\user\Desktop\Crawl.exe, ParentProcessId: 7352, ParentProcessName: Crawl.exe, ProcessCommandLine: c:\eHFmDS\eHFm\..\..\Windows\eHFm\eHFm\..\..\system32\eHFm\eHFm\..\..\wbem\eHFm\eHFmD\..\..\wmic.exe shadowcopy delete, ProcessId: 7820, ProcessName: WMIC.exe

System Summary

barindex
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Source: Process startedAuthor: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: c:\eHFmDS\eHFm\..\..\Windows\eHFm\eHFm\..\..\system32\eHFm\eHFm\..\..\wbem\eHFm\eHFmD\..\..\wmic.exe shadowcopy delete, CommandLine: c:\eHFmDS\eHFm\..\..\Windows\eHFm\eHFm\..\..\system32\eHFm\eHFm\..\..\wbem\eHFm\eHFmD\..\..\wmic.exe shadowcopy delete, CommandLine|base64offset|contains: (, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: "C:\Users\user\Desktop\Crawl.exe", ParentImage: C:\Users\user\Desktop\Crawl.exe, ParentProcessId: 7352, ParentProcessName: Crawl.exe, ProcessCommandLine: c:\eHFmDS\eHFm\..\..\Windows\eHFm\eHFm\..\..\system32\eHFm\eHFm\..\..\wbem\eHFm\eHFmD\..\..\wmic.exe shadowcopy delete, ProcessId: 7820, ProcessName: WMIC.exe
Sigma detected: Suspicious Ping/Del Command Combination
Source: Process startedAuthor: Ilya Krestinichev: Data: Command: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe", CommandLine: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Crawl.exe" , ParentImage: C:\Users\user\Desktop\Crawl.exe, ParentProcessId: 1544, ParentProcessName: Crawl.exe, ProcessCommandLine: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe", ProcessId: 1532, ProcessName: cmd.exe
Sigma detected: CurrentVersion Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\Desktop\Crawl.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Crawl.exe, ProcessId: 7352, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XPSUDTARW
Sigma detected: Potential Command Line Path Traversal Evasion Attempt
Source: Process startedAuthor: Christian Burkard (Nextron Systems): Data: Command: c:\eHFmDS\eHFm\..\..\Windows\eHFm\eHFm\..\..\system32\eHFm\eHFm\..\..\wbem\eHFm\eHFmD\..\..\wmic.exe shadowcopy delete, CommandLine: c:\eHFmDS\eHFm\..\..\Windows\eHFm\eHFm\..\..\system32\eHFm\eHFm\..\..\wbem\eHFm\eHFmD\..\..\wmic.exe shadowcopy delete, CommandLine|base64offset|contains: (, Image: C:\Windows\System32\wbem\WMIC.exe, NewProcessName: C:\Windows\System32\wbem\WMIC.exe, OriginalFileName: C:\Windows\System32\wbem\WMIC.exe, ParentCommandLine: "C:\Users\user\Desktop\Crawl.exe", ParentImage: C:\Users\user\Desktop\Crawl.exe, ParentProcessId: 7352, ParentProcessName: Crawl.exe, ProcessCommandLine: c:\eHFmDS\eHFm\..\..\Windows\eHFm\eHFm\..\..\system32\eHFm\eHFm\..\..\wbem\eHFm\eHFmD\..\..\wmic.exe shadowcopy delete, ProcessId: 7820, ProcessName: WMIC.exe
Sigma detected: Startup Folder File Write
Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\Crawl.exe, ProcessId: 7352, TargetFilename: C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: Crawl.exeAvira: detected
Multi AV Scanner detection for submitted file
Source: Crawl.exeVirustotal: Detection: 42%Perma Link
Source: Crawl.exeReversingLabs: Detection: 50%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.5% probability
Machine Learning detection for sample
Source: Crawl.exeJoe Sandbox ML: detected
Source: Crawl.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: Crawl.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: Z:\scvhost\Release\scvhost.pdb source: Crawl.exe
Source: Binary string: Z:\scvhost\Release\scvhost.pdbd source: Crawl.exe
Source: C:\Users\user\Desktop\Crawl.exeFile opened: D:\sources\migration\Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: D:\sources\replacementmanifests\Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: D:\sources\migration\wtr\Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: D:\sources\replacementmanifests\hwvid-migration-2\Jump to behavior

Networking

barindex
Uses ping.exe to check the status of other devices and networks
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: Joe Sandbox ViewIP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox ViewIP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: cert9.db.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: cert9.db.0.drString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: cert9.db.0.drString found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: cert9.db.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: cert9.db.0.drString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: cert9.db.0.drString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: cert9.db.0.drString found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: cert9.db.0.drString found in binary or memory: http://ocsp.digicert.com0
Source: cert9.db.0.drString found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: cert9.db.0.drString found in binary or memory: http://x1.c.lencr.org/0
Source: cert9.db.0.drString found in binary or memory: http://x1.i.lencr.org/0
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://MD8.mozilla.org/1/m
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://account.bellmedia.c
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://allegro.pl/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://bugzilla.mo
Source: prefs.js.0.drString found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: extensions.json.0.drString found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: prefs.js.0.drString found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://login.live.com
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://login.microsoftonline.com
Source: extensions.json.0.drString found in binary or memory: https://screenshots.firefox.com/
Source: places.sqlite.0.drString found in binary or memory: https://support.mozilla.org
Source: places.sqlite.0.drString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: favicons.sqlite.0.drString found in binary or memory: https://support.mozilla.org/products/firefox
Source: places.sqlite.0.drString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://twitter.com/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://weibo.com/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.aliexpress.com/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.amazon.ca/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.amazon.co.uk/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.amazon.com/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.amazon.de/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.amazon.fr/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.avito.ru/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.baidu.com/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.bbc.co.uk/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.ctrip.com/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.ebay.co.uk/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.ebay.de/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.google.com/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.google.com/complete/
Source: data.safe.bin.0.drString found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=&
Source: data.safe.bin.0.drString found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=&metrics#search.engine.default.verified
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.ifeng.com/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.iqiyi.com/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.leboncoin.fr/
Source: places.sqlite.0.drString found in binary or memory: https://www.mozilla.org
Source: favicons.sqlite.0.drString found in binary or memory: https://www.mozilla.org/about/
Source: places.sqlite.0.drString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: favicons.sqlite.0.drString found in binary or memory: https://www.mozilla.org/contribute/
Source: places.sqlite.0.drString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: favicons.sqlite.0.drString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: places.sqlite.0.drString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: places.sqlite.0.drString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: favicons.sqlite.0.drString found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon-196x196.2af054fea211.png
Source: favicons.sqlite.0.drString found in binary or memory: https://www.mozilla.org/media/img/favicons/mozilla/favicon.d25d81d39065.icox
Source: places.sqlite.0.drString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.msn.com
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.olx.pl/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.reddit.com/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.wykop.pl/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.youtube.com/
Source: 3870112724rsegmnoittet-es.sqlite.0.drString found in binary or memory: https://www.zhihu.com/

Spam, unwanted Advertisements and Ransom Demands

barindex
Deletes shadow drive data (may be related to ransomware)
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\eHFmDS\eHFm\..\..\Windows\eHFm\eHFm\..\..\system32\eHFm\eHFm\..\..\wbem\eHFm\eHFmD\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\wyFgSM\wyFg\..\..\Windows\wyFg\wyFg\..\..\system32\wyFg\wyFg\..\..\wbem\wyFg\wyFgS\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\pKqXjm\pKqX\..\..\Windows\pKqX\pKqX\..\..\system32\pKqX\pKqX\..\..\wbem\pKqX\pKqXj\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\bIEBzl\bIEB\..\..\Windows\bIEB\bIEB\..\..\system32\bIEB\bIEB\..\..\wbem\bIEB\bIEBz\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\rEFsaw\rEFs\..\..\Windows\rEFs\rEFs\..\..\system32\rEFs\rEFs\..\..\wbem\rEFs\rEFsa\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\JQLOTM\JQLO\..\..\Windows\JQLO\JQLO\..\..\system32\JQLO\JQLO\..\..\wbem\JQLO\JQLOT\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\eHFmDS\eHFm\..\..\Windows\eHFm\eHFm\..\..\system32\eHFm\eHFm\..\..\wbem\eHFm\eHFmD\..\..\wmic.exe shadowcopy deleteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\rEFsaw\rEFs\..\..\Windows\rEFs\rEFs\..\..\system32\rEFs\rEFs\..\..\wbem\rEFs\rEFsa\..\..\wmic.exe shadowcopy deleteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\wyFgSM\wyFg\..\..\Windows\wyFg\wyFg\..\..\system32\wyFg\wyFg\..\..\wbem\wyFg\wyFgS\..\..\wmic.exe shadowcopy deleteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\bIEBzl\bIEB\..\..\Windows\bIEB\bIEB\..\..\system32\bIEB\bIEB\..\..\wbem\bIEB\bIEBz\..\..\wmic.exe shadowcopy deleteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\pKqXjm\pKqX\..\..\Windows\pKqX\pKqX\..\..\system32\pKqX\pKqX\..\..\wbem\pKqX\pKqXj\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\JQLOTM\JQLO\..\..\Windows\JQLO\JQLO\..\..\system32\JQLO\JQLO\..\..\wbem\JQLO\JQLOT\..\..\wmic.exe shadowcopy delete
May encrypt documents and pictures (Ransomware)
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\appdata\local\temp\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\desktop\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\desktop\dtbzgiooso\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\desktop\dvwhkmnfnn\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\desktop\htagvdfuie\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\desktop\jsdngycowy\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\desktop\nikhqaiqau\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\desktop\onbqclyspu\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\desktop\sqrkhnbnyn\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\desktop\wkxewiotxi\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\desktop\xzxhavgrag\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\documents\dtbzgiooso\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\documents\dvwhkmnfnn\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\documents\htagvdfuie\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\documents\jsdngycowy\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\documents\my music\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\documents\my pictures\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\documents\my pictures\camera roll\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\documents\my pictures\saved pictures\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\documents\my videos\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\documents\nikhqaiqau\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\documents\onbqclyspu\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\documents\sqrkhnbnyn\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\documents\wkxewiotxi\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\users\user\documents\xzxhavgrag\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\appdata\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\appdata\roaming\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\appdata\roaming\microsoft\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\appdata\roaming\microsoft\internet explorer\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\appdata\roaming\microsoft\internet explorer\quick launch\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\appdata\roaming\microsoft\windows\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\appdata\roaming\microsoft\windows\cloudstore\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\appdata\roaming\microsoft\windows\network shortcuts\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\appdata\roaming\microsoft\windows\printer shortcuts\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\appdata\roaming\microsoft\windows\recent\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\appdata\roaming\microsoft\windows\sendto\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\accessibility\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\accessories\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\maintenance\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\system tools\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\appdata\roaming\microsoft\windows\start menu\programs\windows powershell\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\appdata\roaming\microsoft\windows\templates\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\cookies\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\desktop\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\documents\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\documents\my music\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\documents\my pictures\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\documents\my videos\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\downloads\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\favorites\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\links\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\onedrive\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\default\saved games\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\.ms-ad\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\3d objects\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\acrobat\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\collab\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\forms\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\jscache\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\security\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\acrobat\dc\security\crlcache\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\acrobat\preflight acrobat continuous\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\crlogs\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\crlogs\crashlogs\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\flash player\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\flash player\nativecache\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\headlights\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\linguistics\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\logtransport2\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\logtransport2cc\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\rttransfer\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\sonar\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\adobe\sonar\sonarcc\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\com.adobe.dunamis\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\addins\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\credentials\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\crypto\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\crypto\keys\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\crypto\rsa\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\crypto\rsa\s-1-5-21-2246122658-3693405117-2476756634-1002\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\excel\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\excel\xlstart\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\internet explorer\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\internet explorer\quick launch\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\implicitappshortcuts\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\internet explorer\quick launch\user pinned\taskbar\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\internet explorer\userdata\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\internet explorer\userdata\low\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\network\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\network\connections\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\network\connections\pbk\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\network\connections\pbk\_hiddenpbk\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\protect\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\protect\s-1-5-21-2246122658-3693405117-2476756634-1002\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\speech\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\spelling\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\spelling\en-gb\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\systemcertificates\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\systemcertificates\my\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\systemcertificates\my\certificates\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\systemcertificates\my\crls\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\systemcertificates\my\ctls\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\uproof\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\vault\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\accountpictures\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\cloudstore\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\libraries\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\network shortcuts\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\printer shortcuts\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\recent\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\recent\automaticdestinations\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\recent\customdestinations\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\recent items\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\sendto\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\start menu\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\start menu\programs\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\start menu\programs\accessibility\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\start menu\programs\accessories\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\start menu\programs\administrative tools\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\start menu\programs\maintenance\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\start menu\programs\startup\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\start menu\programs\system tools\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\start menu\programs\windows powershell\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\templates\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\themes\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\microsoft\windows\themes\cachedfiles\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\extensions\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\crash reports\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\crash reports\events\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\pending pings\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\bookmarkbackups\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\crashes\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\crashes\events\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\datareporting\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\datareporting\archived\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\datareporting\archived\2023-10\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\datareporting\glean\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\datareporting\glean\db\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\datareporting\glean\events\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\datareporting\glean\tmp\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\minidumps\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\saved-telemetry-pings\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\security_state\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\sessionstore-backups\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\storage\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\storage\default\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\storage\permanent\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\storage\permanent\chrome\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595amcateirvtisty.files\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\storage\temporary\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\fqs92o4p.default-release\storage\to-be-removed\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\mozilla\firefox\profiles\z6bny8rn.default\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\skype\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\appdata\roaming\skype\roottools\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\contacts\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\cookies\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\cookies\dntexception\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\cookies\dntexception\low\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\cookies\ese\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\cookies\low\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\cookies\privacie\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\cookies\privacie\low\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\documents\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\downloads\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\favorites\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\favorites\links\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\links\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\onedrive\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\recent\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\saved games\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\user\searches\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\public\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\public\accountpictures\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\public\desktop\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\public\documents\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\public\documents\my music\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\public\documents\my pictures\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\public\documents\my videos\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\public\downloads\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\documents and settings\public\libraries\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\perflogs\decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: c:\recovery\decryptfiles.txtJump to behavior
Modifies existing user documents (likely ransomware behavior)
Source: C:\Users\user\Desktop\Crawl.exeFile moved: C:\Users\user\Desktop\DTBZGIOOSO\KATAXZVCPS.mp3Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile deleted: C:\Users\user\Desktop\DTBZGIOOSO\KATAXZVCPS.mp3Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile moved: C:\Users\user\Desktop\DVWHKMNFNN.jpgJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile deleted: C:\Users\user\Desktop\DVWHKMNFNN.jpgJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile moved: C:\Users\user\Desktop\NWTVCDUMOB.pngJump to behavior
Source: Crawl.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TM.blf.0.drBinary string: \Device\HarddiskVolume3\Users\Default\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TM.blf
Source: classification engineClassification label: mal100.rans.phis.troj.spyw.evad.winEXE@37/784@0/1
Source: C:\Users\user\Desktop\Crawl.exeFile created: C:\Users\user\Desktop\Decryptfiles.txtJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3760:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4428:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1760:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6016:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:824:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5376:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2848:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1404:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7832:120:WilError_03
Source: C:\Users\user\Desktop\Crawl.exeFile created: C:\Users\user\AppData\Local\Temp\Decryptfiles.txtJump to behavior
Source: Crawl.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Crawl.exeFile read: \Device\CdRom0\sources\cversion.iniJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: Crawl.exeVirustotal: Detection: 42%
Source: Crawl.exeReversingLabs: Detection: 50%
Source: unknownProcess created: C:\Users\user\Desktop\Crawl.exe "C:\Users\user\Desktop\Crawl.exe"
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\eHFmDS\eHFm\..\..\Windows\eHFm\eHFm\..\..\system32\eHFm\eHFm\..\..\wbem\eHFm\eHFmD\..\..\wmic.exe shadowcopy delete
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Users\user\Desktop\Crawl.exe "C:\Users\user\Desktop\Crawl.exe"
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\wyFgSM\wyFg\..\..\Windows\wyFg\wyFg\..\..\system32\wyFg\wyFg\..\..\wbem\wyFg\wyFgS\..\..\wmic.exe shadowcopy delete
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Users\user\Desktop\Crawl.exe "C:\Users\user\Desktop\Crawl.exe"
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\pKqXjm\pKqX\..\..\Windows\pKqX\pKqX\..\..\system32\pKqX\pKqX\..\..\wbem\pKqX\pKqXj\..\..\wmic.exe shadowcopy delete
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\bIEBzl\bIEB\..\..\Windows\bIEB\bIEB\..\..\system32\bIEB\bIEB\..\..\wbem\bIEB\bIEBz\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe"
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\rEFsaw\rEFs\..\..\Windows\rEFs\rEFs\..\..\system32\rEFs\rEFs\..\..\wbem\rEFs\rEFsa\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe"
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\JQLOTM\JQLO\..\..\Windows\JQLO\JQLO\..\..\system32\JQLO\JQLO\..\..\wbem\JQLO\JQLOT\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe"
Source: C:\Windows\System32\wbem\WMIC.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\eHFmDS\eHFm\..\..\Windows\eHFm\eHFm\..\..\system32\eHFm\eHFm\..\..\wbem\eHFm\eHFmD\..\..\wmic.exe shadowcopy deleteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\rEFsaw\rEFs\..\..\Windows\rEFs\rEFs\..\..\system32\rEFs\rEFs\..\..\wbem\rEFs\rEFsa\..\..\wmic.exe shadowcopy deleteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe"Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\wyFgSM\wyFg\..\..\Windows\wyFg\wyFg\..\..\system32\wyFg\wyFg\..\..\wbem\wyFg\wyFgS\..\..\wmic.exe shadowcopy deleteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\bIEBzl\bIEB\..\..\Windows\bIEB\bIEB\..\..\system32\bIEB\bIEB\..\..\wbem\bIEB\bIEBz\..\..\wmic.exe shadowcopy deleteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe"Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\pKqXjm\pKqX\..\..\Windows\pKqX\pKqX\..\..\system32\pKqX\pKqX\..\..\wbem\pKqX\pKqXj\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\System32\wbem\WMIC.exe c:\JQLOTM\JQLO\..\..\Windows\JQLO\JQLO\..\..\system32\JQLO\JQLO\..\..\wbem\JQLO\JQLOT\..\..\wmic.exe shadowcopy delete
Source: C:\Users\user\Desktop\Crawl.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Users\user\Desktop\Crawl.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\Crawl.exeSection loaded: cryptbase.dll
Source: C:\Users\user\Desktop\Crawl.exeSection loaded: windows.storage.dll
Source: C:\Users\user\Desktop\Crawl.exeSection loaded: wldp.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\System32\notepad.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\notepad.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\notepad.exeSection loaded: mrmcorer.dll
Source: C:\Windows\System32\notepad.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\notepad.exeSection loaded: wldp.dll
Source: C:\Windows\System32\notepad.exeSection loaded: textshaping.dll
Source: C:\Windows\System32\notepad.exeSection loaded: efswrt.dll
Source: C:\Windows\System32\notepad.exeSection loaded: mpr.dll
Source: C:\Windows\System32\notepad.exeSection loaded: wintypes.dll
Source: C:\Windows\System32\notepad.exeSection loaded: twinapi.appcore.dll
Source: C:\Windows\System32\notepad.exeSection loaded: oleacc.dll
Source: C:\Windows\System32\notepad.exeSection loaded: textinputframework.dll
Source: C:\Windows\System32\notepad.exeSection loaded: coreuicomponents.dll
Source: C:\Windows\System32\notepad.exeSection loaded: coremessaging.dll
Source: C:\Windows\System32\notepad.exeSection loaded: ntmarta.dll
Source: C:\Windows\System32\notepad.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\notepad.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\notepad.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\notepad.exeSection loaded: netutils.dll
Source: C:\Windows\System32\notepad.exeSection loaded: propsys.dll
Source: C:\Windows\System32\notepad.exeSection loaded: policymanager.dll
Source: C:\Windows\System32\notepad.exeSection loaded: msvcp110_win.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: mswsock.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: mswsock.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: framedynos.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: netutils.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: vcruntime140_1.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: amsi.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: userenv.dll
Source: C:\Windows\System32\wbem\WMIC.exeSection loaded: profapi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: winnsi.dll
Source: C:\Windows\SysWOW64\PING.EXESection loaded: mswsock.dll
Source: C:\Windows\System32\wbem\WMIC.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.iniJump to behavior
Source: Crawl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Crawl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Crawl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Crawl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Crawl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Crawl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: Crawl.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Crawl.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: Z:\scvhost\Release\scvhost.pdb source: Crawl.exe
Source: Binary string: Z:\scvhost\Release\scvhost.pdbd source: Crawl.exe
Source: Crawl.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Crawl.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Crawl.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Crawl.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Crawl.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Users\user\Desktop\Crawl.exeFile created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Start Menu\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile created: C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XPSUDTARWJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run XPSUDTARWJump to behavior

Hooking and other Techniques for Hiding and Protection

barindex
Self deletion via cmd or bat file
Source: C:\Users\user\Desktop\Crawl.exeProcess created: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe"
Source: C:\Users\user\Desktop\Crawl.exeProcess created: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe"
Source: C:\Users\user\Desktop\Crawl.exeProcess created: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe"
Source: C:\Users\user\Desktop\Crawl.exeProcess created: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe"Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeProcess created: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe"Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeProcess created: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe"
Source: C:\Users\user\Desktop\Crawl.exeKey value created or modified: HKEY_CURRENT_USER\SOFTWARE\SoftwareClient PrivateJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Crawl.exeBinary or memory string: COULD NOT CREATE CHILD PROCESSWOW64DISABLEWOW64FSREDIRECTIONKERNEL32.DLLWOW64REVERTWOW64FSREDIRECTIONABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ\WMIC.EXE\..\\WBEM\\SYSTEM32\\WINDOWS\C:\SHADOWCOPY DELETEAVPMAPP.EXE,ECONCEAL.EXE,SECHEALTHUI.EXE,RUNTIMEBROKER.EXE,ESCANMON.EXE,ESCANPRO.EXE,TRAYSSER.EXE,TRAYICOS.EXE,ECONSER.EXE,VIEWTCP.EXE,FSHDLL64.EXE,FSGK32.EXE,FSHOSTER32.EXE,FSMA32.EXE,FSORSP.EXE,FSSM32.EXE,FSM32.EXE,TRIGGER.EXE,FPROTTRAY.EXE,FPWIN.EXE,FPAVSERVER.EXE,AVK.EXE,GDBGINX64.EXE,AVKPROXY.EXE,GDSCAN.EXE,AVKWCTLX64.EXE,AVKSERVICE.EXE,AVKTRAY.EXE,GDKBFLTEXE32.EXE,GDSC.EXE,VIRUSUTILITIES.EXE,GUARDXSERVICE.EXE,GUARDXKICKOFF_X64.EXE,IPTRAY.EXE,FRESHCLAM.EXE,FRESHCLAMWRAP.EXE,K7RTSCAN.EXE,K7FWSRVC.EXE,K7PSSRVC.EXE,K7EMLPXY.EXE,K7TSECURITY.EXE,K7AVSCAN.EXE,K7CRVSVC.EXE,K7SYSMON.EXE,K7TSMAIN.EXE,K7TSMNGR.EXE,MPCMDRUN.EXE,NANOSVC.EXE,NANOAV.EXE,NNF.EXE,NVCSVC.EXE,NBROWSER.EXE,NSEUPDATESVC.EXE,NFSERVICE.EXE,CMD.EXETASKKILL/IMNWSCMON.EXE,NJEEVES2.EXE,NVCOD.EXE,NVOY.EXE,ZLHH.EXE,ZLH.EXE,NPROSEC.EXE,ZANDA.EXE,NS.EXE,ACS.EXE,OP_MON.EXE,PSANHOST.EXE,PSUAMAIN.EXE,PSUASERVICE.EXE,AGENTSVC.EXE,BDSSVC.EXE,EMLPROXY.EXE,OPSSVC.EXE,ONLINENT.EXE,QUHLPSVC.EXE,SAPISSVC.EXE,SCANNER.EXE,SCANWSCS.EXE,SCPROXYSRV.EXE,SCSECSVC.EXE,SUPERANTISPYWARE.EXE,SASCORE64.EXE,SSUPDATE64.EXE,SUPERDELETE.EXE,SASTASK.EXE,K7RTSCAN.EXE,K7FWSRVC.EXE,K7PSSRVC.EXE,K7EMLPXY.EXE,K7TSECURITY.EXE,K7AVSCAN.EXE,K7CRVSVC.EXE,K7SYSMON.EXE,K7TSMAIN.EXE,K7TSMNGR.EXE,UIWINMGR.EXE,UIWATCHDOG.EXE,UISEAGNT.EXE,PTWATCHDOG.EXE,PTSVCHOST.EXE,PTSESSIONAGENT.EXE,COREFRAMEWORKHOST.EXE,CORESERVICESHELL.EXE,UIUPDATETRAY.EXE,VIPREUI.EXE,SBAMSVC.EXE,SBAMTRAY.EXE,SBPIMSVC.EXE,BAVHM.EXE,BAVSVC.EXE,BAVTRAY.EXE,BAV.EXE,BAVWEBCLIENT.EXE,BAVUPDATER.EXE,MCSHIELDCCC.EXE,MCSHIELDRTM.EXE,MCSHIELDDS.EXE,MCS-UNINSTALL.EXE,SDSCAN.EXE,SDFSSVC.EXE,SDWELCOME.EXE,SDTRAY.EXE,UNTHREAT.EXE,UTSVC.EXE,FORTICLIENT.EXE,FCAPPDB.EXE,FCDBLOG.EXE,FCHELPER64.EXE,FMON.EXE,FORTIESNAC.EXE,FORTIPROXY.EXE,FORTISSLVPNDAEMON.EXE,FORTITRAY.EXE,FORTIFW.EXE,FORTICLIENT_DIAGNOSTIC_TOOL.EXE,AV_TASK.EXE,CERTREG.EXE,FILMSG.EXE,FILUP.EXE,FILWSCC.EXE,FILWSCC.EXE,PSVIEW.EXE,QUAMGR.EXE,QUAMGR.EXE,SCHMGR.EXE,SCHMGR.EXE,TWSSCAN.EXE,TWSSRV.EXE,USERREG.EXESEDEBUGPRIVILEGECOULD NOT SET SE_DEBUG_NAME PRIVILEGE
Uses ping.exe to sleep
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Users\user\Desktop\Crawl.exeFile opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-client-migration-replacement.man
Source: C:\Users\user\Desktop\Crawl.exeFile opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-drivers-migration-replacement.man
Source: C:\Users\user\Desktop\Crawl.exeFile opened / queried: D:\sources\replacementmanifests\microsoft-hyper-v-migration-replacement.man
Source: C:\Users\user\Desktop\Crawl.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Crawl.exe TID: 7356Thread sleep count: 66 > 30Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exe TID: 7356Thread sleep count: 38 > 30Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exe TID: 7356Thread sleep count: 57 > 30Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exe TID: 7356Thread sleep count: 51 > 30Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exe TID: 7356Thread sleep count: 72 > 30Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exe TID: 7356Thread sleep count: 51 > 30Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exe TID: 7356Thread sleep count: 44 > 30Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exe TID: 7764Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\Crawl.exe TID: 3220Thread sleep count: 92 > 30Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exe TID: 416Thread sleep time: -922337203685477s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\Crawl.exe TID: 5764Thread sleep count: 131 > 30
Source: C:\Users\user\Desktop\Crawl.exe TID: 5764Thread sleep count: 35 > 30
Source: C:\Users\user\Desktop\Crawl.exe TID: 5936Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\Crawl.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeThread delayed: delay time: 922337203685477Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeThread delayed: delay time: 922337203685477
Source: C:\Users\user\Desktop\Crawl.exeFile opened: D:\sources\migration\Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: D:\sources\replacementmanifests\Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: D:\sources\migration\wtr\Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: D:\sources\replacementmanifests\hwvid-migration-2\Jump to behavior
Source: 1696333829746.67aa4432-87f8-463e-b422-f6679add9971.first-shutdown.jsonlz4.0.drBinary or memory string: "VMware V[
Source: C:\Users\user\Desktop\Crawl.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 1.1.1.1 -n 1 -w 3000
Source: C:\Windows\System32\notepad.exeQueries volume information: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt VolumeInformation

Lowering of HIPS / PFW / Operating System Security Settings

barindex
Overwrites Mozilla Firefox settings
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.iniJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal.ywDmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.dbJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.dbJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829737.9f7a5e7a-2be0-4ff7-b132-b1f6e59a8e58.event.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829737.9f7a5e7a-2be0-4ff7-b132-b1f6e59a8e58.event.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829702.cde8135c-88c3-4c34-8670-7ef017742548.new-profile.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834606.011115ff-9301-40fc-805e-ba07b7fdfce4.event.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834606.011115ff-9301-40fc-805e-ba07b7fdfce4.event.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834620.c7889da7-33f0-4599-8452-58d47c58437b.main.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834620.c7889da7-33f0-4599-8452-58d47c58437b.main.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857869.95af30ae-acac-4802-b983-233d7fd3cf34.main.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857869.95af30ae-acac-4802-b983-233d7fd3cf34.main.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829746.67aa4432-87f8-463e-b422-f6679add9971.first-shutdown.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829746.67aa4432-87f8-463e-b422-f6679add9971.first-shutdown.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.a73949a2-5a70-4025-8008-88156c16bb4a.event.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.a73949a2-5a70-4025-8008-88156c16bb4a.event.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\background-updateJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\eventsJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1435a377-bbaf-4c9c-8706-0811a779fa3fJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\15f01145-7764-450b-9ad5-323693350a9cJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1d5599c8-3f43-42cc-8163-9a43c60a06d1Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\78267ebf-1fb3-4b11-82e9-903e54a2a54eJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\808127e8-e7ed-4078-b3f3-7f09061a011fJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\3a40aaf9-3f8b-43a2-85e8-88e3ffc7666fJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a5d6ec76-765c-4778-afd2-1e05a1554d8eJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a7174184-f177-48c4-876a-8a51c2ed8fbcJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-wal.SQuoJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\parent.lock.DfJxJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal.OBYhJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.dbJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.dbJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.jsJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.jsJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\45e26519-596d-41a5-b290-e547b44111fdJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\6fc53411-ad83-4cf6-a5f6-905f0f3f52e8Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\.metadata-v2Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-wal.utRFJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal.IGtVJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-wal.SRdgJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-wal.KAOUJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-wal.kmYVJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal.GwmUJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Telemetry.FailedProfileLocks.txt.IhvTJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-wal.PwtfJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\Decryptfiles.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\times.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior

Stealing of Sensitive Information

barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.dbJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-walJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829744.7278f154-e8f4-4235-84c5-c5c1c6af0084.main.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-walJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\7278f154-e8f4-4235-84c5-c5c1c6af0084Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\times.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a5d6ec76-765c-4778-afd2-1e05a1554d8eJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.dbJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\45e26519-596d-41a5-b290-e547b44111fdJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Telemetry.FailedProfileLocks.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\15f01145-7764-450b-9ad5-323693350a9cJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1435a377-bbaf-4c9c-8706-0811a779fa3fJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\parent.lockJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-walJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829746.67aa4432-87f8-463e-b422-f6679add9971.first-shutdown.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834620.c7889da7-33f0-4599-8452-58d47c58437b.main.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-walJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a7174184-f177-48c4-876a-8a51c2ed8fbcJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-walJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\12f997af-c065-4562-b9f6-11000bb95c9bJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829737.9f7a5e7a-2be0-4ff7-b132-b1f6e59a8e58.event.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\eventsJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-walJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.jsJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Crash Reports\InstallTime20230927232528.szWHJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-walJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\05d02ac8-b2f1-4670-8541-db8ec2bbf427Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-walJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857833.45e26519-596d-41a5-b290-e547b44111fd.health.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.iniJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\78267ebf-1fb3-4b11-82e9-903e54a2a54eJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\6fc53411-ad83-4cf6-a5f6-905f0f3f52e8Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\808127e8-e7ed-4078-b3f3-7f09061a011fJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.a73949a2-5a70-4025-8008-88156c16bb4a.event.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-walJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-walJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\3a40aaf9-3f8b-43a2-85e8-88e3ffc7666fJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.jsonJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\7d12ac42-15c3-4db9-abfe-259bc8d249acJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\277ffbb3-8e94-4f3f-acac-7a401d130160Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txtJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834606.011115ff-9301-40fc-805e-ba07b7fdfce4.event.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\.metadata-v2Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834580.6fc53411-ad83-4cf6-a5f6-905f0f3f52e8.health.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1d5599c8-3f43-42cc-8163-9a43c60a06d1Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.81ddb4cc-1d49-45f2-961f-e24ea6db2be5.health.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqliteJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\data.safe.binJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857869.95af30ae-acac-4802-b983-233d7fd3cf34.main.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\background-updateJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shmJump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834608.65054280-9d54-477d-a3ea-afcb1f88e001.health.jsonlz4Jump to behavior
Source: C:\Users\user\Desktop\Crawl.exeFile opened: C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829702.cde8135c-88c3-4c34-8670-7ef017742548.new-profile.jsonlz4Jump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation11
Registry Run Keys / Startup Folder		11
Process Injection		1
Masquerading		1
OS Credential Dumping		111
Security Software Discovery		Remote Services1
Archive Collected Data		Data ObfuscationExfiltration Over Other Network Medium1
Data Encrypted for Impact
CredentialsDomainsDefault AccountsScheduled Task/Job1
DLL Side-Loading		11
Registry Run Keys / Startup Folder		1
Modify Registry		LSASS Memory1
Process Discovery		Remote Desktop Protocol1
Browser Session Hijacking		Junk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
DLL Side-Loading		31
Virtualization/Sandbox Evasion		Security Account Manager31
Virtualization/Sandbox Evasion		SMB/Windows Admin Shares1
Data from Local System		SteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook11
Process Injection		NTDS1
Remote System Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
DLL Side-Loading		LSA Secrets1
System Network Configuration Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
File Deletion		Cached Domain Credentials3
File and Directory Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync11
System Information Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1585300 Sample: Crawl.exe Startdate: 07/01/2025 Architecture: WINDOWS Score: 100 69 Antivirus / Scanner detection for submitted sample 2->69 71 Multi AV Scanner detection for submitted file 2->71 73 Sigma detected: Delete shadow copy via WMIC 2->73 75 5 other signatures 2->75 7 Crawl.exe 4 1001 2->7         started        11 Crawl.exe 646 2->11         started        13 Crawl.exe 2->13         started        15 notepad.exe 2->15         started        process3 file4 55 C:\Users\user\Desktop55WTVCDUMOB.png, data 7->55 dropped 57 C:\Users\user\Desktop\DVWHKMNFNN.jpg, data 7->57 dropped 59 C:\Users\user\Desktop\...\KATAXZVCPS.mp3, data 7->59 dropped 61 111 other files (107 malicious) 7->61 dropped 77 Self deletion via cmd or bat file 7->77 79 Deletes shadow drive data (may be related to ransomware) 7->79 81 May encrypt documents and pictures (Ransomware) 7->81 83 3 other signatures 7->83 17 cmd.exe 7->17         started        20 WMIC.exe 1 7->20         started        22 WMIC.exe 7->22         started        24 cmd.exe 11->24         started        26 WMIC.exe 1 11->26         started        28 WMIC.exe 11->28         started        30 cmd.exe 13->30         started        32 WMIC.exe 13->32         started        34 WMIC.exe 13->34         started        signatures5 process6 signatures7 48 2 other processes 17->48 36 conhost.exe 20->36         started        38 conhost.exe 22->38         started        65 Uses ping.exe to sleep 24->65 67 Uses ping.exe to check the status of other devices and networks 24->67 50 2 other processes 24->50 40 conhost.exe 26->40         started        42 conhost.exe 28->42         started        53 2 other processes 30->53 44 conhost.exe 32->44         started        46 conhost.exe 34->46         started        process8 dnsIp9 63 1.1.1.1 CLOUDFLARENETUS Australia 50->63

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Crawl.exe43%VirustotalBrowse
Crawl.exe50%ReversingLabsWin32.Ransomware.REntS
Crawl.exe100%AviraHEUR/AGEN.1319254
Crawl.exe100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://www.ebay.co.uk/3870112724rsegmnoittet-es.sqlite.0.drfalse
    		high
    https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDFplaces.sqlite.0.drfalse
      		high
      https://www.avito.ru/3870112724rsegmnoittet-es.sqlite.0.drfalse
        		high
        https://github.com/mozilla/webcompat-reporterextensions.json.0.drfalse
          		high
          https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpgprefs.js.0.drfalse
            		high
            https://www.amazon.co.uk/3870112724rsegmnoittet-es.sqlite.0.drfalse
              		high
              https://www.ebay.de/3870112724rsegmnoittet-es.sqlite.0.drfalse
                		high
                https://screenshots.firefox.com/extensions.json.0.drfalse
                  		high
                  https://www.amazon.com/3870112724rsegmnoittet-es.sqlite.0.drfalse
                    		high
                    https://www.ctrip.com/3870112724rsegmnoittet-es.sqlite.0.drfalse
                      		high
                      http://crl.rootca1.amazontrust.com/rootca1.crl0cert9.db.0.drfalse
                        		high
                        http://ocsp.rootca1.amazontrust.com0:cert9.db.0.drfalse
                          		high
                          https://www.wykop.pl/3870112724rsegmnoittet-es.sqlite.0.drfalse
                            		high
                            https://twitter.com/3870112724rsegmnoittet-es.sqlite.0.drfalse
                              		high
                              https://www.leboncoin.fr/3870112724rsegmnoittet-es.sqlite.0.drfalse
                                		high
                                https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-brplaces.sqlite.0.drfalse
                                  		high
                                  https://www.olx.pl/3870112724rsegmnoittet-es.sqlite.0.drfalse
                                    		high
                                    https://www.youtube.com/3870112724rsegmnoittet-es.sqlite.0.drfalse
                                      		high
                                      https://allegro.pl/3870112724rsegmnoittet-es.sqlite.0.drfalse
                                        		high
                                        https://support.mozilla.org/products/firefoxfavicons.sqlite.0.drfalse
                                          		high
                                          https://MD8.mozilla.org/1/m3870112724rsegmnoittet-es.sqlite.0.drfalse
                                            		high
                                            https://account.bellmedia.c3870112724rsegmnoittet-es.sqlite.0.drfalse
                                              		high
                                              https://weibo.com/3870112724rsegmnoittet-es.sqlite.0.drfalse
                                                		high
                                                https://www.bbc.co.uk/3870112724rsegmnoittet-es.sqlite.0.drfalse
                                                  		high
                                                  https://login.microsoftonline.com3870112724rsegmnoittet-es.sqlite.0.drfalse
                                                    		high
                                                    https://bugzilla.mo3870112724rsegmnoittet-es.sqlite.0.drfalse
                                                      		high
                                                      https://www.ifeng.com/3870112724rsegmnoittet-es.sqlite.0.drfalse
                                                        		high
                                                        https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYiprefs.js.0.drfalse
                                                          		high
                                                          https://www.zhihu.com/3870112724rsegmnoittet-es.sqlite.0.drfalse
                                                            		high
                                                            http://x1.c.lencr.org/0cert9.db.0.drfalse
                                                              		high
                                                              http://x1.i.lencr.org/0cert9.db.0.drfalse
                                                                		high
                                                                https://www.amazon.fr/3870112724rsegmnoittet-es.sqlite.0.drfalse
                                                                  		high
                                                                  https://www.msn.com3870112724rsegmnoittet-es.sqlite.0.drfalse
                                                                    		high
                                                                    http://crt.rootca1.amazontrust.com/rootca1.cer0?cert9.db.0.drfalse
                                                                      		high
                                                                      https://www.google.com/complete/3870112724rsegmnoittet-es.sqlite.0.drfalse
                                                                        		high
                                                                        https://www.google.com/search?client=firefox-b-d&q=&metrics#search.engine.default.verifieddata.safe.bin.0.drfalse
                                                                          		high
                                                                          https://support.mozilla.orgplaces.sqlite.0.drfalse
                                                                            		high
                                                                            https://www.reddit.com/3870112724rsegmnoittet-es.sqlite.0.drfalse
                                                                              		high
                                                                              https://www.amazon.ca/3870112724rsegmnoittet-es.sqlite.0.drfalse
                                                                                		high
                                                                                https://www.google.com/3870112724rsegmnoittet-es.sqlite.0.drfalse
                                                                                  		high
                                                                                  https://www.google.com/search?client=firefox-b-d&q=&data.safe.bin.0.drfalse
                                                                                    		high
                                                                                    https://www.iqiyi.com/3870112724rsegmnoittet-es.sqlite.0.drfalse
                                                                                      		high
                                                                                      https://www.amazon.de/3870112724rsegmnoittet-es.sqlite.0.drfalse
                                                                                        		high
                                                                                        https://www.baidu.com/3870112724rsegmnoittet-es.sqlite.0.drfalse
                                                                                          		high

                                                                                          World Map of Contacted IPs

                                                                                          • No. of IPs < 25%
                                                                                          • 25% < No. of IPs < 50%
                                                                                          • 50% < No. of IPs < 75%
                                                                                          • 75% < No. of IPs

                                                                                          Public IPs

                                                                                          IPDomainCountryFlagASNASN NameMalicious
                                                                                          1.1.1.1
                                                                                          		unknownAustralia
                                                                                          		13335CLOUDFLARENETUStrue

                                                                                          General Information

                                                                                          Joe Sandbox version:41.0.0 Charoite
                                                                                          Analysis ID:1585300
                                                                                          Start date and time:2025-01-07 13:31:07 +01:00
                                                                                          Joe Sandbox product:CloudBasic
                                                                                          Overall analysis duration:0h 6m 36s
                                                                                          Hypervisor based Inspection enabled:false
                                                                                          Report type:full
                                                                                          Cookbook file name:default.jbs
                                                                                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                          Number of analysed new started processes analysed:42
                                                                                          Number of new started drivers analysed:0
                                                                                          Number of existing processes analysed:0
                                                                                          Number of existing drivers analysed:0
                                                                                          Number of injected processes analysed:0
                                                                                          Technologies:
                                                                                          • HCA enabled
                                                                                          • EGA enabled
                                                                                          • AMSI enabled
                                                                                          Analysis Mode:default
                                                                                          Analysis stop reason:Timeout
                                                                                          Sample name:Crawl.exe
                                                                                          Detection:MAL
                                                                                          Classification:mal100.rans.phis.troj.spyw.evad.winEXE@37/784@0/1
                                                                                          EGA Information:Failed
                                                                                          HCA Information:
                                                                                          • Successful, ratio: 100%
                                                                                          • Number of executed functions: 0
                                                                                          • Number of non-executed functions: 0
                                                                                          Cookbook Comments:
                                                                                          • Found application associated with file extension: .exe

                                                                                          Warnings

                                                                                          • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, VSSVC.exe, svchost.exe
                                                                                          • Excluded IPs from analysis (whitelisted): 20.12.23.50, 13.107.246.45
                                                                                          • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                          • Not all processes where analyzed, report is missing behavior information
                                                                                          • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                          • Report size getting too big, too many NtCreateFile calls found.
                                                                                          • Report size getting too big, too many NtOpenFile calls found.
                                                                                          • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                                                                                          • Report size getting too big, too many NtReadFile calls found.
                                                                                          • Report size getting too big, too many NtSetInformationFile calls found.

                                                                                          Simulations

                                                                                          Behavior and APIs

                                                                                          TimeTypeDescription
                                                                                          07:32:03API Interceptor6x Sleep call for process: WMIC.exe modified
                                                                                          07:32:36API Interceptor10x Sleep call for process: Crawl.exe modified
                                                                                          12:32:06AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run XPSUDTARW "C:\Users\user\Desktop\Crawl.exe"
                                                                                          12:32:14AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run XPSUDTARW "C:\Users\user\Desktop\Crawl.exe"
                                                                                          12:32:33AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt

                                                                                          Joe Sandbox View / Context

                                                                                          IPs

                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                          1.1.1.16fW0GedR6j.xlsGet hashmaliciousUnknownBrowse
                                                                                          • 1.1.1.1/ctrl/playback.php
                                                                                          PO-230821_pdf.exeGet hashmaliciousFormBook, NSISDropperBrowse
                                                                                          • www.974dp.com/sn26/?kJBLpb8=qaEGeuQorcUQurUZCuE8d9pas+Z0M0brqtX248JBolEfq8j8F1R9i1jKZexhxY54UlRG&ML0tl=NZlpi
                                                                                          AFfv8HpACF.exeGet hashmaliciousUnknownBrowse
                                                                                          • 1.1.1.1/
                                                                                          INVOICE_90990_PDF.exeGet hashmaliciousFormBookBrowse
                                                                                          • www.quranvisor.com/usvr/?mN9d3vF=HHrW7cA9N4YJlebHFvlsdlDciSnnaQItEG8Ccfxp291VjnjcuwoPACt7EOqEq4SWjIf8&Pjf81=-Zdd-V5hqhM4p2S
                                                                                          Go.exeGet hashmaliciousUnknownBrowse
                                                                                          • 1.1.1.1/

                                                                                          Domains

                                                                                          ⊘No context

                                                                                          ASNs

                                                                                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                          CLOUDFLARENETUSENQ-0092025.docGet hashmaliciousDBatLoader, PureLog Stealer, Snake Keylogger, VIP KeyloggerBrowse
                                                                                          • 188.114.97.3
                                                                                          Quarantined Messages(3).zipGet hashmaliciousHTMLPhisherBrowse
                                                                                          • 188.114.96.3
                                                                                          U1P3u1tkB2.exeGet hashmaliciousUnknownBrowse
                                                                                          • 104.21.80.209
                                                                                          LVkAi4PBv6.exeGet hashmaliciousUnknownBrowse
                                                                                          • 188.114.97.3
                                                                                          U1P3u1tkB2.exeGet hashmaliciousUnknownBrowse
                                                                                          • 104.21.80.209
                                                                                          64pOGv7k4N.exeGet hashmaliciousLummaCBrowse
                                                                                          • 188.114.97.3
                                                                                          BnJxmraqlk.exeGet hashmaliciousLummaC, PrivateLoaderBrowse
                                                                                          • 104.21.48.1
                                                                                          https://rebrand.ly/3d446fGet hashmaliciousHTMLPhisherBrowse
                                                                                          • 104.26.5.15
                                                                                          DHL DOCS 2-0106-25.exeGet hashmaliciousFormBookBrowse
                                                                                          • 172.67.148.216
                                                                                          Sales Acknowledgement - HES #982323.pdfGet hashmaliciousUnknownBrowse
                                                                                          • 104.16.123.96

                                                                                          JA3 Fingerprints

                                                                                          ⊘No context

                                                                                          Dropped Files

                                                                                          ⊘No context

                                                                                          Created / dropped Files

                                                                                          C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.puIK (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):436
                                                                                          Entropy (8bit):7.499802209199181
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:kilNQVx4F2Oy0p5acxQQlft9NWljNj7GlNI3DJY1r9UCn:k2OVxVWp5BQGfEYlWzJ4rJ
                                                                                          MD5:FC3BD334DB8F1774E5682AA753B9268B
                                                                                          SHA1:80A33B92B77EF1DCC882B2B524A39221E8665914
                                                                                          SHA-256:11B243F97A4596D2C00BD1CDFC996BEA043F1111DCD0BF092C32D44D35B07677
                                                                                          SHA-512:46BCABF33B5F4D3BA75ADE6367F87163CCBB42203C64F0B411F69631DDEC92409ADF6BCA7B1C2DC4865265F2556AD13E61FD7D1D0C07D77131CD9990F6C23603
                                                                                          Malicious:false
                                                                                          Preview:9.7@......U8..yD.......P.:j..%h.ITc'x...M..0.%....RL.nZ..(8BK-.[.....K0[}%......:r.O....Q9...J....D..".y.y...I...n.W..9)F.[..q..OM.u(._..|.IO.\......8.1.1.....a6%ss..q.....^u.S{.Sbv.LV.|.5e.R.}K.....3..4.Xj.^....3...!{.....#........4.....\.f._P}..M%O%m....`*M...k.E.K.S...~.........z.Xe..qT(..P..w.Qnc..:.q...CC*.~.p.."4l.y.....Z..|.<.\5.....M'..'...O....8.....G...%.:V...(t0~...m.}$..\...&..Z0e.. .o..0xABADCABA

                                                                                          C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini.aMPW (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1200
                                                                                          Entropy (8bit):7.847975241102988
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:oUa3pkeqoU1QZMJ+HYc+jfdBMHaRm30JokFzyajp0doxpp1Q:tIql1wMJEDOYHaRm30Jogzyajp0GDQ
                                                                                          MD5:1C8CF07E86D143D9C13AA00178802FC6
                                                                                          SHA1:89B2ADCC9196AD45E17C4938DB0B7C1C4EF7258E
                                                                                          SHA-256:F3508B91227670365D31DB520CAA50FC427CDC981F00859A73F655C22F4069A4
                                                                                          SHA-512:215D06963D904211064CCE992FF3F2CE2091CCB327F0FEEAF04F32A24D2192FA73C8AC258925E4A827D29BFB602F2254F5119FD51432BCB77BBD09E646C8E8EB
                                                                                          Malicious:false
                                                                                          Preview:.w.K...@{.c.5....'...........:.GB._...e.u..~|}...t.e.....qBA.m..4..*.1..*4i5U.}...ck.fT...0..V.'o......?.-.%........,....+..j...@"..."..2k5:..g.z.~>..+l=#...u..I....R..+U.(.S.x.TfIT>x].@x..W.HE.........L.-._....o..i.......!.}..V......m.%6..7y...*._.<...x ...#H....G...fkK.b.8B3...d.>63A*D....nO...2;~..5Gm...r.b.....(.,....2,7.A.....-.R.i,8...zi..G.g.Dp....M..D..{.V..0o.h....3..."ew...<......q...ZIY.s..+...<L.!....FcS.I`{.......e|.Q`. .z.4.Ul..l..kI..J.B.d....Q[zhW...9'..)..U.G.N\ 5.S...m.....$......V}..s...|...........~d......rV.f\..]U..N.6......>..1"..".6.q...YHt0'g.u:]..n..O9.3....f.w_.d.L.R.8.....R,...Y..WIH....Z..V_>...:...K.f...c.p..`...n..{,..r.....p...k..T@R.R'.v.!<.....'!0....%gb..Tw...$.W}-?.....-jD?GPp..U.C"=.e.....{8..=.>..00<.`G..u..}.j....j..2.X[......0.<.E.,...^..Sx.....P;....HC.......V...S].:a(....A...@Y.p.......9..c.#.l..k....g..#.J..7.'...q..7..6.i.2.....j..J..w..e=L.7h..t3.1........0..E=..._>..gc#y...C..-)K.p..5q..

                                                                                          C:\Documents and Settings\Default\NTUSER.DAT.LOG1.eyTv (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):65802
                                                                                          Entropy (8bit):3.4093987051611547
                                                                                          Encrypted:false
                                                                                          SSDEEP:768:UDlezmPDxLaXBEACX+luNutzJlNYMy3vigy:UDlexc+W8
                                                                                          MD5:6A9FE9FEB1AE6BEB08690C1E566FE616
                                                                                          SHA1:78C8B452F307711CE72342FD0CCBAC3F814EC2C5
                                                                                          SHA-256:CE3F9939D69AF974F55A5FF0BC0CDC977A7BBD09ADB517C910AEE2494BC4E36F
                                                                                          SHA-512:7F7CD095EBD861745F203B651F0F636121D84F1113EE669C0F5F3901A6DD58B64309FCA154DEB1A86DB627335A77579FF23C35C65C97A80C36F00E9AF9E6515F
                                                                                          Malicious:false
                                                                                          Preview:lo...J.y...KDd...Y.......u........k...^A`.,.4....7.&...J 0.T......O..r..R+..MM....}.W?...-1.K...zSl.[.x..P!...S......f..->....(...;rE..V=..h....i..}..7.....Y.a.3.R|.E.....b...Z...}...u.2.ba...=&6fs5;..LR\.h,.N...}t.....A....*./d....C..J].7...}.....t..[......~pC3.`{...h..7...|F.sV..`.F]x.l4.....Qg...|-.Z....sZA...%.W).m..:1.l\....26...[.C./U...i.L.]...!....@>7..?Xt....SI#3.W...|.T..KE...d..."..`.4!.T...40G.%`r.........6...........K.........!...1.e....@.G.;.N....r..e.._,.....kg...ie.=.]V...;..\Vjp.A..T..8."|&..U..1....[.......]a....r.'......J.T.xd..".f..?j...x..p^..f.w..~i.I.N#...q(.,r.......Z.....yx..<.."t....U.-A.......j4@..=..am.9.[. N..&.b.I...<.O../Jv/.....?.\..rW..b..-.\..0....5...l.<...-..1....`.Ir((...c.!..$...-..v.|U.s.Q}.g.`.7......eK...i0.Bf2....J.6.......0Z.'.M.....=..h...d....]sB..L<.A.f.L..qJ....&X.~....@.+..V.\.5$'..I..W..6.(.Q...81...]..F.v.z[g.Wex.&qJC/PE\...ER...)*#RD..9Z..^.~-'*......"......y.P.U...".*...R...M..i..u.$.$.^A....

                                                                                          C:\Documents and Settings\Default\NTUSER.DAT.LOG2.YJDE (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):20746
                                                                                          Entropy (8bit):4.755375452655067
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:2YSHz9L2BrSniNxePRhxtt2DWCz0389zcg3Xa7C:2Z9LmmniNI5hgz0M9zN9
                                                                                          MD5:4F5C48DC329CF6A5D10E00C31E63CDB0
                                                                                          SHA1:DB61D451F53B0D0DA3305729049708EDEE5B874C
                                                                                          SHA-256:2500557ADBABD0C9397A0446B86D2DF6131D933618506519FEC18BCAD78B7156
                                                                                          SHA-512:5779F1DDB8F21D44C6ED309244E6A0C1D73905749B769BCDBB0AE1AA29F2F16B9D9B37D7A079956FE2A96D0B1ED21A8DB1A376EC078302596CDF18DD5235DEB4
                                                                                          Malicious:false
                                                                                          Preview:...KffvQ[xh.Y.........aSD3b..B/=.......-aZ.i.&.+..........^]8G..}6......Qc.6.q..H........+.93.G.+.............B..ZU....%..M..|....VZ..:R_/5..ph...E...)d.A@..E..Z.przg.^.*..DK.$.c...m~|1g..e.%&.[_.?AS.@.)Q...q{......b.(!61v..k..:v..Ia...K...`..)..4.M.....$.Y.7..8.)............wh... t....h..>.~xvi...O._...T.a.0g.-[..S..D..x.....m(..h&A.&.(o..`|.f.y.'..b.l*.o.G3xK...S?.....'.Qf...sJ...P}4Y...z......V....`g.MN.k4)@..[+.:8z..I(..0!...g..;...4.>..., ...su.(VC...7.Y.s.W;.u...)..C.t..p....(c.!lO..nVD.s.Z../.{..........[l.[..Q...q.D..7j[F{,..;.kL.....;-.(m....^.....m.hM.1.x.p...........\>{.|..!.Z@?..q.!....0!..N.U..l.1_.b`._.....q.^.......6..'..s.;m.......L..F.F.....U&.....y...FO.0.k...... ...........<35..|...,..c.@\7A.?%..z.C.E.:K..s....32..j..~.*q[...........(...1H..>j..k.i*.......p.5kh...f#!...^...#[...,_...O.&2.'..l....>. .Y .{...c.+.B.-;1V.`6..;...D.Q.R*.~wg.)%.].bM.P.....Y{y...M...{.f.F.5.7j......mi.H.A.%=|.U0h.....M\.O....@Xj.='..}...TR...n%..

                                                                                          C:\Documents and Settings\Default\NTUSER.DAT.vtjW (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):262410
                                                                                          Entropy (8bit):3.163575162812944
                                                                                          Encrypted:false
                                                                                          SSDEEP:1536:XZ2iBRd/kjJbhu5zkBijAXU6fMo0+SYKLWe:XXBRd/OozzANUo5P8We
                                                                                          MD5:0DE20C81C368BC4871975327DBC73E28
                                                                                          SHA1:C0EF7B1DC8CA518797386FE14D8B9C489A97D65D
                                                                                          SHA-256:B2BA58159B4B3500B4225A403239C9F676DB27066C05571DCB764DCAFBEEC3AF
                                                                                          SHA-512:51D6E72C78CBBC6A32E56F00B9F0C5C31387AE7576356450BE350086567171051C19CD22D46A2A50EE85B210F6BCE35228AEE4B678D4B6EC06453C9BF4E37C50
                                                                                          Malicious:false
                                                                                          Preview:...y_.lH..b..`.?s..k.a.......,.^.s.....~=*>..@..x...p..b...=.Mj.j..h...i..?P.R.....Z.Z......#.q6LP3.p..*.j...s..i....+NF.E$.P.a....re......6.;8w.*&...N.y.7w.v....C..`..z.$5.c.....{.:....e..0...4X5G..dy .x.x=......e....$.Y*...\..*N...W>"..JK%..*"...-..S..u...s....._U.%P5;....i.N..P.c......3.v.'...^.M....U.TI..2..?.\..rQ.g......\F...U..^..<[....?.....}...K"......S.I....=...W..>...'x.-.......E...M...X.6V@.,.|....IZ...$.. .|...3Xaf..M4...yv8<.d...".%...gc.....Cj../.V..O..[O{..wN:..j..T..s., .8J.G.V..'..>.s..jd..Y.6B..;2..n._a....8=..Oe..jhK.....S....k.SP.".=...Z..C...%...)^.E...J6....2F.L.w.*..6....-i....[o..P..>..&.(...:?.....L.....L|.$.....>.VZt~.Q..m(<.&n...q,.(Y.jB}....O.}7a.....]..G...<.U.n.g...f.....Z.....).?1|.yl_.G.....i...I\.-=..{...J.U..Z.....C....!...s.N..f.8.M..........~.2.E3.;S4.....H_.u..../.W.qz..%C..bn...I....0,....5....qx7....v..QB.....+..T....f.j.6o.m.E..~.xa B...-9.D..........8)...U......F.Y'....Kr..._......bR..a...0.....%....K`.f

                                                                                          C:\Documents and Settings\Default\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TM.blf.MNbs (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:SysEx File - ADA
                                                                                          Category:dropped
                                                                                          Size (bytes):65802
                                                                                          Entropy (8bit):1.0522830230091045
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:ntqaHiIc7DiPRgW7swf9L8cjrDRkseaWxRksc:nsaCoPRlxfxDrFDWXw
                                                                                          MD5:679CD4DB4CE8B69048DF351196173FC2
                                                                                          SHA1:E3E6D5CF7A777290FAF74835A8C9D544430D090D
                                                                                          SHA-256:B1FE92136174A205F59A7D65BF3DDD2A6ABDCB3E9009F7FF4D397FA19A6A5AE1
                                                                                          SHA-512:325B41C0464D841661D2FEB2ACFF42123A9D6CB93F9FA944E12781DDB71621771B0AC7B6C7C97B0D8617A4734728BA7A7228B59BC8FFF487EBE4FA424CD79FE4
                                                                                          Malicious:false
                                                                                          Preview:..#.g..PP2;.b..M.&...........X..k.c.x.Xv...>........r..S?.sC ...3......3P sg....Z../..EA..#<......0......F].1..W+m&.... (.....n........2b..o]]...!p:X"..]....OT.9O.hb...i...V...|...6|N..i.....b..Y......6{8;.&.{r....ZCn...f...^.5.#./&Y<......s.N.^#../zV.......e.!V...m.b.?|...$R...l.m.#..4O......J..YE.C....y:;.[2.bJ.......e*!...K=7B.'=.{b.S0uuu........6Z..7D.8nQn..l8.Aa..>.......r...0.8..8..@..u...?..Q^...I{.|..^.hE^.].Z^...x$.~...9......%.Aa..._w......@.....F..L.Y........"......I......OK.i..2.!.nf...b...*...]..e...#@x.71e.C...>.........~al.....j.....7....sC...]"`D J...N.........c....H....0V.7...tE.D...$..^.S...x_.W..Q..W .........}Z...."S....L..`.f...2.la.}.bo...!Q'.]C...i/...cN2..n.}..ieO.g....o".-.6(...Mw1.U.9....hG=.O.y.G...D.^3.e...L..S._.<.;.).C,.M....Ex.1..7..!y.@.4.Z..j(7.^~.>.EZ....TS....d.Z..Ui.g.uj.`.Y.r[.{..4.....^.~.V......!...3.J........9?.....u/....Z.i_......IP2..\0I...L...{....i2...sm.S0.C.f.@.t-.Q#...ZI..........*.C

                                                                                          C:\Documents and Settings\Default\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.TbJG (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):524554
                                                                                          Entropy (8bit):0.1348714842428908
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:mERQPai49oEJUbKTMtqCelbiskHwME40Mm3ku06rfvlaBcAaw:e4oEJUeTMtqdi7VOMokuH9aHj
                                                                                          MD5:07E41E7727E610A2FEC2EE2C7F7B4798
                                                                                          SHA1:9A48219D9FF4CB235849483F00CFAEB6B197F4A9
                                                                                          SHA-256:2F7C6BC4D6C0D39E15F40532B6A04338D10E89A1EDB8D0C81C8F2F66324ECF9C
                                                                                          SHA-512:FF62059079677C4F8F3BE59931C82F35C7BC52714B07B5B33A99D750E5844024E56F5B55A4AC91F11B54793A8ECBFAFCF423822AECC0250501FBFD22DB063A17
                                                                                          Malicious:false
                                                                                          Preview:.[.a`.K..1....pTVNK". ....a.....l.|{B..^.... .....=.N...l.........9G.......=...i...N..........M.].0.X.9.......uK.6;..O.cG....z .oc..........<Cn..QM..[YsPb..d}..<A)..O.2.C..6.jAy.........o...6.k..7.j|.._N.......{..J.aW...1SZ@.O.k.u.l.Rr}...KF....?5.k-....\...>.........g....K.q.!...K.<..m.......).....u7..P`g..=..........$..."...].../.$J.N;q......{A..D:h....'g&...%.2H.2......c8.h.........q....}Ugj.M...Oe..|..)...fc....%.0.BNX...5..}p..&.q(.=.G...........A........4.u.5.....y.1ZE.8..u.V.._|...........=2.Y-.g=....}+...M...4:.....M0]&.zf~...!.<=.5..E.T=UQ#.k..yH._g......#.N.{.p.5?..a....(....3......d.Gj.r}.TD..,|..=.....Pf..TB9V..6.(..;o..n....8Q..I...@.4.w..T@Az...G....|K.T.{C.k...u&....E......N..goO.U.=./...?.J...HY.O.9...4....wOB...Q...-..+.-..8...D..-|..........N..y.<5K.s.c..5.B.S.]...\HS<(....y....]I.D..8......:HJ.}."....{oZ.]l9..]..T._....Q....<k{.......x.R......#....T8.............0....-..j..q.mS..Q_.}Z.ci.............V.B.@(q.E..8.m.g.

                                                                                          C:\Documents and Settings\Default\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms.DGgx (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):524554
                                                                                          Entropy (8bit):0.13528055512601456
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:zHYRY1PTlZd/PbAiYvafZt3CD9DsW57MnGkptBLTpJjCLq9w/:DYGbTe6ZtyprQnGUt4+9w/
                                                                                          MD5:DE8477432ADE352D2DD9B520F054C62C
                                                                                          SHA1:07B1AA93CFD407A84D040E564A0F5D32571C4981
                                                                                          SHA-256:3B173B2E944C59850B96CBE29539933E8FD8CF08144ACC6D247E7C6CF50EF6D0
                                                                                          SHA-512:3B2B905A65584ACCC550283BA95A8C4B6ED9F2EC8B99D3BB2AF88E13F74EB692CF349431C84498AE50DBD76F0BA8EDFBDA81720FCE863D2AD3CB11E8D6235721
                                                                                          Malicious:false
                                                                                          Preview:...t.A..Q..U..L]*Q9'....(C'..`.d-+-.[]..}...y..v.%.IV..t'P..3.a.>....`\r2,.).r;....h....4Fl...........q...~..9(+z.......Q`.|8d.._.H....+=C.N..N2......_...m..H/.O...3......g.....y.@3.U*YD.=m..E.G.8.....lwEp.....Z@..P...HZ...3..[)R*.>]4.f..H.......c..X%g.:....)..~....k....y...t.......d.o+.Q..h=`m........l..........!.S....d.2........q........;.....~....,....e;L$>*.5......Z.._.......8..-.Z.~....l...&.D!u..@"[c1.S<...^.).o.@......jJ..#.S.K...m.a...".w._........U.....a.cY.{.......,.B.}&.r..m..\}]...P.-...+......=N]o...6.....p..m...d..#.py.u<K*i.f...4...."r.3F7F.N2e..F.eesHEL.F.H.kH..!m.a..P..~dd..U...k[..2....=b...3.........6.........'.\......]6O.)....;.4.[6!.o.u,.w..4.*.*......X...X.r.-p..1......tZ........P.....!H =..."u....'....+.d,.;.q.?(5.v.D.......n{.pt..;E.........WY]P#B.Z:+....#.....X.EL..Q.."s..^.<.U..l.K..L'.9.3..N&..^.Jm.)....Y.....&.!..%+<.(k.. 8t.Tv.cV..........>t#.v5.Q....3..nZ'.5.....I}...L...A<..t.:..H.d...i....Hg..9....K./A

                                                                                          C:\Documents and Settings\Public\Libraries\RecordedTV.library-ms.ZnDU (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1265
                                                                                          Entropy (8bit):7.82599268115329
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:U6VatMe0Lgkx7VnbNKOhm0DXAVxagn451QtEnLGQgUpAoUrU8oJwSN0FFbu+Ugtn:U6UU33bNKO3Dwzvn451QtsbgJor+BUg5
                                                                                          MD5:B1A39D31E9908838445B3B16D3D164B7
                                                                                          SHA1:2BAFF9BA55295A4D4D29A39298BE8ED59D99C273
                                                                                          SHA-256:B2D9DF95E1A7AA47EA743EBC2E9F924FBE592CCED5C97ECC4348A32DA9F5D79F
                                                                                          SHA-512:F3079BD75092C5B37FC01087213B8214900834CA50B14CBA5149006F978B2CE60B0C29CD37A6226FF57D9DCE6517EDAE903787EC9AB781BCB69E1E0427227B87
                                                                                          Malicious:false
                                                                                          Preview:.yx..."..."[Mo.&....i; )Q....+..Y.}.-...T........C..../....._.....=....Pp/W.![../..+.......h.8L..@.z_qY.Y5[.........v6...C...v..++<.Z.c...T....*..N.xW.z.e..A:.)H..=..N.B`w.oP....y......*......x....i..t...S$.......B....C..1"57......y...K$~.%.3.(|........x..&Z).M..O...C..vR.....cz....;.....j....Z.t*.l1.$.A.g.Z.9>....O..8.)a.E~../....x.d.H...._.}.....atp.....mCi&K....F...|..Ym....h...V....XM..:....o.'...0H..!....8a.......!..]-...g.y.i....J!..\nOR..U..`.O.n.da....PA...l.*+^......vP...b..8...+..Gz;...GTc.......N.$3...jD+...A.g..V......w..D=....X.r.....A...p.@..Y"|HkDO[.WO.v...sg.V.....e-9c. 9.dM..\UH?.S...mC..^?6..Y.=.C..4Z....v)....i.@K...Nb?..7...E.......n^..... .....)D..*6...0y7".!M...s...J..*.....\...ch...'.&.. 9.g.(y..l....!.V9............).bY.N..V<..H.{._C..W...7*+..j.b..(Q..9O.o@.P.cR,.U.<...jey....F.,8...1....k,{qM......^y..H1o2...Fo.....N..c.17=..xSk.2..K8...9u1.j.|G...k.Z.....G!|.o...K.....(.o..T@lr....h|...A../.w..+&@Hn..tion>...

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData.NdHL (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):288
                                                                                          Entropy (8bit):7.243375154202293
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:sM2VbcK8gk4D61m+HWUeZ9kZtFw7d/l0deUPbJo8zMcidkExn:ecYt61FG9kzFwBllQ5zdI3n
                                                                                          MD5:D37CDEC53B7DC6A0AA3B98787542839E
                                                                                          SHA1:4FC9119696B5FE5122C0C42C138CF9E573423DF7
                                                                                          SHA-256:3251CC45ACA12F6D2D1A02435546FB116061CAB87DF88CBA70C9C4DF346F02A6
                                                                                          SHA-512:195AA4C4EEA6F46B205F315F128F21BA3C1407A427FD49E64954B807307DE9B83065DB8E174B6EC77E550422C9678B3E510BD22B379A5299E372B1393FEB2403
                                                                                          Malicious:false
                                                                                          Preview:x\.^-{.j...C.K.>>].>>..K-...E.....5.G.G..@e.......V.7.....2...:.-}.Q....n.W.&..>%D....e.`.o..P/ek..SVUm<..R'...nv...34...../.s9.O&...M[Qx.....U...^2k.5~V|.C+d...R.t....-..E.t..k.......-.6hq[..k...F.....R.A&..;j?..E.......^\...-.....Py.L....+.{j.|J.d.v9......:za...0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings.Htau (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):290
                                                                                          Entropy (8bit):7.244265707253575
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:QlrBHKLI5sGMuw4Soo6296JSheikTbugWdNzVIIWhqmn:QlBHdRM5N6VjyNBWVn
                                                                                          MD5:A4280DD4ACF72E5466207CB13A759933
                                                                                          SHA1:0860F1B090AB940CC63DC95FED03432FB2CF9CCE
                                                                                          SHA-256:93A41B1A23F94FE4F3329AF11E9922BBF65A867D7DB1553E6A8F7A7C1C7E93AF
                                                                                          SHA-512:C8E260385CE9601F71C397F45ACF11CEC1FC15A9FF37ED7282C90874C7779901CF2632884C3BF3B26E5BFA3AEB70E4CC5A2DB782801EBBE4ECCAE760E350F0A0
                                                                                          Malicious:false
                                                                                          Preview:m.1...|h...h_..<<>>].>>.vIZej)"..<.\8..e..^)j.....c..f..O.4wZ.<...h.cy...t*.EI. T.T..P/o~? ....!..l.Ed)...X..{..o....\.T.C.;\.M.@.}.7...:X..i..8...9Q.Xp..Fl...y.P.....1...5.......n"V....?..Q..k..t..h.>.S..K.......;....Z.Juy.Irq...Hj<......u...d.....!.$+.8fe.+ci.....0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl.jdHk (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):67070
                                                                                          Entropy (8bit):6.569253511866881
                                                                                          Encrypted:false
                                                                                          SSDEEP:768:4xHLf1WMFHmw8XJZZZe/E4XdNSirWriXYWZZMZ/dYS8VLm+kig+GPG6rD2kSI:O7kumw8Zd5rYZGZutbzf0xn
                                                                                          MD5:8CAB86DC77D8A57B73C4C8E5CF3C0EEC
                                                                                          SHA1:E037514586BE029DC06EDF42941BFF6E9FA08723
                                                                                          SHA-256:E157BDB13992DFB40B26406A035C6A58611634307F3AC0CFC287C39B6B718A75
                                                                                          SHA-512:B1FA4DD2BF4919CD1CAAAB7D6F9814122D398200DDC2BF8EEF8FE7696FB7C3FFB513BC617C1FBAB00E1DF128529F6F6A368544C7746FBE1365DEAC16C9043421
                                                                                          Malicious:false
                                                                                          Preview:..Q.{/H....x.|P%Q..|....o..o.6...$........{..G.Y?`TP...Gt.vh0M.....r.......>...>.ul...h..O.z[?.).Lz....5.....S......za...#....n0...5.....y..'+q...$.P.2.c.(.w..4./U..}....Q....}.<.>.@.P./...-X.W........Z.b1..^.V...%.dg..<......g.d.y...V.A....a........3.....R.{.KY<!^.c..&f....D.^S.V.......}.V..."R."m......h....~..A...n. ...`.N.......=.>.p...,4_..H...hLb.z.....~...L4+;.U.s...............ab..2...ZJ...C...v...."....0..T....MM.O"...A.....s{.;.....&h/r....s@..BB*..f....5....E...R....-).v...3v!U.a.bY..y..A.='...N.8L).$.WQ.E...%r...........U9.G..!.....[....K........+..._0.....].5.............(.Z..{.........J..9>..6u.H'-.p..D.$...J.)....c>6.."^...hwF}#$....o..........v....S.J..{U.UR.....K(3.*... Mx.K......_.ZG..NM..A<./1..L..%%..:Z.......1.{_|<..}.Q..VjN]2y^<|h...i-..y.E.9..Q.......T........E=.#.N..C..V.<(-.i....k...cH...^.70..b|>.......#...1.........}9......N.g.0..NE....N.K.=..w.Ny.....)..%..4.X.....4.....W?..........e.s...

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl.DGor (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1003
                                                                                          Entropy (8bit):7.7966571700737175
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:BwxJdco/bX5p7qLhCDHvjLs0w/Lfw4TaCDGPJ3loLFLtYSH8:Gj5QFCDH7Ls0Sfw4CPvkLBc
                                                                                          MD5:4094193587448ACA27D1708347EAA606
                                                                                          SHA1:8118DCD42CAC82E40CE81C6FA58493B4C7A4AA75
                                                                                          SHA-256:14948FAF133580BB9F31D77D6DB68C74E4DDD336A32720B8BC97B18CFBAC796B
                                                                                          SHA-512:FBE6EEBD50ADE3CADC92362E0AC0BAC575BAB3A4C23D17719D5B0EF89F15B4C65457DA54441B1E3735E7C5442430488645A70E066E6111531496E54023121E33
                                                                                          Malicious:false
                                                                                          Preview:.a1=X...p..NG....[...KT_t..@Z...d..Bz(c .O.P.]....u=...X.Y...-.M..c.K......'..s.%(.A.g.t...3..=c..ee....HsO..x.j...= ....`..C_.d..G.IV.mxW..K..q.....r...k....~."..Y+...26...v.h....F|TS1E.qT....yS..i,.j..p.....]{eY...b....b.#..V5./.}#,\.(e....PY..R......M...D)w~..Ir..U..b..?.>IbBS.2.3~.......-p...t..pZ+..& .>1[..p..5..q...<d.._.=j......z.fnc...6[....X.H..zj..^....Po.]....47.ed3R...K..,O...8..V......#...Y......-.fj.p..[...DF..^<...%.1..`.G=..2.,..|....K...c6.......}.MP.y#G..L<..~.....p...i.`..O.Sy.=.1h..i..T..WZ...s.S../Ak..$.v5.n..zV#..3mG:H$...w.....z.d.0...V.5i7....%7\.~!p.....x...........(..zQ..`..5..@V.$..h.W..f.B.9.j....%p.{|U...R... ...R...,".j}c*4}..X.E>ku../.}.....z........z..a.I:9...R.......e..........]vt...a..u...].Sf.{.y.p.DJX./.H.o..Q.Sx..#..r.x..g*.U)Qlw..|.r.*.D..w$....4G.Mp..,H+Ly.Z=:.....~.t..f.*..Y...D..\.n./8,...U....c6.U..I..<"f..a.A\......9...,|..x...%R6.......r.-.A.t......i..e@..^.D...........c(.@.4z..Lp..;..-..WJ:...0xABADC

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store.okib (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):10506
                                                                                          Entropy (8bit):4.266534901682183
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:xgMMWqoFBp8f3cwlqwZgK35/d7TMycaAYmqajK:MiBo35UKgUK+mdK
                                                                                          MD5:06E33A6AAC27C85C86AC2FC5B10C0FD7
                                                                                          SHA1:AB2AABBF996DEFEE2055DEDA6367D4CB929A24CA
                                                                                          SHA-256:FCBCE2DF401AEEB95B0AE7454722812BD8B72DEBF58D67B9775CC2A83443E45A
                                                                                          SHA-512:BD251142D2196FE469D8C0D9FA967FA3018E5853808DB5A8ACF34A679F58DBDB85FD438ABE1691C3308432585ED4C8963BF8E0F3DFD3EFA6293C959E19F9696B
                                                                                          Malicious:false
                                                                                          Preview:'Yi..T.+1u......R........a|.oB.#C.'..y+u.?;=H...I3..\.hX....@B..(.CYqy..Z...._.b.....%^=.-..%.n..Q.U3-,..hB....>!.[ 6.....;Ub..,......;>j.. .<.B.I#.[..(...VP.Y.Z..j.fk.V....J.._..6...I..(dR}.......= Pq...gd...dyv.q..L`..J....*YB^...... ..ZP.V..G....2..v.t.}..7.047I...9..|...w.=f?...u\kuq.SC.....p...C....k.-..*.HF{..H.pD..6U%.3.w.[0.scI..i^7.v..5......Sy.._..^x.6...1=.1.M.9.'.hW..R.u..S.s..PN..\r..U....8..)..v3...r..{O.........@...F.,A...."....%.b.Kr.[!.....Xj*...j^.....s.qen..".:.Y.. ...A.NH.../.N.T....J..9U......[!.9.*....>...s..%P.2....H....t...:<\DoW.{k.i....(x..*6'..:..kH7u..!..Wid.0.z.n..;..zO.....M....W..*..w>.{.4.....H....F..hz./..N..W.S.~....m].......K.z..=..c..S.o..........{n.A[.:p..".0....(..,...lm.s..qm..{F...O8"...7.{..X..'[o...F...@.fN}.p.0.f...N......Ii.'.q9.$9.3.h..&....h_..r...B..`.._.q.mm..0..mtyX....s`p.)`_.+t..:....w.....^.j.Sc./....p..zi..+..!......pPB....rd..^6.hr..T...}.Nj.\Q.A...i.1.4....6.Z+...oL<...a..x..._`>WY..u.%..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.dtuy (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):24418
                                                                                          Entropy (8bit):2.3621088960230616
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:IjUt8XROOWAW6I9hU6gRTQi1Q+aGCFWEfp1vmR5tUpukg7Q+MWj:IjUt8BvkZ+QyQ+07puD7sWj
                                                                                          MD5:BD076E6DED64654B84948DD86807470E
                                                                                          SHA1:101D139846B79703F4FF117C83C6EC91C264E64A
                                                                                          SHA-256:83B64914A859DF8A85475246804BBE02F0094D2FB8A31105E6F225B294477242
                                                                                          SHA-512:EDD50AF1EA4CDB1A35416BA794B3B305EE05F1B6B670D5F355E273F251CFBA654FDC789154767969B158BF1007229B581AE3784AD790970D8BADC8466ADE6E16
                                                                                          Malicious:false
                                                                                          Preview:..pg..X..75....[V..I..u;x..)I.H..I..>..T*$..n3.RB.b.l.$......28...-l.yr...Lk..<.U..T\..s>.".D.h../|Q.....I.&..X2..ys,y.4....j.>...d.r....as.%.tc....O..Q4....K...............;......p.h.\.5....7..E.Y..1d..D.VQZ$......7K..Ie.<.U.y.....g.._.../.T.B.....;>.%j...3X...@...*.K(..E.8..d....$.C.....f..=..C..V.D0...W.7.}...w...zem.e.O..;.hx.....\./..'Qi..W.....=x.jl.T.m..E..%.bh...).o|.....z\.y...]..e..>.5.!..g..Q.yj.M:..f..&....xy..4.`..f6...... ..t..2..P.M..)Oo...m.t(..2u......f..v.Fwb=......s....V......#.eZV.]f...J.1Z.p....+K......q.J..I>y...LM.".JB.A[.x1.W..4.....[.s...:`..y.^u..b.M.OJ..5.so..o<@..b'.~.84.?+fI."n..i.:.l>...Y.6...ty..7.b..."l..;r.~>.......<. C.".........=..<E...{':...l...~.y...n.{.f,.p.V *.Q.u.b...F.w.;6..gx.......Y.y..._6J.....7.p..`.*..m.....(@'.v.>b.0.<........eZ.m....n.u...7N........iN;.F....Y.u..f......Q.....6.-....<..2..G....^v...$50..#q.AL....q]..G......h.8..%..e.....b.../...W..<#.(W3..{8.[9.;V..h|8..&].)..kVk$.Q.u.6-.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storek.pMyL (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):530
                                                                                          Entropy (8bit):7.593673192385571
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:gLqVKd/1PVavaVR3RpFi8AwWXsMJp+EtVUefUU0Sn:gWAlNVkaVR3nFi5X13WIV
                                                                                          MD5:372CFFC33DE9EF304A0E0454AC2A5A27
                                                                                          SHA1:F01DD6943FAAF4C205D1B22C5CBC2B30E7019533
                                                                                          SHA-256:EA342226CA8CCC14258E1660B28874F004FF72967F8E2B567E6EAB98659EB07D
                                                                                          SHA-512:C48C7B6C3839D3BFC9A0B8C0F322A800EF16A4A4D44CE040E1603832B216A7EF2E291492EB23CC8D96C374447AE2ECCDFEA6EA8E4C39DF2A0C3404018336830D
                                                                                          Malicious:false
                                                                                          Preview:O.vb..xpgk.y..."..`+"..Ll..G....[....+"8>'.A.YOd...Z*.S%W.r........p...#3.r.....]..l...........G.^..e...0...<.../.+..A].X..._B8c-...9..>?l. ....r.[.... W.sf.q.-....!..^.d=........j.......!.0%.K@PF.2.2&We..'t......0....i...,....R....wE...U.`.>:.^z.&.g;w^......j...( "..vZ..(.|O?(9..Hh..o./....Ij.E...=w.../7.m.)..).P'B...b.H.N.>._.%g..F.G...W.....%.6*%.Q....Tf.&......@....Z.y.#F....|......8.C..]+.`+2.]Q..Zj..~c..Y.*.9....3G!..^...~/.+L5.&D....6..~..(.Q/A..KFTz..X~'=.d.[k...................<0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata.kPbY (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):14722
                                                                                          Entropy (8bit):5.998454865117248
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:WcqAmp7Ni/Pb0lZ6mgtdHOelGdWaolvsTxEg:op7AwejJGxwGxB
                                                                                          MD5:99337845AFA51540A9EED695EF1A3C80
                                                                                          SHA1:4CCAB9AF636D739A1B77ED69FFC72CEB90475730
                                                                                          SHA-256:37114FAF80F2F293BAE9AFE004FBBDCC5B03FCC81FEAAB92A5BF1C345BFFD7CD
                                                                                          SHA-512:90761299B5D66401EDBC590A7703D787DEAD484BA1164150FD2BD15C8AA0DB88924A3AE398D14580EAAA2A78EF8001B62AD1A3E6E04D8CF63D2BBEC4E73786D9
                                                                                          Malicious:false
                                                                                          Preview:I....c/=.Y.x".S..Q.R............9ml..pD.AT@U...W5.......KJ..i.Z.f.<....]vR....M+..3.X..~^.%.....i:K.....c+...|.R........^..27n..I.*C.U9.g....6G[..!...!5......d...C.H,.u..2S.....PSa|].s.P.h..b....P......#...x.g......P.!...<.8.....^.B....0@=..%_:...*..f....]'..i..Y....q....}1.I3.i!...z.h.!.=C.DM..@._f......P...^D}|t.Ay.j..t.....<...@...".....EY..e.^........D..G..z.,...i.[W./+..`.h....E..lqgp.N..c..clj?....M..Gt..4.R.>....^..yS.MO..4.5./......J...+].......c..)>.,.V.'7.K..G....blL..A....{.b.._O.WEI.M..7=...'.....%......B.do..t.|l......fi..a.L....z.......M.....g.....[.m..F.l......PM>xs...3.._jdj........... ..n.Q....R.4....5....|pk.z......la........\;...BB.Jn.N.%.......x.j.......n....RH..}.c.......$c.w6dZ ...v............W.....X.:....Z8...".b.|..).hU..yD.n).~b.?.z.Z6......#e.B...b.w......s..a....6{U.,MFd&..L.A....8"#_V.Q._...9.f^.5...oJ..."..u....-9U.U...].1X_....").R]..;...v.""<$.W. ..=..I]...g..T.Y.....9h.t:....cs}.FN....!.!..&..".H..c

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav.PxWu (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):302
                                                                                          Entropy (8bit):7.206612542281084
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:v1lREwHaHzz5uY1xRGWEl2JKDLU+r/dClz8AgVOMNCYn:td6Tz5rtGdbUKk2AgVjCYn
                                                                                          MD5:8EB7320B850A0C347D5D918A86FC09D6
                                                                                          SHA1:C77AA67099C309DD954AF00F4B86D8382DBA1382
                                                                                          SHA-256:2EC8BB21329F6A251083DDDFFACAAC4A77912CDC85A6AAD59418439E452FEA09
                                                                                          SHA-512:F25055026FC60EFCD371BCDF7774801AB07DAC371846F5E58911A06AA31895497C8C16EB031F58229808A891A4C6A4FF0C4C41E23498FDDF6AEF7AE093253DD3
                                                                                          Malicious:false
                                                                                          Preview:..h....7R.+.e..Y.=.Y.b-2?.+.20........U1u.....Q2 u..........v.@A.W..e"$..:..&.s2.!.M...tG.i4.!.1..")....%Z....>>..j/:.(\.rsy=.=W.=.8....{...*.E...1.c.}...|.o.jN.4.R.m..F.x.f.3.%9.v...@'..c.=..i......"}4^.j.....=.E.+.......Z....6.....<.u5.e...e.[....( .L...}.......(.,.Fp.a.......0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav.tCWZ (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):320
                                                                                          Entropy (8bit):7.339172382298218
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:e37tRGzlwEt/JctnUJDnxjL4/UkVHWdxUCV4jx8+tn6jCbTkIaSN7n:erz4wMJctnUJDxI/U9dxdp2nQCJaSNn
                                                                                          MD5:AA6C87D29E16C6031F8B613C7930BEF1
                                                                                          SHA1:685B2E2C0B275FD3A62AC425EC3FF1F35A3807FC
                                                                                          SHA-256:369BD13672BDC987FAAF8C4C36E487AC782ADB2A828BE50DDADDE71CFF2A8353
                                                                                          SHA-512:C19D49157E712C49340D4F5D77AFDD8A573758DA7CA3C82E60FD5C50B3E4AD3F6CB2F07CA5F731279ABFDB5BEF06304EC43824E41A4A8CA206F53BF8FDEE6019
                                                                                          Malicious:false
                                                                                          Preview:G....M[.t....+...n...m~.Q...\&0..O?...a...9.b........&z.GHp......*).o...7......r..6x...*9.y..6..n....-.g../..5]..h....p...4S..R/7K.\2..9;....0......q..q..g...yW/+.-..fP.B.Ii.3.|....0D)....3...v.2-...k.b.y..g....T}.......+....Y"!"..wW..Z/............P.].W._f..}..e........C.k..?.<ly.....X..7T..N0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9e146be9-c76a-4720-bcdb-53011b87bd06.ebhr (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1226
                                                                                          Entropy (8bit):7.8329824259237135
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:jg24qaAOjmhwLE8E9AbMSw3+1zBQaOznl6bOVzTWE3MlEj0T/:k24qD7hE49AoSVCaOTQSV+E3vIT/
                                                                                          MD5:4FDED9CCD793AE764DD5DD1286DD9F53
                                                                                          SHA1:11EECE90ACB39555B2FA45F02091B2F7DC81C79E
                                                                                          SHA-256:FF16A0F5F685D8901CB217AF8AB2A9773723C7917734818782FEB9BFCE1E1840
                                                                                          SHA-512:1700D677C17A7AD18071AF793AE73AFC157293CC97C82765CD4C6C405A89069C3D0D7C68FB4D47963747711A1820BA5A8AC10CB3C7F85667D2915962A19B4DA9
                                                                                          Malicious:false
                                                                                          Preview:....N...%.h.Teh.8].mb:N...A1v...'.....V2..xC5..$.}'. ...h..F....".....\.0ug./..t...D.#2.22..'.g...z...2VY..v.{9.._e%.L...#..@.....!V.:....M=..E..yicY...-(..`._..X\k..Zpy...sa..V..I2....."..JX....S..b.9.A.......2..|g>..6fA{..!.........'3(c....X..(..I.o.S>.h.............V$2...rw.rW..#........Qa......t.d.....!.a..l..&.\c<YN...3@..[T..K.N...E.8.A.....5Y.H..EX("u,..*..=?...[.?.s..s..J...E0..~%.`.Z...KP._.{2.t8....1.7.$B.......dP.....V...I......{........g..Vr.. .c...iVy...F..e.A.Ar):..)..B..7......y.+4.......%..*.j.l.*.s ..I..8...c.c.{F]<K3[....g..%g.I+tj.l...Gj....x.zh.:pc..I..*.?..~...?./@....c...J.n.Y....[....Twx;...r..W.....@.".dG.f%...xA.d..uxW...l.K.n/..4..k.yS.....U6....jx.|......Y.='.@....~.Q....n.aP!!^.g.6._.F.....e.j.j.+..Bv...n.........b.......S.qT'.......a.D>com..I5..d..9....R.1..m.........KT...$...6.7.2....!C.h..r.._..z.N.......2.q'..VU......j.4Px.....RI.......?.M.......HN.F.9.....r...@...R+..V.uO..H...r.......,...k..reP..Fr.O...L...

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Protect\CREDHIST.Yhie (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):290
                                                                                          Entropy (8bit):7.185368067731313
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:ZEJeWOcpxZYNCCTcuA9qJ4/EwdJcqUV3xGeMUiA1khf17Jcpz/3Zn:qQJcpbYNBP4/ltUjGeMUi4ot0/Zn
                                                                                          MD5:80A0BF6E4ED02B62D357E5268F623487
                                                                                          SHA1:B151CCB43338A0F5D53AE50A65BE4BAE96BDDBBC
                                                                                          SHA-256:B5C991F259B8410CB48EFDBB71BE449F6FB28EA6B0C8C85663EBEBFD874F835A
                                                                                          SHA-512:46A7DF831DDB171313B11888EE69BCF5976D0C01BE4A608264389560CAB0BA9290F681D1982E90FDA3D6D5147D4E449903F3C5A888F3CEFA9C11BAAB41723168
                                                                                          Malicious:false
                                                                                          Preview:..Z.....9.;.l;.G..q.....G...?......L..eC|.[2...}.".;T2..$=.O.w..r?M.`......Tl..@......yn.0"...;#.$}..p}...,.....6...i.....X._...............4..8.YYW.y......6{r.0L.....&..;YZ....p.H.....t{/Q.9.....s.||.(J..Z..L..Dl".Z....x...{E....Q.B8.W......(..r|y...g.^|EB'....5R.7-.F,Z_..0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1002\3f1b70ec-2d1d-4c93-9a1c-a7a36da68c8b.amyM (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):734
                                                                                          Entropy (8bit):7.7405221939628515
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:BSwD9E9YyxI2fdeSBuyJ/8Y35I0pmc2Be6NNqajbkWv4CX4RBNuQzziBpbVF6sgh:BSw69BK4fuymYpjz2vNwKkM4CIRBk+sI
                                                                                          MD5:E7E0CF2118319D6A5CA56578202E5550
                                                                                          SHA1:3BB99D6B7B1CA486A513B9D72C9405D781D7EBC8
                                                                                          SHA-256:0874C1E822CFCF9AC29BC9483EDA675D8AC34B3E1FFD5C3B79241FAAD53A5A4D
                                                                                          SHA-512:D27ACB2D95BADD1FED0D9962CDF4C0D31AF1891D6D66C1AF41F30B782CF8F17A79C2F5927CB05AD6BAABAF617C2A314AC1F07EEE8FC9B2519785AFCA6E6A4F77
                                                                                          Malicious:false
                                                                                          Preview:.'.OC..'..h...>. ..)}..*....L.W}...`bW..}T.....:.........=....x..V..nC......Q.5.....>....}:.#....<.8.....>.E..*.8.7..,[..&.....9z.Goo...:(M.$$.K.X.... cR.Y.13.{9.......*..R.....R....).M.&p.#w..._>m.........o..._.AAT....CK...*.X.de.W..6.L....)nJ....>/...4..j.U..17#`...*..4..v.f......p.(..o.........p:...?....u..?....:.....\..r7yy.M.....@d...j'..)(KW..^...t..q.[.........a..(...{..'..G.T.....h......=(..M._...m.(...t...[.M......f.Yv......0...q.0.3N\q)......O..aK.;.FI.p.....]....:o..W.o.0S....D.b.Z.qe..e..P..........&.........".Z.Ba"..R.-E}k.yF....H7.,_..F)...&..lk.@.L.>.7.k2.R.n..?.Y..._!Q.4.V[pe.}...`.h.$..=.+.Oq.?.N?oC.".#..F....:.......+s..^..fE...Z.i... 8.......z.......,.%...0..h.0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1002\Preferred.FpOt (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):290
                                                                                          Entropy (8bit):7.3507962348038545
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:qhjuy97FwKYs0FixIuuzBYhwG+aHL+0/xKsgFvtLTudxuXRsOhHn:Sqy9Fwbpklhw3cKsgFZvRLHn
                                                                                          MD5:5F066AA43995F9D58F6CE7CE8D271EE5
                                                                                          SHA1:44D125783AD6BCB6010E0E62974F5BE93732F3C7
                                                                                          SHA-256:AF13FBCCBF497721099D0147CDB3BBC3B6ADA355799F80E68A76F0DED7713D1A
                                                                                          SHA-512:9BC0C5FDD64FF3DEA7AA530266648D4AB64BDF17BB22BA13A31455ABE6017B62424FCA60F0D376662C2D4B6D488053200693A6541CD04F2C5D1F7F98147ED675
                                                                                          Malicious:false
                                                                                          Preview:.5...G..eN....e...._.<..%....r..Hrf,.....w..x..5 )_..G.'4W.f3.h..Y{.=.j.3-.y..X.....V.....<..Q.K.E~.#q.....P..7f...V..a..6p....{z../...|.A........4.U...f.9......*....o.J/..m1.aX....O..........|..z...{x......`.5.+_U..-...n......\0F..#u....6b..u.6[pc..:...Q}..I@o.........0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC.CoXc (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):282
                                                                                          Entropy (8bit):7.264256715743548
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:02yLErZINYH266K5mjcxspYN96v56JLkWgBKyOESAYL49ns7Yn:FywrZINfM4jcmtv0wWmOESAYL49SYn
                                                                                          MD5:EDABB94C21AAE7BC5B4FFB1C162FDF4C
                                                                                          SHA1:9A45431F859F30912FD4658021801EE365A3E10F
                                                                                          SHA-256:3D9843025C080B355603CC322663CF1235D6BF77FFCC7F31E0F28F1C8F496C66
                                                                                          SHA-512:4D869231FE3EBCD1A948BA6AB7A29183CE7F99CB8D8821CE7A5697EE36FEFDD4CD41E9F792F6FE8FE2E2211A59B73C9C2CE169C017CE9C8C23255C5BCFBA4148
                                                                                          Malicious:false
                                                                                          Preview:a.......7..9...y...L..Z#._...y..|Q..k..."jgj...G..k..x:..Ip...@-oe9C...9..pT..G.^...;..-o...@.av2Y.[..D].E...m#o.....&....`..h.6.X.N..xp-/*)...J...4^...%.-....`uYP..G.NU....C.'x..{... ......F..Vr&.I.....V..m.8..`?b....D.yj3.Q?o..}..O!k...i.j.]d*_`.@~.y....0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms.jbQz (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):1284
                                                                                          Entropy (8bit):7.862939237833893
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Ek8WzeSYPGR0VIvDdUDwQEoUgj8YHY0PmNHE2uUSDUEEaeQjp87toKn9p:/weRIIvDdUDMYHYomeFiapVa/
                                                                                          MD5:41A6306E9645B38BE575CCA7EC997809
                                                                                          SHA1:4806643128E65FE597C83A607328963D3E06D4FC
                                                                                          SHA-256:F6DBB31AB2683FC1FEF4F7CCF315252DFEF0698738253BCC7BE1678B809E8414
                                                                                          SHA-512:FBCEE853A15248E5B7B6D442CDEE307BC6CE75961548F4097673EE660FFC6D2D2A1098776C350A8F4A9C57CA88C50F2FD74CAD0E94FBFEA560C1064957BCEC14
                                                                                          Malicious:false
                                                                                          Preview:...<......_.c......;.S..p...6.(..jH/L....q.0q..r^..2..'..(....26.l......,z..cA.X~..D.I.sp.0).u..`O......M.....l0...G..a(..9......M%6..n.h;i.H.n4c...Zn......5....ZMl.^..............G.;..LR.k&...{....P?w....8../..GC.......s.^wF..Y3...l....<...z.^j.+.h ...K.so...j..+.....+......HAO".QW.-......%.Gd.0Xy.`.R.........c2.Ct'a..K..6........h....S;.#f.>.!.....p..x.ng.....m.W..$C.....$......?.vw.NA.0. .o!Z..=/.....W..b.T......F'-.f8.[F......{Z...f....s..B./.o.........`......".a/p..)7....muzF......V(.B.......FwM...DQ-.:.h.&...._c.b...u....1S=.=..[.R..."k.-"....H....K.,.D$...2..+.K.U....*......4......%.$..u..j..J.MO4......w...`..\..7..#...O 2/.;.!.z.................._.E.24...R....(.98.Q..U>...I.k.u5.4.._..-O..z\.l..9.[.t....7!..S@....k..U.?..r5]..*.C@.z.f.....d9.....f.%.=JZ.0$;k-.1......3.....8..r...{.?V..".V.....%...g_..N.."1..Z..5.%}.o..g.S.8..#..{.a..r.p%.A.g_.c.Qaj..2o,Q..utk...............i.%!].z~..q0X.S(..Y....T.@..H..O.m.I..u...S.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms.zdtv (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):2356
                                                                                          Entropy (8bit):7.9209498569244365
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:kTvCzLlB7O6ovVOIgYwdoSyjAMqHiGN4NEqQT:4viLqhxgYwdipOima6T
                                                                                          MD5:9EC72A1CCE4F0812A74309D81B5D0839
                                                                                          SHA1:B1F1BDA5ED93814EE2687EB0076DA54904A730C2
                                                                                          SHA-256:9CA39425474F92E956895C9D4981A39388382DEC1FB97B962B487B420A85D4E1
                                                                                          SHA-512:F15B73DE21A3A27FD8CC823AA860037641D7DA3D0B24B2AD7D30ABBDF1E82C9CFB17FC9A804150DD0795E1E01B815321F967D45AD1818097F2C879B3E80C5DCE
                                                                                          Malicious:false
                                                                                          Preview:K.gf.J............<.@...,......F....Y.6.:..wa.Iz]Q4.....+.x.."..e...@.Ew. .u1.j.T.FE.J.42..{....y.:.w=.n.x..C.B.w.WVK!..._(,..M(:V..\.c.Yc~H.....i~.z.(........W.V..C(X..]..<3..Ne....).uM..VLW.....;..v....>.V.*...t0...66....=Gp.Z...?Q....Q.%..(..../.."g=..t[..%.b.....F......s.....r.[/.?W....,h. Xf.\...b...n....P..n.0.j.7.TB.,'..+..5.E.}`:.A*...a&.NF..}.3..l....KF........]..j.0.6B*l.$N..../8..,...../.w..1.....&.+.k.......N:n.S<R..@.....F-@7x...f.*......wM.'5..0.*$...D.{...........*.8c.....L...............x!a..q-....$.m....-.]{K.(W/....+....n..,.@.-.........j.[....1M......B..Q..!.#<.s....\..uq..'..}[..6......v.y;.;..H&......\V......7.......#.......}..V....#.....z...[.!..h.g....;...R~.P.Y.Ci..J.....Z.5.6.S....."fD.Hz^d0r......R...Js)....L.%|Dn1.......q...0....*.;`:R..B......*.....2F...s}...`.p16.....?..V.`.....>..xz....f5i.L.....96+HB..;.....=z...|DG..Mw..a.y...n.P....f.:..?.,...S<..B_..;T..C3.T.......^&....(h-.u...ld.S..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms.XwgV (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):2313
                                                                                          Entropy (8bit):7.908687742920132
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:t/epKnsowDCc92pOWiYFTtteeRWZ9Ns0VgV7LEf8hZyLCoVx1PhrsYYQjxb0g:YLowDC8WOKTqfrVgxRZy7x15eAb0g
                                                                                          MD5:FA4249F8B50C38623C5A4C2A0F51608A
                                                                                          SHA1:43C3A9987C51981AB124BE0939E18EF44199A954
                                                                                          SHA-256:AC65D4107530CFD5C941F29F0332AB35013C1DC4DFC46EAF8042EC1339A91B22
                                                                                          SHA-512:BCA7BC9C6870E71CA4D962F19A8DCAB93F73889B3B4E31DB9ABE624120FE5A33627478FD057DA906C37FB72C8DCBC3EF874FDC4A5FB34EB5ADDB078DB005457F
                                                                                          Malicious:false
                                                                                          Preview:[.#.x.2+../.:.._......+....].9........j...ckr..y|Sf..x..'G.L....,..i.O%.s.U..........Q~"...~._..n..8c...6.G.V..d..u...%.1.[....~......T..3.CK......)AT.>.E...f..8&....H..M.....O..,.G..+..n..0..+...........a...o@....{...%.....d..f....s6OZ1.>:>f.'.z..y.v.O.+....lAQ._J..p.X..hcp...O,B_......\.P..`..>.t....K..V....s.tTK5.H.'R./=+....h............:1A..!...u...s../.JT.r........MX..A.....%!F......d<$}hVj|.v..(.\..8....f.P.a:..;Q.HD^.K....[."$x...A.P.....6hA...:....'E....c..J..G.>.QI.b!....#Z`H.R.#..h.?..O.j<...c..K.~._d./.X]~O......2..{wD....x.6[..P..+..6.+<4EL.4V.0...em...iBb.)e.Ii.A.....}...s=.c....r....}.......xb1..X*E...@d.?....w.N...e......g.n;+Z..xB%^.|_^.?.. ......^...o....orq)*8....ot.. =..+B......TI ........%A.E..y.......s...e..m..TW.*.O......A..Vr.]t.:z..l..@j.{3\.B3~....b..5..]I.....}...|.|Wo..0.?./.^?..>.n.n2r[.......A.\.y."1..h.l..i5N..s.....c.;....&.&.BF.E..%..8CD.~.9..H.n.^z...6.uW}.c.G...N?.,.......P..(..'....[...~-pd./.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms.EGVp (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):2330
                                                                                          Entropy (8bit):7.9299833955222665
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:6KfexlWhe+8cWuISSbOPQIqf1cFjCyaoTd+1puai1oxMT6LkAcpH:6KfJhK+j01cFe5ERT6oAch
                                                                                          MD5:15093F8E36A2E8BAF02C425E5CA5F7A9
                                                                                          SHA1:13A9ED73661E467EF69E82DC3107D4BD1229DFBA
                                                                                          SHA-256:BF3D35FC4D4EFAB29BFC2EB234D469D6DDCD1D1EB5CB43D6513471FC86AF8E8C
                                                                                          SHA-512:FA48C37765E512B3C2487F4B9145EEAD02D9F812CC60383F7B9C793094311A33C3250980A9092094A116D93A758E177AFC2965906CE2D9EFE137CDF57D11B589
                                                                                          Malicious:false
                                                                                          Preview:......H.o.d...........+....%...?...JJV.....83.......j..E...6S..RE.Z..[.a.E}.O...\.VA._.0..... ....~./..M.^..G%n.=.h.;....wE.@.!.....l.3....i..9.j.....-..`+..h.m....T.N..v'..bl.....*..>8....z.....oC..u.j..(....v.g....T..^..S..F%.!8...C...h2#.......s.....+.^U.D...'..p\..%TI_.r..b6y..w.K.c......."K.V...?..7.C.P|d.Z...\q./.~.#.U.w.h..0...I..~... ..N...m.2.0...^.l...B...U..q.kG.....3.*...x.K..%.....R<..[(.....8C6.;B.^LLIk..)!3.....UD.....).:.,...l.=..\h.[..J. ...n.............Q.b`..!.....[~x...'fT8.1......J...N....~.e.X......8.j....?.Q...|.gF^y.RT,...P.`..h..T.^..H..`...ZD....>D...k..O......E^..`. g...t..e.`8..&.N..YD.C.Y.......am.Y.)..j..l.{.CX..(YtEv[...y54.w4.G2.?"............|`...{.o.d.AN1...o......Z........}.Y....?...z.....|.P.}.'...+.9G.q...^-.L..xlsj..PL...U<.|...G.@<R.9|..w..<M..q...f..K.2......Dm...G.}...*.......sH9..m...~..rN)E..B.7.a......{...t.jw.L.....|(../..yiLz..V...'......e...z..{.....M5...c..uM-5.f............jSo..[3..L.6...

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms.XivZ (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1290
                                                                                          Entropy (8bit):7.866670952493789
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:WOc72vIorAsqKxviTh19JFK7/oCXbLtstAX/N95e89L8q+b0t+:H1xrAsqKAQQGsts3e+Lt+bI+
                                                                                          MD5:99B76C49CA56B082B1CE544B25F6E110
                                                                                          SHA1:0AE0CC75E6232891546A59A75D547F4CBDAB67FE
                                                                                          SHA-256:6430C49232744F86EA71ACA41FEDCD392C4879EE257855F6DCDE45A319016129
                                                                                          SHA-512:7F050E187F9870DBDB53B1B22967C679F2C169FCE2E07D7D3D6DB2E0D161FF906438696B6430419587C48F693E4AF5D06DC147E64AC55ED37D3212F551BEE887
                                                                                          Malicious:false
                                                                                          Preview:...)H...U..b.e.7.........M..Z<..v..<t...b..)..X.6..?(...M......uuz[.0..K.Li.I.3..i=...n..j[....U.......4....T/....(.T,..QI..Q..&VO...".1.....q.o\....Xt9......K..}....!.3..._...bq.r|......w....v....l.._.-c.(.i<.HU.P9...`..O..r-&.....Z...H...<.c....4.+..+....9...Q:...!........D"..."K.o.....y.j-#i.i.._.y..p.a....U......Yp.5.t.cgaa+.h"......>ML.g.k]...w.',Kg9........U~(i?.n~d!.vn3...'...b.#....f..|...C...4...7(m..wsM.$o..).........%_..R.., ..\...{......N..<44..,q .-]WY/?..i.kh./.j.....Y....a.$./#....[.!.g.....p..M..TPK.>j...`.......)....La.........jS0.+......L.(;.'._..>.9..0|.w....s&.d..\s.!....w7.s......................~......N...2Cdp..TP.....d..#.h.e...:..u-.c.....d2..... ..q.F.bzL4......].6>.0..@Z.....*.B.68.,.~v3.4F.<.."..$B.v..eF..#c...1.h.w27.n.i.........1........W..&....u)\....p~.A>..?1.$.S.v3H..........p.a'.`....U:...X.|.A..j.>............S.^.......V@..$.......(.o+jA.....#_X..3R....,.E....@.C.@ ..F.Y.9.H.]~xx../o...*#....`...

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms.QSCG (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):2341
                                                                                          Entropy (8bit):7.927858543602471
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:kSy+2bwA06VZvdGwojsOSP+wbT7ei5y2D05ApVlTIgu2g7:ko2bamwjsOSmwPdAgMwvDc
                                                                                          MD5:8314ABBE0CF34FD42FA3353698959E9F
                                                                                          SHA1:FA420A935D8F8981A96C00C0F42DBA3EA9D4837B
                                                                                          SHA-256:3A261C1781D65CB241D58FAC786B728DDC1AA48BEDFDE7C9EDC97C9D14F0023D
                                                                                          SHA-512:3B4CFEDF8FCC81C0A09FB229DAC483F7BABE60B318BAA647871F382ED656C59CC8616A79CBB198FFA20BE1442A1C03426C713BCEB6596133BE63936764F59BCB
                                                                                          Malicious:false
                                                                                          Preview:.._.<.....0.48..z...i..^fw...~<.m/].......b..:.R.c..:..ciib>.).W.#...>o<.6.C4.t.g.%.....$.U"%@.u."..W....7..k...#?.7~E........2.X6..c..o,&#zzl...K[.*.S..2...J....n_....<B^7U.*..cP.....SM?b....8.!8m).U.?.......Z...W.[..`..Ha...T.e5d....`....u...a.sc>B......O.K"..g/T........&.........hb.5.F.2.'.A<......G...5./.J.Jh..@....,.=1Y..!...H^..\.m..@....&....^.-....Uo...E.D... ^....&.W...pt.f..q.*.....G..G.....(..gA.1.I.5-Y.....TF.V...M..../...cz..;.Rnm.1.x.......#H..G{..canS.....rLa.@.8l.%x.#`N...y{.p..1.....K............5s.`..fC...0O.v.(...v.].`..v..,.O..}..M~)__.#W..s..AA.....&hK?.N.......A5.C..s.}..;..<...#&..c.......m.$....{..... ...Ca.(..p..S?.8.H......=...H.{.0....7.C.:..A>:....Y ....sJ.Z.......o.|..m.H.^w.8...s.m....7xp.=...X..F"9.A...>3..<T.O..c..2.~w...n\..N..GE.0\....s.Y....|J.~.....^.H|..n..W..q+2R.,.||..aG....J..>.D..q`.Gm......>.j.....D4....L.v..Cj\.qTS.98;......H.]..L........R2;id."(...~.2...{.j./[.3.....R...x..a...^.|.d:Ji...!'.w

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms.IVmk (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1802
                                                                                          Entropy (8bit):7.877372032087085
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:7TddeloeaX/lwyfsxhhsUFvVB6pTwqEiqk/:7T3elod9wyfUnvVs6qRv
                                                                                          MD5:FE9D7BFC11EE0CAD2FFBB67CF50E387E
                                                                                          SHA1:EC05BF87D7C2690EC4CB46A8A4616DF949FCA18A
                                                                                          SHA-256:17CF37E4D5707A32D8F37C06F97315EFF2E7BEBE2C650EECBA26611BA1C16E85
                                                                                          SHA-512:6279F142EA21276ADB366E46C57E01DD46F1C0D2DEC1AACF35A4542A3CB1449D6185E271F8694C486599538E5E4F39805BB78042FE48DC5E2840958083366BE8
                                                                                          Malicious:false
                                                                                          Preview:'...@...g.4..=.B.....:EX#RJ...L/g'..g....|6-.nN...dV.]5.X..l.$m5...w..0...p3.Y..FU.6.H...Y.yo.H......p..R.U.O.U..*N&I....... .z{....T@.?......l1...H....D.}.!.2.."..Q.......-.j8..2j..#!0H...QQp7.[{..7.X...T.EV.H}_......<..7n.a.CeQ..Bo....`T,#l...N.%]..Xz`3....Y.X....M9XI...[-0.......)..$...D(GR...B.VN..J5..!.......c.W.i.v=?$.:.4RR....X..I ...Y..P...k....@...t&....D.;.......M..F'r;.....++4...PN).0.R...}..r...Z...&..*p..d..K.&...%.I...BE..S.4Uz=.|...*]..v.L..c.o..T.l...,.....L...AV.....A...~`........s.I.j./.|..V4p..".....bE.l....F.......I.........>J@.1......x....tz.|.`C...?.nH-.q`RT.....X... ...............la.LJ.`u..I.w.$.N...p.&...T.7.j..w..L....S.....gC.......;.#.K*m..@.sa....\..e..~..S..@.... ..'..J..?-.7n.>=#...`.T.........Gm....I_.;......%..ak.UNS..2....2.1Yu..9..tV3.h.^..G/HJ..#._2l..;.K..;...Z...YME..U7.\#..d..)R..5.sG..........:.GQB(..L.....?........sn@......I.%..*...,....[..}8...@w.,A.:9[..&..\J..vH.U.u.%.X.V{..f.H3......8.q;.-BB\C.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms.XhQr (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):5898
                                                                                          Entropy (8bit):7.420045826065581
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:8DwiojIfqbBdD359AX+j8B70a/HhC6r7+wZLtmAdRT6KuQYMA:8sDjIf2hCw8B7DI6rHmAd7uQYR
                                                                                          MD5:431D0994743A71E10E67CA4FE10D7470
                                                                                          SHA1:B03B9104531F9CB7D067B81B4B2F7D7D337D052A
                                                                                          SHA-256:BAB5DA0DCCFB2372589245F19999DB13359567E35A51DEC9F8736EE61DCC4AA4
                                                                                          SHA-512:D732B1E102E8ABCA91E857AEE7EF799A0FB8BCB9F988A866068DFB7651229329A173A0EAD30F1AA9EBE52145E08944DB513B3E533C48DC960E58BA6EBBDB8DE4
                                                                                          Malicious:false
                                                                                          Preview:].......l.H....[.J.Jof5..'.6b.....>[.Y"[A.q....e......r......^..r.u\.CF....R.2Z..rl..t.?.:...5..,...4...|..A.....U.SW.X......F....`.^.c..:..o..l.z... .D..."....W6..........4E.5.c!....9.Jf2.qgS..._.35.FN.....%.W....M..CU..!..r.Q~.......By$.......J`cA..US...r......h.G...@.....<..).....S.n.{.....>...g.+....M..a..^:..>.......M....x..J.g....&iU..^S....R^%.)Z...t5j!..4.j..D...tU....7.(..8.D....:..F~<8J.^"..6..c.r. .'>.b..;Q..c$..7.,....j...E*A..R..G...1..I.in..CSpD..>.2.~7...Bq.P.x0..ww...^j..`.@..n....c...kx..x9...F.!4.Z.;.sB.x.1<.p.*=xe*M...XB...x.j..j.E....#...(.I.s...`(.\.2m`..b....U..].......~.;...F....G....................).. ....B.f...P.R..q...-*...h.U..-........U...|....t.9A...Y.-...)........C.,..8..A2L\{..h....bd]O.........z-&..)c...@.......w..R..`....`P..".c....(}.;>........~..U..:....d.x.9.]..#.I.l.0.M5j.....*..3.s..W../.7\.$..q..S...o..i7....g.d8J..w....I>.h...*.V..uO.0.N40".X..w/.....kS..5...#q...3.!... ...;I..np.D....Q.0Z?..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\DRBXYKCKXO.mp3.eZEY (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.82887627205558
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:CK8NfrREL/kM6T1+7IReA3qxdjEBd9WEX6AuNVMNhD5ct5ABao7IoGnwV:CBfiYbRReA3MhEBdTqOhD5ct5Q7Ic
                                                                                          MD5:3834CD35D81B75CC71B8F92F7ADFE90B
                                                                                          SHA1:A502A02341D92647B3B6E9DA8128219183E170B5
                                                                                          SHA-256:17FB2D4CA3E3BE14AE84AF7889EC5AF6B7EAEABD9FE1009C85751E8BB76E9A5A
                                                                                          SHA-512:9CB8A6869A2114A6579A5D2ED11C41B3752C7FE4FEF69391F9B08FF831CC8734E13694DC6D7D374FBAD1A78A48158D334BE51BD8CC5EEC993FFC886BD8C28E7F
                                                                                          Malicious:false
                                                                                          Preview:...`........?....WV.E..D...>....HD'.=W........!.Q..u...7..6?...XKR6...F'....Ovl.t.m.R..h.N\.....<..\6...n...`..4*?....c@?.z..H1.0.z....AF....2".3.Br.Q...PLR7|./....*.`.7..................E.....V..05.9..p. ..a,_]Ck..'...]..(w.m.2.....?.u.1.x...WVl..d.}..........{..a..&Gqg......&.G....`.UT....M...Q.).[..?#.#J.N*y.A.....ze.8.B.c(y..I..a...<o...-..l....ph.;.....5e.$....IZ|..m*`.\O..b...A.....Q...}...O..4..O..}....u.jL..0`.....gT$.N...%..N.4.T...c"...r.W;...y.0.............i....L...R...e..._..=Q..(0...`V..C..Si`..F.|...b...=.m...@..`....O....t.1Xd z<#..F"Uo).W.Sq*..)a3...h%./.k].....e....PJ...5.@..ej\}..&X5..(..W.+.E..N...f.w.'..;..=.6\...I...]G..+;..#.....%..I.6..I.1J../x.a...HD!.aB.F.:.(.........d...\.........N....[.|..Md3$.....64.......}..(.kDf.x..N..FaB.P,...@.T.s...s....^@...y.._!....O..SP...w.]...\....^QC.!E.....wk./..g(.....+. .5C.{A......Th......y..v.2.jcb.gu.JE....w..{.R.?..!F.}..W._@C.......,.....3...........Dp...E.p....m.9..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\DTBZGIOOSO.docx.VTBm (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.860084739428974
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:7p1M7ZISgorv4ZjYyPZ5qSelI08c7mTCMFMKqx0GagUnZU5ICpOaOVrUCG+H:7p1M7ZXrQZjsQuKDLm5tpOaOVHG2
                                                                                          MD5:7AF85CD7BB4BB62997E2BFF72915B873
                                                                                          SHA1:4311B2265D1B78BF72CD08EEFA2439EF5569C59E
                                                                                          SHA-256:3668518D9CB231A9877B7760B84D882F31522A29438E17DB1E92DB31D21DD07B
                                                                                          SHA-512:F2C111A76DC9C8D598D835153BD73CBAE433A2BBD0B1F7CB9698ED14AEF091CB99EACD6E7FA219F3215FE0874AF333ED702D8D92CB7CC60CF011069099D1B6B4
                                                                                          Malicious:false
                                                                                          Preview:..../.y.w.2`P.N....q....MG.*\..6.d...fU....cY...&.|........../.....(?..4...R|N]G&!.. C..W.2s....e.s*...d....Ch.5Q....W....G{P..K...)B.EH..w6.T..wl.-GO2..2.;B..8....R..R... ^k.#qv...+<.:....kY...R.v.hf....W....Be2...X0N.u......z....@...%x...&.K.z.5._l.i..O....T_....O.>..3....-.Ze...#Mo.F.*.GD.S..a[.....J..iu..0.#..Z..+J"y.....].+...).sR.q={p>.A..(Sj.TQ. ...I.>4.4.x@'|...j...~s.)!z.k.1...{...P...i.Z...S.8'.....E.<.....x....W3.......h..!.-A..0M.R..+4.Y.0..;e....x....g.d]N).(..V....R|T. ..rF....l.7n...J.(6.....k..>...9.Ry'Y@.i...,..zq..=)..e..(..j....._.....n&oR.l5&E6.m&f..g8I..SN......}..l...o..O.y.....yz.W..~...[.Cm...6..v............)........;f.....t......+.}@..r..W.d7o..q.u.U..-.S.t=.;..j....&./.....,.63t.8...y}.8.\..=(Bd...} ?.........>m.w|.5.}.e.6....0.W..H...C.N...1.:e.-.l.<....9..h...+(:...hD.9.L..O..k../.v.#)'g.. ~./..x.."QY..k..NM..XA./.b...9.U.w....E..$a.R....f{A.6...6,........+..W.,.V9.1..`.#j...S..../..m.F......f.V.l...o..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\DVWHKMNFNN.jpg.ihDc (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8532484025650175
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:hRr7BIJY1mRm4omCf7QX+65IPwj+cgB0MoICk:9IJY1Bmsp65dyBHRCk
                                                                                          MD5:652CAF7AF172D22BB5BEA65221DFAC0F
                                                                                          SHA1:E93BCA3DE6BFE9A0F5C21DC4977E8B580DC33BD5
                                                                                          SHA-256:10B248523209EFF757C5ECF167BDCBDD4A1479DB518417EBB18190E54F5314AE
                                                                                          SHA-512:2A36BD267410554E9EB40C99F2128A0B731F548E21723D3A78AC9C5C28204CC79177095F6D0A0892705082BBF861DE23F30D365306548F67D817CC14DC6B71E1
                                                                                          Malicious:false
                                                                                          Preview:J7$.p......%`..w.7/..j.....r...a..A..VG..e@.e4.a..|{*...f_.k..'L...)M.a..bg....Ms.X*mM....p>}.{..)l.. ....~G.V......[.!..x.(.j]Za..?..u..XB.u<..Xz']jD.....e.$.;..q..V.2+b..R..].!..t....[W.&Crt.gPw@*.Q.d..{..V..HwW:"...P.......p..u.....\}..i.{.....<.=.......F.../Mo...d.:.J. ...)n....G~.....3......f..;...i..qC%...0g....g!.n.....-.BN.q.}._-~..?..E.s......V.{.....rQ..5TCf...e.(..lK..>.....$.n.\T..Z..&i..x..N..T..a..]?+..0.....H...a..YJ...g.....!...;.}..e....[.(L.I.K...z.,......q....tv..\..i..v^B..T2.(........../..._...S.x.d.........4=..c....`.....IJ]...Q.8.M.4}..o..........i......]%.......(F.PS....8..y..W...!B2....s.....p...m.~.V7....lR=GoR.4A.C.hT.C"..!....w}.........]..W..1b#.Oa.]....g.f.YU.l.j.._&@!..5!-(lg.....Rm..o......w{.yn.b.d..E1....M..........D.KjR.7i./z..iu....M....N....$.y..s....qw.)D...V.t..p.<..Z...X~.....dO..X].x..,.....:..#..#.&.2...k.D(K.gR..F....t?..;.$..\.'.....o..Cj.%.......d.h.N...:.p.Y..a.x..........?.%U...1.7.7.KX

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\HYGZTMOBZN.jpg.eDig (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.860557894174856
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:9kjoC8TOT4z8hqwDJKmzTXx5ZAvVz2KD3JScXiQQ05QU4RVByr/3PIijrk5NQiv:9cz86T4XqKyrx5mNz2KAcyF05G4rYi3+
                                                                                          MD5:4F52BF3CE19CD4C7AE2B67DB88AFB3C8
                                                                                          SHA1:ED36C0F6CF4D6A17E93481056AFA897AFD933C99
                                                                                          SHA-256:860F9D261A92D34EA3ADB7C507D063C0C72ADFC69542C9BE0D26B232CDC196A0
                                                                                          SHA-512:CD2CC0FBB1FD5A70BA03DFE36CD73EF1EB68B4F353D1E8FD774944A78E67DA22C4BA239AF75A1157363570C840B0A61C4C0C415427B067C2ACF3475E4E90CACC
                                                                                          Malicious:false
                                                                                          Preview:.................a....\. #...:.vD....+...]...=P)......T.8.M..|^~...@i...V|.....@ ._..-m.2wy.*(...4.'.rg....v=.VL|..#.QTb..=........sm.......O.rB6v.%.[S.C...'..cB..........M..%.<'6A/u._.."F.6j~x..U..].n.x.....=.h..<.0B..\.U.....L...J...}.....I..."...E.....`[.,.."o.....7.}.)qv..[4...A.y.m?zgd.F....}.I[z/...g..7*3:K6b.oW..jQ...P#.;.IPU61.^..euGD"<...!s;....!.......Re....e..$..T,.....[vFh.o ..j.....@.C1..k........M..4...W.........2.>V.....x-..,.-~.Z..l"....2{...,..-~...~.x=.....\.Tak.GP@...zt.r1P.....sh2.>5I8.Y./.X....4q...5Z.GH.Z+...p.?.....=.I..d..lX..I..=Knu..m..|..]q...N.]...-.tk.R".u\).....LP6.WY.w,...P*...f'....f7..Z1.M.n.b.M/..s>....H#..Z...3...&..c'8.S.^...r.a.po.jh..8e...y.q...HGn4..(....m^s.Oy.f.1........S%....p..s>..X&.C.6v...j..o7c>..3.n....e..B.G.........y..?.&D.z.S..D..i.S..l...Y.K.TQJ..}..... ...<d..U&8O.Y........... S..4.@.>..z.|.aF.1<....lB.[rS..ZS..#...*...>.'.v.kie..j.a.q...l.}..K1yC.r!@.......- ..`Zu..W..T.U$F

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\HYGZTMOBZN.mp3.FSqz (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.884707719032619
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:RQqCbOLQ5PNMd1m+qWcCDYvMUlwkKN9oYl4c:ejOU7MDm+rPUmN93ic
                                                                                          MD5:5F1AC1B9CE93604800B5E54090F5E62B
                                                                                          SHA1:FBC18258ADE9EC7D8918E825C79C1AB1D828736A
                                                                                          SHA-256:57DC8178543F5823E4E4B0CB65DA1522D87E672E4E15467B731C962308B156C2
                                                                                          SHA-512:8D74AC2D0D7EAE6544ACCC4C3A10607CB98393B98383ABB01B0688430A67DA6246F14C30C621AF4EEC828EEA85685B027726952F6673F2B2E3A5B2ADD7B527EC
                                                                                          Malicious:false
                                                                                          Preview:.).P..L.....>...^q0GB.ow.....;...f.K....})..._|F...`...>1|H'........Z.nV....2.*..].....~E....=.g....}n..*..|!%...s.U.i.H..J$......V5.`,...$..5.W ...(%..Rj,2.a..m(..S.\.p.;Ok.vmQ.D=.......=.H.L4.#85>_ya..~..H.m.9......'.i..\.....0. .h6>;..v..2..fTWcZdAB?N._P..H\.\..j.!`*Z5.y#....cm.....xs.EM.I..5..X.Q?.j...`.f..=..j.}.g_..{.o.N....f.......^.}.D..F..iY..........W.f0.b..\}.....]..)..Q..%.....cL..v*XV|,.i...S1.....#.+.#k.@\...#...\#....F...S .J.....?...A.....(.+...R...;.. ._$.e<"i.LR...-...<.AW.#.= .B<........4....W\*.RB...7.J.K..h.....cD...l...-T4....`a......V.....]..>u.T'.3I.L..l..x.YPhAtTD:...T..q%...........46G....et .9...v..."..Y.*G..=.....(N.[t..Pjc.v...p]....X....o.u.........X.l.R@,......F...).{..$k..m.U.....M.......z...3.LU..A..">'.[....SZ...U~wu.N!.....e..) .....6RA...qn..F....Uq...........m@.:8-...|.Unj.....g...w.....I....WU.......$.P[...Ga%bc........G.....G..wk....=....-....K....vS.....hxK.`.o!.U6.X.~x..T_...r...J}......f.n.i

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\JDDHMPCDUJ.mp3.wbJm (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.833694798003071
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:/hM7btt1U9FYrsRpuERRnBMLDP1FTzk56d/9eKJmvZLtkYXzcZClT2:/hM75DUYsR9Pnivd/MpkYo892
                                                                                          MD5:DB8D246A6CDF37425975DBD41882FDB4
                                                                                          SHA1:6B2B69254C24FAA3495B9BB1A5A11FBFFC63B54F
                                                                                          SHA-256:E944F1DA0C4C06979AAF8037CFFF8F6F519A8BE51AA0FA6889BCF4F8F709036D
                                                                                          SHA-512:C1D87CB4FF55DD9B75F76965F09987DE227629C7CD4CF8AA5CD04EA0C9B717B0FED0F1EDECB79F1D907B058BF928FF6B91A9885AE10A1F0F99D7331829D4845B
                                                                                          Malicious:false
                                                                                          Preview:<...H.Uh..&..P.....cxa..r....u.......7.0<.u%!d(q....h...x..L.n_fL...@<.....Qe.]...?}[f...~lc..9...x.J.#.......]......_..Bj.../...u.^...ci#j.....ute_2...MA..e...h.<.........x..W...[....M.6....L. .%.'.#....>..~.".l.7.....O.:..*...f?....&.9.<.B......J..7....v..!..=....>bnA.L...l........Z%IC.fq....O...6-...>......`... .Q.U....~...^lcU+.Z.D..). 5>.~...>..C$...L*.)......$..P.B...........nLr../....U.L..J......-.x.c..LIKW...6.?..g...p.....y.y....J..5B."..ZrC....a.M+lZ.L0..".%..A.-.....9.?.}....d..'.*...5|s..m.....0..6......r7....1..5m........[v%...3.T`7l..q..D..;`....n.....19=....z.l..<'.M{...G....?...s..!.W.N....%.}.M...,...$.F@{&......t+k..t.&u4.....}u..m,.b-P.j.L.[%...x.......C[..^.f...q.f...[.FE..}..........1........w-.f.)^r".[.:.1h.J#..r......q...;D<R!...s'.<..2.Kz....$.E./...~b..w-..Kwj..v..g.d)s..f.....L...@.D...5CEu.l..X...U.f.<..;...-..uEf.6.....5..J.-..M......n<.....w...;N[.G.n.......7V.......h..O/......<H.-..E\......W......T<......

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\JDDHMPCDUJ.pdf.KuOJ (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.857068183262382
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:JOtP1zAmJpVS8inUTIgROYeMuwqpGZT37JQGPkeHXlt4tHa6c:Adsmg8UGIkOYbj6ArhPkeH9
                                                                                          MD5:09C87B489C786385DA3EA7AE8CC4E4A1
                                                                                          SHA1:3E7CEA0088345F6AB9757A6C468008ADDB288573
                                                                                          SHA-256:AE44F8D3E1922FF1C071470BA6DB0E42D039D0361FA4EC614A90D673D94D07C2
                                                                                          SHA-512:6F35CC3E052DBF50DE21B540C942083396D55B671D32950569E91A66E0DCBEA9110385C945BF90F874F8752F589AE2C08728BAB521A38CA651D6C0A714EE055F
                                                                                          Malicious:false
                                                                                          Preview:.-.:......'...Uj[..[~..-....Z.d..~.......Hm..T...w5r.E.._..S}...7..+.......@N..Lp.......(....7..cu.*...q....3.......e^4..}.;g.....e....}.=.h.8.N..i.......V..G...w_'.]..Ug.X.Z..X.....^Y#%]..uN1oYS.+.o..<.\...e.G.T...^.}.vY......U.;M.E.......n......F........~.n...q.rh.;...s....H4IP.p!.........Q..y..@.%.>S...c.....!E.K..G.nBt.{ .83W_.ab,....."J.yA[.7.M.SFO-.`.O.8/..&....o...:0..}.z..M.....(..l.0.!...l....x...]...<..D....0e......Ax.+t."'..A.D....;......tt..Y.,..,..W...[./.|....u...cGW.!9.K...=..>/r.J...Xy.q.Cl/a......(oz..J}mk.}N....H......R....ko...........i...m......>.:.SV.k.......O.(...4..o}..Lq..Rx!...XqH..\.......HU.s.I......mtG.-H.....l?....0..k...hD......))p.J..9'..nQ..w..0.....C...Pa...0...1G}..7..X.3t........?y&Crd...O....._..m.Ts......;..p;u.....f6f...5....b...Y.O.~..f..)......CN..!xa.x=H5..1..Eu/..7..,..p.v/..xLu.<..Gi..{........AE......_..9.I........pq...|!>qkiK..S...@.>.X.m..}.JZ..w.k8-~...6..,. .O...l.30./..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\JDDHMPCDUJ.xlsx.OxLl (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.839934532975688
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:r2fEQfu2/qMMe+2ivNws9nKqygWanlrgoesBY8IOwM88N:sEQW2/ZMeLONd9K5al0oeg+p8N
                                                                                          MD5:4771B67E1156EA4B9F5219457FAEA8EF
                                                                                          SHA1:54214F014778B788204E0BFCF0C1D1C51D0629E6
                                                                                          SHA-256:7C9C39F939D0915FD4F0BA21E92C6D40E4DE3AD2A66728C21E562B93ED9039B9
                                                                                          SHA-512:16BFD1B8C350446FE54DE61859385F56BD04FC7E8A44EADB584849323CBF3A6AE07B6110889AC2AB2B8190DFAED32DEA2E760A22CCC88FC4356C07CD71319D81
                                                                                          Malicious:false
                                                                                          Preview:[.....g..TW.K..\.A.T1..9ZK0.q.f.!@..Ax.2N.d..../T.....g6.9........l.........hW....E%...@..r..1"......F.2..n!+u...nfQ.b..W...}HZ....~.W....u..t...zmvr...HJ=.,5._..R...DrG"7%AQ4.O"h.P...._U..Gh.....k4>.I.Ohp:...P.=g........r.p......WY...o.V'..R.x..>.U.....a..C..\?.../..f.........y.?..GMz.H. .&....=sc.T..tr..,..[...&Zr...[..nC.).f.V.\..SG..?.....6F.~.I...Z.....qRI.[n P.L..X..3I.LH.hb..."...{.f..1...B....'J....%...Y.c..SD..<.....2...,.e.9.B..//....u...,.%B........g...y+.....d.&.gci.!.X.....}..S.....2Eg..bu.a.#..%2...P..h .|.K!(...M...d...b...x..&#u......w......=$.<..I...".:..I.K......7)*.g...w.4........\m...=.0..m...#a...5'{../.....A...mz... Zcs <y.#IL..$u.M....<. .L..*.Q..H.p.P.t.V..Wnl.D..Ts..d."....I..@uui6.=..$...rw..7.=.<..?.F.<.......H..ZE.P....8g..X..'qr%R..&.\.....M..&8..j.`.z.c,|.p...&...6...O%..s ...@s.....`..U.-...nw..$.f...z..?..2........aQvw;g...x..8l.&..\..x..........C|D...q.|....b2.&_.(.OP........*...[.T...S...:..(.l....J.y..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\JQADJOBBUH.png.TCtm (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8340152539330274
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:zhGSSIlO/E0SZJtD82QbdjkkADkjbFiKXTpF122O5B6WQwd+qYj:zFiE0SbtoADwFDr1q5BxQo6j
                                                                                          MD5:BD1F96D414C0E17038E4FC9B4EA4769F
                                                                                          SHA1:3A9C0E866531C1D93780CAAABEE1607B45CD2760
                                                                                          SHA-256:3F3E633E4BB7DB35DAD86C1A760C5923C22A643FCF16C06F9603FF3DB2335B07
                                                                                          SHA-512:59437235F116FA2B45285B351800102BF02B6B5F380BC384F3C085BE4B14F3807203B850CBD6AEE35DF0C17F515ECCABC493AC887E2994DC1D9DE18DCBA6CC63
                                                                                          Malicious:false
                                                                                          Preview:[Z.xa.T.)+f.m...'J...L.^.......;......<.L...p.iL.Jf... ..{K....#.. ..3...AEO....}.Ws=4UF;..(j...z...6..%.}J......^..c...s.CI......{.y!.).._.H..fu.Y...9.#P..+....\..(..A....V..p<).}....v....(.|........O.N..|..us.[.x.m....ck...@.....l.J........_..yQ..xH.....5..j...+-....JJhI.(z${33...f..(..../.!Y0...bNOl.j....."..]..S.(.^...o..T..7.L\.....a..3X..R.j.{.O.U...M..........d*.\..5gU..oO\7.3s...V.[...XO..G.....T..m;.....)....z.B...W.K._.lU../".1q.(..^SQX..+..%.s9......x..v../....a..D.\..(.O.bW.*^.2}.Hv..i....u...|..*}V.Y..=.A(..H.|M...H*^B .:\Czz.d.....u...<.p...EYY.O..n.$.4"f..n|..r...T}lv...9...V../....`.....<.x....Wk.p......4..7...DR.u'G.".\0I=.!O..*b.6 .T.u...tp...b..k>..4.Bj.Kl5K.{.......u....U.....:..*Y.j}..g...'x|........../QUT.+..D...*Ah.3,..X.;...@...<...Y...N.,W.TZ..:...7..WK.#o....=R)..9 7`............quX......r.[vs..V.k......8.1h3.^....,n...+..k.D.mT.}/..V!...;..I...y....&"a.......,..\....`......H.q........m.J8...;..#.7g8..c..O.Q.B$$m;..d

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.mp3.hydU (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.823447691476666
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:b/tRxT3OZUPkXXzjGPRvlYuztHfAqhwbx/NXRd10G/yYGx95eOQJxzxOCRrB:b/TBO6kXXmPRvlYRbx/NXRb7/YlSxtOw
                                                                                          MD5:F3D604A6A422491A4827E77FCB27539E
                                                                                          SHA1:E369DB0C2B71881D808D66953241C1525E6BE2FE
                                                                                          SHA-256:3D828EDE21B7565B7812FF33DE79A4AF345C5728131176E6F73977CD2B1245F9
                                                                                          SHA-512:7930F74945F3FE9704F6D3AB0B8F2BDD1F93F4DFCE1C9E50DB8C6775AED732EADA7F79B2AE2EB852E107C2E05590D9070FE6FD4FDB0828746949CB08E1DB638B
                                                                                          Malicious:false
                                                                                          Preview:...]:#..cgf.]..D.l.G..:B...g.p.......s.RJx.k..z.....>$......x..Mu.X``.L..H.`...O.w2..&0...y3Y.#.B.........}..;=...n..e{xuK.....VU.D.E;.c..9..;.o....xb..j.X.3J0..2.......Z?.#g..X...E......I..~...!}.....;..@.xv..` .....Z..^...nJ....^.n....T."w.....%...Z..uf..lB....M.."I....m. 1.R".Nn.Ka.ed......l.N.Zw-.....3d...gJZ+.*$NH.......?..fv..f:..a.i#=*G...u..;......,.#.K"C..FH.d.Ad....OjJK.o..}4]...... g.vH1..../ZY.N....hpG>..$e..O.).C.......a.....?^.+.e..."[.L.$v..UR]..S.J.=.."F7..xy...N..a.m.C]{....[|,,.. .4...X.D.a..(.D.OZ..pq....LUE.nB..3...M.l.Q.S.n.....2z...O.Q....c.........uQC.J]k.|.....y......WG...3.@...X...w]T..M...m,pE..G..a..#....By.......0.Rz...Y....{t.....^.....BJ..da..|.......B...I.1y<=...Ky..a8...xU......F.6"...u3.E........1s...&....xj.@0~....0Z...I...).6b.fqKEv....%..&K....L..8z.t8~...n5^...$..K........*P2.....0.q..t..e...oP...|...0..t........0...Wt.'..2...,p...@..,G.._.C$.H..;X.....gn".p.....J.TZ..K...I........E#.L.G1'...-|.Eg..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.pdf.qsHW (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.829010840458703
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:6cKTSIub3b8niWfMrPawvlVSpBjAS+s9CkLjbTI+Gkxbu3I:bKurr8ilLawdmFfFAau3I
                                                                                          MD5:7598E02CF5AB59D401D66852523F5430
                                                                                          SHA1:A11085F3AF13848143196EE8E152D11049718373
                                                                                          SHA-256:9A5B8EBEAEC012A1A9DA7A85DE0ADEF8A3626C2AF175898FBC9A2D140F86DAA7
                                                                                          SHA-512:ADD2DB41C6B5BC19EFE2E377B75266F5CA1C075F4539137ED933071C0A02434B15C1DA4F01D85F5137ADE63BFDF887F408CE75B6EA33E2CFB1EBDE7736FAF14B
                                                                                          Malicious:false
                                                                                          Preview:.~..-..>......u...).(7..W6.w.....U...RJ.......".w.nS...$_0.g.0Y...0...s.....g......y.....n.....^.tM..H/..L..S...`:."..9s.(Bj.../........`.......K.........3e.f;..^._.P.su5A..R.a..O2x]R.V.@.....Jy).....Vt.........N...8:...c..{.fL.c..,2...".?..T;. .....Q.r..r].N..<....o...M.u.....1.....$rwy..>N g<.D..lc..............+..:st...^..f......)"^.v...........h......X.T(.s...)Aae..F.....v......F%N...y..1.......Y..o!..A..]...%..... .$.t./..|.{O..u.<..<N.......2RY...E$...#...Q!..<q..sa.lO....W.......N(:,.n<.._...........]jb..e..V}. 2+.Cwv.P7Q......(...!E7..`.B.....z...I4. .......X.1.ff,.L..../.... u...o..l...*cH....T..f.j.......m V...NZ.])`...E9.t....q.v.M.r.D)kG.....Z.cFB'.}..(|...<..9.6|Z.....;.^...#....#.JK....6...4.[k...V>..'&..|u.2..#gM%..sy...7._..._O......ix...hB...!\...G..T..Q..I..}..=....9i.......4.6.n..H.7.|...T.t...C..^...'7....$..0..b..~y.d2mX.......N[...y.......Z..........!>..........C|M...0@.....v......;X.2..$RM...'g.kx~

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.xlsx.YLWq (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8604409386213
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:oWU/8oZrF/IuN0XSoLCpYZOwSn0UJ/GM3qW+BmV6KShNRQVvHB7pyBfO47wLlA:VU/XZrF/IuuRepyO9nP/V3q7K6KiQVpE
                                                                                          MD5:2BF30BD99E36F32EAFABD98DD66FAE73
                                                                                          SHA1:342C5D46F7A2DC9E1E836B8DA69085C57C420345
                                                                                          SHA-256:2CAAADA06AA7071C0906124AAA30DB350968F26D74433CE08D22DBAE47B4B399
                                                                                          SHA-512:DC58B3940409125BE6AC67EC0F56511EF5E05D412850656B97A919F882B9AAA135AF68EF45C4EFEB4D8AB401BF6AFE5327FE8A61F5D3BA9F581FF43BA74982EA
                                                                                          Malicious:false
                                                                                          Preview:..O.WM+'8}3...tN_.....Oy.L...F..s....C..`..PVU..........Jx...."....v.F.zZ........K9....G]..nU.#......?..7... .*M.|..`.ue......ABc'0.T.Aq......A....&N.g.........X..6.a-9!k...B.lZ8.9./...?.o.,...~.N.HO.....d\.)n.'.......[..%......C.r/..78<.`....F.$.#..i..u.Z.R.e.W...."...6G.D..W..._.^+v.\.a./ff...U.....<j~G)U.u..\:=Z..f[}#Og..V..^,.RJB..).vWbP.....u.7.).a..K..0.xE.&.i...Dwdy..........z.~...`.tx.\*h...V...g..py"......tf.Rp...(..D.PE..U4.?.\j.JI...C."..'.y...k.sT...+.....I..`.........'g.1HQ?..s.Z:<...50m.?.~.o..1.@..=.z...{..g..}.A.^..{Y..H1L|oZ.R..o..G.K..;y.M...LPvA....i....l...#.o...i.u..i....n.....m.*s<.E_.d.B..r%.]H.^|.#2O.....y..Y.q.m.%..CF..*.5..%.uD{.n3C.;....`..........)LJ&...(....d.Lh..O..G.....B..O!ll..@.LTV.~t...`,tz.X."..~......G.z..O...x........R9.v..@...Tp.....R..p..Y=..pC?7..d.j.0.0...~)...f..1A.$.&...~....^C..........I...|..+..u........]3<,./ui.W.~s..wzI....?.*.......o.^.fg^...<.A.....?...Q.Y..T..?$..N:...p.0..W.?.Me#.L.f.Q

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\LHEPQPGEWF.jpg.ERVZ (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.848975188471548
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:6xyVaubHkk+EWljT/dnCrlcY6BTiz3jKeou6zfk/ukD9PUh1F8m:oy9rj2jT/dnCrqY6BOz3gWuC8jF8m
                                                                                          MD5:857BED115AE382B086A67C946CAD09DD
                                                                                          SHA1:0CBFDD1B3280E60FBA94A65FD73D8A9BD221F014
                                                                                          SHA-256:4694E16DB949D9C8E0264E85F8D0B3365EB7C5FDEBA81E9AE3D2F125EF27A63C
                                                                                          SHA-512:C2852578371B634904838E46CC1AD014A40662E1016ECC105B1F77FA3A9B11AD3CB9BAAC5E8804D0F28682E86C64A7DFA3BEAEFE42C3F732E453ABFDAFD2CBB9
                                                                                          Malicious:false
                                                                                          Preview:). ...Y.....D.......i..C.G......L......V..D..E..7k..EN,Y.L..3."s.92Q...d....df..y...J...H.....m......;._.{.......l...j`*..............'Z.4...P.{}e...k.3.b......M.h.W....b...V.E...Y.. w..v.m..SCQ.>.Gd..#l.o.!..!Sw.S....ef.0...dt.Ux.}m.-.:........G6..cT\1.....5.........Y2.Y....W7L.V.kQ....gP(.Ji..T)C..Fu...:\<)....[.Cx.t .u.............^...4$..{S..=a.K;....T..c~..+...........?^.KD2^..o..8.....Z.....|6..|....SH/.N~...u...jP.}{^M.D....D......}E.IS......VY5.!1......JD...~..".,......%..e'......u.......Y...J..F.4b.Y..^c...L.F+.s.m.....1/...S8@...%Hj..S.X..r.4.+eCr.._.o.8...^. .ucw..9.C7P.&...{Y.......T.1...q...v.ZN........AJd...'......ME.....US.V....=....'c8.......y..9h.......4../..f$V.W<.Rc.1.5.;D`.......N....+.....}.....PC...o.N.H.p../..5.WDe...L...{..#k.....N.K...I..h..1F.Z.x8....I.F.^gQ.d.._yO....L.".(5.C.~.Y..u.Y.[.........O.+#...fw..w..W........Vh..vox.F.S...#..Z._|.v.Y\h...}5F[[....6rs.>...q.l>..tS.[.'.p.....M..<..(.x..q.....`.g..@.....k.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\LTKMYBSEYZ.docx.QeDc (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.867331743541078
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:99LZnKoHvo8SkCFanAUXBIiLnsz+w7LRWdWDU1CkkIkxr/pIDu8j:9nnKoQpkCYnfRIEw7LkWD+CFIk5pIy8j
                                                                                          MD5:F89AF91A0421DFC5A2D667B94FF5273D
                                                                                          SHA1:1908652A0B86C6F822BE9C6E440D24E0FDEFADE3
                                                                                          SHA-256:616BEE7DDF8FF59EE630906BCE62E0B2E6391E21F82DF2739A98CDC3ACEA6ACD
                                                                                          SHA-512:295C68D09CD29BAAB8B8E012ABC9C17AE2830FAE008F6A9A835184A8409D191736D843CB75A7BC5A1ED64D560572B2445C7F42B88C0D9AB5312C5AA18532A618
                                                                                          Malicious:false
                                                                                          Preview:.Q..E....B.4....6.o..r.fp.....`z...}..%(n.>8.[.O:9.{~+..U.........%..,q...>V......)_.....c.V...R...y&B..+rNR....}.p|Qg.^pqeA........j...t*....Z...m.....).p.o..=......7g..4.ll...P.{#..}.q../U.n....-..Y<.p.E~.{=...=.MR...p .Ig...J.b.>..F%r<.~m........j"..b.._...4.]qf..9.S...v..u_..c .....XBhn,.~=...m.7.!..*..d/..\l...M.+s)T.a.!.....b...Q.m^...2.*.D....#....f.-......<:...'...t.z3<....^*.BA6..n....y...<*: nA.O/...$.,.V.......0..vF]5.v............I.....<:.8....=.~m7s..Rwet.vI.- ...v.o...}.-.y*.!?.Z..|..,.jD....=.JE0..#.....ib......2s.6).$.@.N...z.9...,..|LKS&...}......a.E..tWV.^y...R.I..W.Pt...`[j......g..R0F.R...6....J...JYPX`[c...D..?..|p.I....6.....f.2..{a.!..)1..`........nK.......>.7.i......g .uU..a....j2GP.>..&... .L..a.....3r..>..C|:#C.i..Z-...t.....C8XA.?5:.\vH.. ..TX.\.%C....8....t...]S.q.%.g.....\..z.;vjV.......S)....X....".Zn...KD...\...c.'.%8[.2..2R..qt|.l.....Q.I.&....=.`R.......3G....6uLB.i.7...{.iu3....2...........5.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\LTKMYBSEYZ.pdf.QCUa (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.83904048577976
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:kpb4XlsAapN49RCimzVtjgPrxpZFn4JGz/2X7rad1ygcswIiDePlFQPcDH9u:kizapN42z5tjgT1q6u7fb9MI
                                                                                          MD5:F594EE29D83958D1BD843CFC8815B7D8
                                                                                          SHA1:867499D76D1779132AF9FDD340790EDF47CE7093
                                                                                          SHA-256:FF14DA9A53D660D1C975BB5916AB33AD04CE6C55C6EF01C9300999022AEEA531
                                                                                          SHA-512:1601AD62602A9DDCDAE0F7EF5DD6CB0FEF484A58C6B4994DA422523505B3841B536E68CC4AB1AE46037E2B95F3C727A354E0FB9552F301C6966AFB92DE0A79E2
                                                                                          Malicious:false
                                                                                          Preview:........i!R...6...6/V....C..A.(...;e_....E?.....f..og*...(.......d.0/dw...X.P\.2...,..J~J...h.p.Y.'&..D.M..$.X!...>=.....=.jG..........<<;{.....X.......x.&...2..A.G.;.`.G.C&n.....-.......}...?..A6....o...Q...|IA...Mq.:....j...o.e.2=.~.?.#g....Q..z!.CO...u=...4H.,..F........b.'..e`.~n=..~.C....4DqB..a....._r...0.T. .%J.`8..?....:).o..../..`s...SK.M..^.... m..T...[.3....c.....><.L.x.....w..z.Z.9C>%Ld..Y.2.&..6(.p..Gm.j8....Yz/.'T.~.6....[, ..VN.F.......I.%Z..+.\.&....fc.z...Xs.?...........l..G.......<$..*...[..?fP.w".m.h..U|8... ..w..N.....C68....t...{..m...".&..V..(........,...Jr'*......9.(].5...1.=.lQ..R&...s.b.,.n<.$...^.h.xW.lU2E..\.................5.6..>.M8\..)va1...!....^~....'s.2...H..$.e.....,$..TqB4....R..$..[...G.a3\.......Jk);2..IFV....,}@...q.e.Ym.C.O.g#.R5...'......h.(G3........-......v4.+.5.@..Xo...%..*J......'.....c$....`A...U....5{(.n/...dFg.Uz78.o.,.l..F2OG..'wV.SV..`z...Yj...-..5..80....F....BM._.<#.....E.X........z

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\NWTVCDUMOB.png.WjIZ (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.853013270085759
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:U0vJzSRS8AHENo7/TgAHCfwcxaJnLvvGJK4BOmFaUTEjcq+1ru7lCkS:UaJeM8A+olHivxa5LH9AB8suw
                                                                                          MD5:E8656FD1E743B0BF44C195787B69E150
                                                                                          SHA1:B83B6C76F4614CF988BE9DDFA3FC0B8F12E25AF1
                                                                                          SHA-256:516D95EA3A1324DE5ED267041B59C96EB8B372B3BE94CE9394668FBC3B9818D3
                                                                                          SHA-512:13D19EC6BBE6717FC8F039F3FC2B29191E71267E44B95725B4C1FE7E3855116C33B4C071A8452498E7350D48DF26A072051F1BBD04516E69B0D9CD618CD41E6A
                                                                                          Malicious:false
                                                                                          Preview:a..d....,z.?*..K..=........D...KL4....?..,.9O|...2...~.r..7....i0....z..2._."UO8g....k.'..#..Wq...D..........!........../.Dcu.."t....p8r%k.......z0+,....<..g.....|B..\F...W..;Q.7.L[..O..O#..&...#eX*LW.x.....r.....Vd.a..N*......C...S.."[.@.6.1.r..&.p...1.t..~.."..../.[....=..y....._....#$._|.....m..(.'`m~.yl..s.v.Ac.{g.k.....-X...........6.!.X.|..c.....2.....V}b...:.;=m.....N..|'W..y........4..U. ..'.~.!..i]@....c_.%..j...G..*.d.,h.c......t.(...B.e.d...].*.$...".y...~z.[..9.D%..MQ/.F. ....'(......<aF,.......}.z..2!...v...;..Iz.......$.LI.$.......M..j.Y.w3....{...-..?A2>....c..n...k"K].g....dp...h..?2.c...8..mo..p...F.I......y^@B.!J4.5.8)..Zj..h...wnp.lG.D..}...@a..T.....O.....%.#\...^........ec7...I......../."..Uz#..K....18oM..}B...<..${.m0o.LEt.e.!....1d;.E_{...D..d2..."y.W..D-,..*L.......&.A..X...Z.>..KX...4J<...-.T5*......1...\...B..^9e..._MyF.O.\...ZV.N...\t....C)... .F..K..M...%.I..-_.......R?........:.G.j.....z...{.Cu..ae......V,

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ONBQCLYSPU.docx.fALu (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.838285068645039
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:maJqg45WEDHZT5fsDEznxk08URjJZNPR50P/80+vgYFJtFQMLKwDA6:tqRDHRq08qVR5ap+vgEtDLLf
                                                                                          MD5:3156C09830C51E5A4ECADBD94576BCAC
                                                                                          SHA1:87E633C1426119D8C6E0C2195EFBAEC683EF40F8
                                                                                          SHA-256:48A80858CF414ADA02B1F16F0E1FB1410D97339CBA3F3CD41024044E94CCF851
                                                                                          SHA-512:170E6A4BAF28036AA47D9757AFBCDBEB74CBFAF2570F06C088F76632DF3544AF789803F816A74829009C994DEB0DD03A7D2EBE1CBD038BE54F93A5794AB6767D
                                                                                          Malicious:false
                                                                                          Preview:...."..D.....7...M...-...`..BV`.!...-.6O.<.....L......j.....I.+._.j.c.7.i.bF4q,...."?..I........p.....#...u9!...^..8l.6.2'c.@r..#../..F`i.i{... ..K.i.}.c.{D......Q<w...!....iY.u.....i,o..{*..l.4...8$].jL.T:.....u|Mw..`...._.\......>..e.A...m.$M..b.p........;.L...8E.......IY&h^..b..>.^...../.,......B...%..r.>......:.........i....|..^.M...k.Z...Zt......Du.G/>ab..`....c.Nhl..q....H%MHM...*....Q.y.:N.\.....0../.w...Q...K..+.I0.c[...BLz..L....q......m.L'.xt..B.........a...\'.].Bo....Ogl..p..0/VPG..Y....J1D.U..$........~[.J.(.-a......|p.B6e.s7L.7 ..E..t\i`V....?B.g..NK8`...dnG...$..f..Y._..HBU.[..!h..o.#....:c..c...+.PU.......i\F..O.er..l7T.......~..'..-}Q=..P..aO...z..0.... \...46w.....&..PS.m1...(.c.....$cuO(...d.....]%..J.).......Z6..&.......|.=.B.AW..M.q..De.S$N......O......Z..`.t.....BQ&a.*..?.....?^...U.x...1.d..}cQ8...r.......w..@)....._.*...g......o..W..f....o.2g.*.*AE......KD.Y.1...t.....]y....{.M.h.1....!8...R..' ..M2.Dz..W..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ONBQCLYSPU.pdf.cvwQ (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.872320345795445
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:VhKheVkLL4oNe7pW/7q5/o4KuXNMDV/9T6pY6NTXxXAUIEsEclQ1AF8yU+OSx:V7+LKpxpODVVT65jxAVEsEcII8yM0
                                                                                          MD5:D3EF698E45D7B477973292805F8B3EA3
                                                                                          SHA1:CB379A225BBFCED9C755CB400503C7864F320E29
                                                                                          SHA-256:8FD8FDE96383F367ECE55C925FBC5C5A3E7065DA177FAE65E192ECA364C98368
                                                                                          SHA-512:2022C476677FDA07144CC775269C4189B90DDC2FD0334AF8AC3679AEDBD2C9D29CA3CE73334E02DBBF39C9597F142D038DBD1D3C28643519D6879C4635AC55A1
                                                                                          Malicious:false
                                                                                          Preview:lTtF/.i.g.....Q.p.V%.@E..)..2_..;~:2u~.......I..... ...ZX.!..R....t.c..$Y....@.".7K......=C=..d........]k.......Y....#wk.2..(..K....../.&6/.w.z...Q.!..).:.....$j..r.{..(.5.<%.v.p....<.X...v|]..)..C.B...Q....K........./.......x..C..b:Oc...v....4_o.9....o..%....u.L.NL.t.\...7..bM....t..z,..]..... ..T.!.}._. +..'.G....P.pQE1D.).........n....5.^......X......Q...t.a.8...+y.A.H.h...'m...J.....G..(.}..l./....\yGK..h...6..?.MW%.....UI...CrJ...n.)O...:.h..u.#..S.L.Z..a..\,H[+.....Z.....f.b....;.....r....Oi.-..d..;Z.h..(....J.....6z@"..c..bw.wbW)]S.e..m.......3.=..m...<.`.0;....M.....f..f.!..{l.BYx?CWJn#.1..ycl.,..5........}S!.X...`8.7.^.^.bt..u.......{C>..Z.....yz3t.9.......f56.vK.`u........N.,.S^....DS.R{.r...V/........Fi;.i:8Kom0y....K..)...X....N.Lv!..CL...W.3...f.U........#RqU.......!n.X..X+.y.u..'..Bp4b...[.A. %.\.9.1k.D..v&...nM..6...].x....&.d\."...J....[..e..A...~..xY..h.b4.....,.Z..h.%lT..V..40.....9w.U....2..!...S.&$M"#......

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.png.pyZl (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.83839402616436
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:GET9Rtqc1VloIVc9FbRcDXyw7ueiJbLRUywLw1xuk/s6Ju1YSUck:7eck27ywCPJbP7uau1Yyk
                                                                                          MD5:B9F8089A068AA6C4302B1A764BF08428
                                                                                          SHA1:1E7D1B8644AB6D493B64B691C3FC86A56534D700
                                                                                          SHA-256:89A0474008F8534BA128C34A4E80000CCFA4A00A546FC86FD97A698B194EBE94
                                                                                          SHA-512:EE5A2A3AE0ADB9A754FEC03848425474F079527883A3E7A47023976096C774D2F6FEEB2FF20AC63518294ABCE03CEEC0C1AB4F5B0E6D17C56A29EE97549C20D5
                                                                                          Malicious:false
                                                                                          Preview:...{WziZ..-X.......s.......T`2qz.+.J.....05.7i..%.,...S....S....P.)..a..e...[1.f.....#.....ce.......DIO..v..<...e.._..f.L-.O...h..$".1=..8ucU.....:*......u.....SS..q.... ?..Ii.<.k..i.1....K..p........'^...C`...........V......IF..f.0..Jz..'.*..QES.l......5qB7+.p....#...6$..x.Eq.....p.0...g+...m[..v..*..t.#1w.......c)\...D.M.6@....Z..\.*..'V...g..1.Y.7.........5.+..|.n"4..f.2./..WA......H%.-xH(...c,S....T......w.."...."..3|...[I.|C.].&Ov.i.1:.Y...........j....e.?.....$.........9....t..Z....E....jC9.5.........@.wi..e.dJU.N..C.`...n..w....&o...)GP^.K.....@.H..d.=.........U.mI...<Zo..M..*.V.dx..cc.F..........q.,...w5.I..F.~..R..<O....\..O....G^}..SXFzN.V..X......m.OK.....r......{.Yb.......P*......y.qn..MqL...K...u.7j{...LN <.......Y....8...7.4.~z.V..q.!9..D../...no.f...2S...IM.f...@w..a9...:.p.u...c......g...6tU46..N..0..:..4Y}...n..K....T`.......X.u.pI-`.N).....|Xd.].TN.......yx.m=..V......"K..u..Y.2^..a....\Ak.b.Y.7...

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\RAYHIWGKDI.docx.GDtg (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.847976231753901
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:bdKVZnMu5D5cH3F55UzWTt1jJ84sSZOdG1/Uc5rLmOEHGFqUaqSAe:bdKVzq3F55hBJ8XqOdG1/TmOVaAe
                                                                                          MD5:49BAA4629FFC306901B7E6D419FC70EB
                                                                                          SHA1:313E1F0BE8691639C1634FF701BC1D7991F357E5
                                                                                          SHA-256:CD523F42F1C5455F1ABDC6000C8BEF4F7CFB3E7C9CA99DFB1A99113DC56819A8
                                                                                          SHA-512:D8AC46047F4E76EC2309292C4D0021D4F17A35F521B2F609F48A47A25D0820B77C0ADBD596065C03421206AE1A5DEDB1B616496268B954DF3592C3C5205B2129
                                                                                          Malicious:false
                                                                                          Preview:1.R5.).,\.k._.7\..K.s..IA...m....N..P.^..J..P..$I.=..._.v^...E....02.N...Cd......$.,..~g.......$Sb...++P.3s.|.G^.{.....M.s.Y]...9D.....$..u.l<.D..W.,.V)ro>.Y.._.....?...t.|.9.*p/3BP......]@."Ao....y....!@..1.).V.|.L.R.L.#....m...Z`A./{..v...4.L.n.l0.TX..."*..?......:.f.U....rYP4.S........f%..^w.9....j.....L.....F...?.............^..hx..^..F.J.q.a.H ....j wd9.b.V6.h#..}..P_...c..+M#Q...4I.......P.....^.).:..=.)I3....^O.R..w.....z...UJS)W<..Zu..o.a......L.JN(..6....BU`...vyy..[.&........+.....BzC..k...O...S..=z.*h.......6....^.j..uZ[h....c.YX4....!VF...C(....-...Mz..."...........oBI..._X....;.32g.K.....|uU|Y...nu..=........f.......l.\....V.x.L^A8:...4...n.........8+.+......?..t...e..^.8..!mtYxt|_...~.....~...;..x..Oy.._/.7...^.H...\..'......bz..?DR...R..-.G...x....LND..=...1..q.p..u.00 ....s6...5....*.g,H..w...k:.....j.$.P.s.i...L#..8.k..]].W..C)fl!.Uj..KE....T.M..Q>.Ok.@........er|.23f...c.lF....R......- ..1.~?r.I..NB......J....%)."y...

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\RAYHIWGKDI.mp3.Tgzn (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.838472837310803
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:QcC2E/hJbY4l+HPuvLJU9mv9XybzQAfq0b9NRTiCCYVxSq5cfw9uonWNtaQ1ZJ8U:Y//bY4kHPuomvsXH9iRqefw9hWTHs1VQ
                                                                                          MD5:C3203DB5C17EF51989EBFEAC2AC5553E
                                                                                          SHA1:8609415726EE54B7C4FA404A0BA02D1B8E49CBC2
                                                                                          SHA-256:FAC67146F3786B2141BD154F67A769013F8A2ABB7EFE4E91035FD31506D35896
                                                                                          SHA-512:D81CEDA30580B60ABB74A3F27B2AD2058D46AFE101CA02EAAE750B6AEAD8FB3F392497BDA7CCE6DB495C84F1E525BFCF7208C74D64C9571B0EC45BCADE553969
                                                                                          Malicious:false
                                                                                          Preview:..(.N.....P...p....Z.18.p......L..#Qb.6..S......w..]..;I..E....&...-..L......pi...p..j O.e!.........w.O..n..#.Rh..N..O...:...p.<....;<........q.B..mVY$.,...."....9.W.z}.>t:..Y<.}W..OdAF.......daJ0Ja....dN..D.bo..*s8.a+.N...........<E..0.y....R.T=..!..XV...w[.'.....8..B...J.5..^......s\.$....T.*..]X...V.a.w.8...Gr`.V;.4...0#.2../^.,.".D....q..p.h.[.o.FV.^.m.. .m.....Z...]M..=|..0.`r..x..|..j....7.Z..!.'.......v...u&..[......Tc.L+..&.E6.RP.bo......Z..k1^D.......V....`~.;&...;...:..eP...+.OZ.dz....X....^...H....V-...Jg\..~n.!.|.J...M....:.i".\r.K..D..K?I.NU...t.r}.,..b.m.>.i..UF.(1....x...r.....h.F.H;q&...;/Kq..WKw..Dh...?.....3...b..Z..U5...-.Q.7...=.KG!.i..s..Y..tPe4.t.....w..4...k...sradI.`!4...fEx.jl..$.Q.SU&...I.}A........Ah*...ohk...'rA..>).."`.....i.B.m.g.6...W[..hH....j}..? .D.p.).<.c..[.^.y^GQ~7...3&..).U.i.r.3....i.qC.RY.S..xbkXN...$o"."6.Q.#.g...+'..zq.I ./........E.O.B.h......o.-..S+-n....}b..E:.%.q...-Y...j...j6.>

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\RAYHIWGKDI.xlsx.hkPA (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.867222399283193
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:srwbJnRSq3uJYmT5avnfRXm3hAhaCvE2mq8/CLw9EQfntdyHGme5XcKmrJxTKCzB:6wzNe6DRXmRCmq84AEiMwKV9MUvfLx
                                                                                          MD5:786A9B992BDB77C87B09DCB61F11BCE2
                                                                                          SHA1:8E0BA82946EEDEBC95B109C265CD2DF23431602E
                                                                                          SHA-256:D22F41B3374DD53266D558AB15DBB81F4B8F2C79CFFCE4EC5BC47A71C178941E
                                                                                          SHA-512:D322166C7B83DE0659842C6243A14079DB5327325C01BE3C118AD7AA22A0BD6EEEB2DD063DAD81E825E620F257BF4FA14ABB3C1669A9F47840E3850F08032727
                                                                                          Malicious:false
                                                                                          Preview:IhW?....I........r.i.ct.4.0.kz.`....5..(/.&7n*-.....$....t+.~O.....>..F\sM}..4.r..Cy.2A.O.........a..?.T...2s...G<..fA)1\.u~[.0.P.@.hn..*._._....'....I!.~5.:...i)a3M..r:.zFE..K.SsZ. ...{.6 .\.R`f....D..Vj.d).`.{...4.c.TWo..lq.E@......:.P...........@.....A./_.B.`.....y....t~......V8..};..9;.x.%....0..v..p.p..D.(..7.I..^..w.D.....-P}..O..$M[..1}.....a.............OQ..K.....$.T&......]}..Z~.DP..P.8|.K<..7...$..........(...a.._29vp1'.....G.>.{..l.-.9....:...7..9....Q@+...bg..!..pT.Pa*."qM.J((.Rn?yx..."w/s........?..%........DJ<."...^O.&.KW..Rk.H.....L?hr....\C.!u...(.@..".z..+0....d....<y..;.....1..(5.+.....0..:@e.FH......./.O...@...D.....k....*...f.....mx}....:LJ6....8...M..... ..!..|6Q..a.6..............n..k...:.l(..,.7...^F.._.<.^w......|.l.g...U!....G..".M.G.....z.j.|....4.=|...{4.>.......U...A;.&O.>..=.M...u^..C.n...*.......bd.D...3...>t...#.......~.T.O....k.8..o'..:...e.].c>vG.f......\6.I.2U..1.w..].......%Wn._.(Z^.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.docx.kMdc (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.84242992934652
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:L3Nk2P+MPpZHEG5KTnr5b/KO03v7QVV3/Hoq8cSq+a8UVS3OowU:L3tP+MhREfh5CkV1Iq8cSqlVSoU
                                                                                          MD5:2614E5BDF81F174F5C6FF4D3927E02FF
                                                                                          SHA1:0C17F1752E88A82519060FE357527305595D9515
                                                                                          SHA-256:F7195003A934CEF2D5723ECD7009D4E63383B17705C0BFEAC131F7E32670F14A
                                                                                          SHA-512:D0147DB180279272B458D0762694FAFB350244BD9140278E3A1976AAD100303E0A438FD3B7E75E4EE4FC778AA07D08351CD4AD9E29143EE88DB9A23EBC7759FD
                                                                                          Malicious:false
                                                                                          Preview:p=.M .e........V5...#-.`.j.]......,2'(,I.[.y...aV4.r....q..{i./..n.pKF.G.F...}p.4.t.-....q.S@1..'kKd......._\..w...q.........y.A.m...T......I.....k..&@v..;dY{....M..ai.RZ..e...>...N....j...L87...%)...&...E.u.Z..S...-/.<2{v.VZ.H..T.....Ec.....%..,...3......R,Y.....!V...*m.}/...he?..Z......S......B.+.....S.:2..W...G.b.^........V~J..9...!k...MG.O+n.d.9eD..Y".1...-3.#.t..Gv..........g..t&(/...F...y7b.V!...h....b.)q4.4d.,...~..b}3..+.%.bP..["r...=.m.......z..0J:r...>.(G..:.......'..1.U.#Q.c.I..g.HWwA..Q..R.!....>.=...k..0....4k..!o).,]'....IzBo^........-...w<........k.7rg.`...&....[?....|.........9.^<....f;.I..5........e...............Y.}..r/..x.Q...UE....v.%.b.0...s4..U....8.f.Y@-..6@.&..l..-.`...lh..o+{..nML...IC....E.n$...]......_..$...EDn..2..s.&......E.p.9..XW.-<...8q[.!.......;.:...7......n?...g.../B1}0..aSpa{d..H......7C.^A.9p^..0CBB/.S..!V}.dL!P.W...?...:.....j{.Io..%..k.j"+E....+@.!.e'952.O....,eZ..p.kv.5C...]......S..k....O.....A.d.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.pdf.WBAE (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.865495299984599
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:cORlKI2XcvJzrH3sMDKKIAeQ4PQfXa/XqS3wZ3tI9n4UuuVOwxqcc:/RFvlrXNDsJ1I6XJwk9ZOwHc
                                                                                          MD5:EBD1DA680F61BDDF39E6F655F2B954FD
                                                                                          SHA1:9F17C4C7A0267840C5992B5F515E7CD059E5EB6B
                                                                                          SHA-256:CAE0FDF026B2147024D1F1501DEE45FCE1C7C71CC0366D5A87CC264D7F4F747F
                                                                                          SHA-512:3F7CBB529651ABCE5CE3B5C98F04FBD7EAE5FE08FE77FEAF8A223FF714ED9065D18AC6D20513DB6B9D2B8A370C25D360B1C027E710A785D22137BF34A910082B
                                                                                          Malicious:false
                                                                                          Preview:....T\...T..+....7..O?.WX....A..m.:............wm....oH...\....8j....!......7*4..y..........W......*.Me...6+..^2.c.Y.....@.".@~#...#...........-...+d.>@..^.V$...I..h. g.k.......>.!!..)..C.2......+...f.5:..<...!ww..YD..A.R..H1.Ldce|1..oq[q.......2Oi......#.e....s.&g.B6`].._j.......a4X..i.#..Q....q`3..y9Z...1.=.:.u.j;..2^SkJ...:._..Y#.E.....b.V!.T.1..4...............fj.Q-.*Wf....#<P.Q..L..,...s.........../..j..p .I...._....W....fo.:...f.I...I|C^>@....8.....9'.v.....e.R.^_.[Z....w.5.E1.....U!..3.......$8...'.....gP<E;....K.C..a..n.p...b.mU.-...:&.30..Q_A....9....3...y@...!..7h.Ug..R..sf.....u.....X.S.............l}.Mp....#.....W.2-.dm.k.e"..........CFN.Y.G.B.]....Ik..t.....(0.5P.a.4D..~AO..N....UY.bh...P..1e=.yA3#..r..?.Z...\..)....RIw6...0....U...9.K...Y.....}../...U.__/.M ..k....9.9Lsa.@....u>..&.dI..2.>w.T1...|RW.G..".(.)a.A......,.jm5c.[8c.X..1U..P......mE....9..J..y..LWf.I...ic'o.!J..V.+...9..|....L.e...."Iq.s'.&,D..1.....G... .}...

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\SUAVTZKNFL.jpg.BMAT (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.846758391584427
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:UfEb3pwbOpVcDrF5pU6Bdwvu+xEX9at8safwbPMjOezGSqDOvZ2f3IAE6yYm:UfE7pwbOwDr3YvzEX9aSsa2PfOh2/IAy
                                                                                          MD5:AAC209B899B3623628B581D890023FD6
                                                                                          SHA1:A95C70DE552CECBD0BBCC87D2A534454F075865E
                                                                                          SHA-256:E97ACF9855FB188C6E17BA056072B525235677D096C7FECF2EB7891D784E2128
                                                                                          SHA-512:9D30793C531E436942E01CDC47C52267399D182F27CEB9CF891E634A02EDD6E9FB6A49A6645DF3F5CE322272659908F44156C87605C9183C14B7C931310013AB
                                                                                          Malicious:false
                                                                                          Preview:..h.../...|.h\."..h9v.o.{.-..n.}..b........`..w...d|@...Y....x.]..U.E..b;D.^.oU..].mV.%..<.....N.6w)a.$|.<6U/`.t.q...em..~...'.`y#.M....r*.zX..*...*R..D.xT(H..c.hC.d"...B.Nc...;c... ......Yl..N.I...nl.\=.c...9D..k.\~o.[=*iI!N~.......k.V*V.L;.8....|.^.k)..V...jE/...run...ac....S.-P..+.}.qi....{r`4/.-.D...EA;..xp,'..X.@.*9....Y...Y .\./.."S.d.+...$.6..Ki.d.I...>.?.'z.Dy.2..._[..L.YK..s...T.e.)SZ..`...H.....r......7......V.._...YE.Y......@..!...~..6...t...(.k.B.c....f....ni.rs. ...7.m.b|.V.",..p...l^........ wGL.{...&!F.n.@.....m..u... -p.E....c<....,.....r-...._....w..D.X...]...~S.*P...C.J.*.&..o.i.P..:.........I.(r...Z..['...q.h.?....Q...\./n{..y...4DZp{...1...;....M.^...S.X.."...J..kr.....'.%Z..h..<..e..F.G....!..P..Im9....d.Jm.>.Bg X.b.:.R.;.r!.B.....l...G......6@.7;...W......SB..`...R..zT.....C.....P.c.R..o-.O...-.u.[..$.........^.O.../...br.V~Q$o..v..m..K....1!.am2.#d...!.>...E.....}F.mv,.4l...j*~..6}.3C...1.....cO...h...z....yZ.TM...

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\SUAVTZKNFL.xlsx.ogWI (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.863131941256326
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:/TDvxiTwradeMIoND+JuUfNLCG4OM7Ju+u2IwCJNij6zCwVhKMb2gag4HoWYJ:/yUVoR+JuUxTMtNIwCX2ohKgFageo5J
                                                                                          MD5:17DBD402A72EA2ABA8AB00CC5E8BF89D
                                                                                          SHA1:EA0229CD242F4C40B1AEDBF3BE3236623C020EA0
                                                                                          SHA-256:CB534B9573D50EB2EFD1E57541A80708526084132E40FCAF7C28537B33738DD9
                                                                                          SHA-512:30749DBDAB570B806A0E24A69FE5928AE5B747A20BA88CA46D18D2BC548B8612F76027B653503F656F100FC5AC992420D3CAF3C5528EF7C8ADD39E407B503C41
                                                                                          Malicious:false
                                                                                          Preview:._d.*d#..AOt=....0.E$..HG?.i.:........$tl=....:!!P..C}.V#.Q.P. L..[....c|m.rKV..ZBg..#...Mi..M...GG*.......@,K.i.r.M^....8..e.....t........d.v.. 1W..h..h.....ph.......<.#T......`.C..Qa.......Jw....s.S!..&TR,..Zb.x.5$4...a9P'.9.....e.r.)..k<..b%...|..IyH.+..Z..Nz..2..a..... 6...E#pW.(q.....t.s...p.)...]M+...T..g.....\.V.W.A...s.7.....:.-....g.<c~....z2a.G.c...l-....$..0..j..P.3.q..%_...F8.....().a...9..<8B...._5eE..o.p......^...T..[E.h(3....]..(....B?.."i9.r....b.b..n...E..@D..$.I.5..B..........'?{.....7.e;......LVb.\..%2.6.:^_...r....gxi......$......d.%U....VT4....+..b9......>..!.@..V....1...s..Ss..R.l..,..&..>...Cq........,.._....E.......JF....Q't.|[../......=_;$..4..d,xQA..6m.|.z........Wg..w...D;.(.!.w....'..ev..>+.q|....k|............f.F....!4.m.2..'..T......>[U.J._...hv.o..H....x*.oy.t......=.'.r.......A.j..Y#.2WN/y.|.s$.`SD.u.....js..s7.. ...W._.K.:.ve8.o..].....eC>_.7^..:..;..w...~.px.930{\.....Gr...kKW;...vFc.5..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\UBVUNTSCZJ.pdf.KVns (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.859765160924359
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:6rr9vdvAIcQHB0kYKVzxSCXBOGiq82i0P+cM0dMa23DgyOkynPGiMvSi:6rr9v9bakZRxS9Pq8P0PdM0dMa+sG1
                                                                                          MD5:F97E6247C9B10DC3E3D18C7AD24EAFBB
                                                                                          SHA1:776D6441CD820AA7ABABC94BE2FFC0C734938C67
                                                                                          SHA-256:56BBCB91DB7E289E15D6954682A842E77E14895E697F12E2F0BB32A56BAF5289
                                                                                          SHA-512:EDD95F5BC932655C03235DB49D76BC76423E3172053D1CD601F1ABC6B781813AAF7EB7C61BF4841E5EC3A56A03318A6F83E6BDBD4BCB068E3A4C84B36D1462BF
                                                                                          Malicious:false
                                                                                          Preview:5...`./SW7;Z&....."m...7........#PA&..6{.'.....0._%......Q3z...`..s.V.M=^.X..........3~...x.Z^.p.]...PA.CI.a.s.f1.u#.......}.M....W....Co.0...}q=C.up..2..}.>e.!......v3.d../..C.ql..3Qqb^..""2.&....bA.#t.C..Q=]..C.O4.O.Z.|AU@..} :.Tf....x..%..yM."..L.1]g...bK.....@..\@.^.../^.[`......F....Y.~....5....^.$Y.C..hV..M.e.6..V......_.m.ayA...-e(N..(:..\.....F.~....0...q+E`~.]..CX[.=...7.KBt..N..J.J.........pH....X.D.blhe..t..\a7........zVL.G[4..C.xU...H.2..D......QU.q..Cy..?.y.FF......&..3.C.. .h.k.w...f.i.8...+.I8o.'(.%...{..n...JH.....^G......t...zE. .;.S.P.9\.a....J2T.....g.i......=m...8...=9.....K@..........m..8..[F..=q..H.N..............ft.x..L..4........>...z7....`8...R.o.E+y...%S....N.....hY....t.q|....#....Z}.g..L.....0......M..3..S........g..s5k.V.L....n....=+.dH{...P.Sp.T..5...[.]..LnM......Yjb/.<..@.....Y8..f.2.....d.._P.r.J.?v....;R.}I.FW..w.?.c..."..kb........1.......R[.M?X(..q<.N......y.`DE.8......Y..]..9...k(.V.T{.._......A.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\UMMBDNEQBN.png.wcXO (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.853935944558873
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:9L17Lvd7o6bvyLbf0zUFf6n8P+xwA9y3bbCGimbFKF0HFI42JEAMQ/YXl:9L17S6bvyLL04Ff6s2yLbCVmhKF0HCMf
                                                                                          MD5:9C23BAEE8B28089219DFCA5B1C9736A6
                                                                                          SHA1:78D3EEA683AF33B5007EB24FD76981249056E112
                                                                                          SHA-256:5F34B3F0260F79D6560563D67757E0BF0AB9A1CAB8E5DD975CBC46C676C944ED
                                                                                          SHA-512:341DF6725D79A8398B65FEC84B60C868196430A3C8C70BE852312062D86AE5C1C0ECD0970E5C2A380CEE78E9E5691CF6D4FCACC1A04D06366366B418E6FED42B
                                                                                          Malicious:false
                                                                                          Preview:O..y.....G.C.....gT.(...d.@.pM...5.v.$#4............k!]....%.6.m.... ....F/.1.V...YH}X'.^.gx..O...Z|8...(...;m....D...Z...3.)..XJi.Z..q./.~..R.a....i)..i..j...\.q.r4.;...f...C.xlD....<T......1bjo.fMZ9?...l.....|*...*.4....ov..e.....M..XsR`...<.....Z.2.e......(P..%........H.!8.<q......EL[..'Q.9.R....0CO.<.0....#..I.....I.W.T.>.L....:"/x..i.}..Z)...uN3!G:...V.,..%.=i..uC(....)....4......K..3....|;..;.3....S.-r...^...[~..g>....j.........}S.PyAR_.6..m...G...z...p.1/18]...'/.......T.....\..q..M..I}.cr......#...EO........% .....=.......K..'._.9..t.Z._vy.H...../.Q..Dc..z.^J<.N.y.hl.b.pgF....*.3..jYt.......1..T....?o..W.../|=.H...OeB@.f..{.@.kU=QQ..b.,..7...xF."..h.&.......W...k..~...~6....[.`..X'..]...d.q.I].....eBQ.t,V. A@.44wsK5{..v:.`.O...;.q...nP.a-.....U|i.......Qc...'....!U&].L...C.BH.....k-.c.#.=SD.B.....*.../cp......p..}8...q.<.A.....L.. ...D..g....mX...YX.8.'..x...u[b,|.,.mL".U..r...*(.$....zYX..K. Rj...].p%..C..z...;;.......:..joC..[}

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\VLZDGUKUTZ.jpg.QTfS (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.864341169774288
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:KV7pWjfzSPwqoUlEH1hzwFb8Lr9e3d54shFcD3j6XDdkwGrH9DK3C6Fo2u2vhPle:KnWLksx2b8LZe3f4t3mct6Fo2u0hPo
                                                                                          MD5:DC7FD3528E37DB716EBF6B42FD816BC4
                                                                                          SHA1:823DBB9DE6A13AA52C741690CAFBDE08E4FAE568
                                                                                          SHA-256:5DC45F764CACA1909F970093F03F8675E1AC03C77387FD6D7F2C277A1F7D8263
                                                                                          SHA-512:3C65653A168C4B1268F58BB30C38CD18F4FD20EA8A0471411C504904301A89E800D83C1A96A4AAE4BD1CB14B7F22F5E3353B116C58935A62A3A3045C2168452E
                                                                                          Malicious:false
                                                                                          Preview:.K.K....!.....A..|...........K...}..Xk`.38.......&Y`..b.J*...=f.&=Ek.<@....^.D..xa.,...h...5...y=.....-..w.P.Bo...*..#%....64...+.N......K.....*d..>..;.j..i......;..5K.L.6...r....#n....e..vW.<.o:.5*A....1..z......#.f.%......aa.B.{.E_x;".%...x.....;..,....d..z...W.rg....v4..>.ISl.vS.....u.Dhf..Wu...g~.q\...C...3f....1T.5.T...:...D...C...=....M...3Z.#..X.l...{...@....^...u..#H..Q1..*.....`...s......98J.;......w..9<3\..M].}.<z.do5.....#.{...:.._....C2K!?.y.\..:...g....W.M..-...Y.7.!N.E.tR.7i....,5..[T&.R.........xC;..V].;..xgZ.QnA.D.u.?...$.X.y...!.&a.Z.E ........v*..y.....@......y-..YY&.B...P.|.......Fj........v.e.i..~.K.l..L.WN..m.^>D...(..Z..:=.z8......B&....x.I.....3......#...38....."<0..U.s{`;#.h^.9.{....k..l.4W`U....*....V..P@..{.N..e..T"<qI..B.G.UHZ.....H.}.d.O.H....].k..8..lt.(Vf..X...$<B-..L.E^.>..(..V..@7.A....L.y8..IA....r.ls...<._.....I._..Me....K..`..|.N.....~...$'..D'i.v.......V..1..../.Y..p0..\x".n..P......z..*.d'..3.C....

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\VLZDGUKUTZ.xlsx.AxFM (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.844185495347405
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:pOeBf4f24sHK6GEdkKxFc3raUZndNBlsYxn1drkCbiIP/61J+Y393H:gs4f249z0/y3rzdNBlVnzHDY0Y3ZH
                                                                                          MD5:7C7F055E8887B92101C88CF8F35DBBDA
                                                                                          SHA1:9C4A4FA461108527D1F58A0FF059B542BCD97E93
                                                                                          SHA-256:D0D9747C7C8A27AF74AD933AF3E2009A090FC9D753B3C5260A66E869B5D1E09F
                                                                                          SHA-512:64783678B4BB889534087DB39766A8481D81E4E17B6E33CDD77C1950418F817145D2BC5B783CD62C3E9A1467CAFF8340C3B4EF0156276914640FF5F9D5B2CB77
                                                                                          Malicious:false
                                                                                          Preview:........ru.f...3x\.=.e.2..5...Y.OT.omh.....T..t.k.T.yce..t.$.......8c......j.~.r........L..{..y.,.}....gV.:...4..+.yR2.[.L....U..\x...P.U`.<......&...$.Y..y.&x...*>..U.%.I.3...!.l....[.)N.Zw./..(.s..<.....K...g.D..y.T..U..-.Jw.d.}CR...P.r5K..E.~.WV..}.....p.uI1..y.G...J..L*......U..2.Hx~*{.[...*j...is....&*E@....=..vc.zu.#`QI........T9._...+.P.)...'.6..E..v..S.wP.'n:.r.<....B.,...R...]..o...........@.RZ5.++.O...D>........qA/~8.B..jBC....>.<...[.z.x.-....D..(..d..X.$..=..<...k|<....g..U.g.8....#<..$........%.g.u...[..%....m81k...,..<sE..( ....<.9..%.4zY/...q.?2>......&!....o.....j.::z1......'..C'..urH...K>.!A..Hs....x.#ed..3..,]Z.....@.V8..8.Z.....{.Ab..........;..s.AgMjZ:........Y.M;....E..x`...c^.."..!..!k.`A.M....'./q.-qmd..w..B>.n..v(.\....H....YK.T...k..U].X.....>.E...bc......a..Y..T..#.......=...P..I#.....K._...Ak.[..&.g.l.....~.0.^..(*.#...:A...<;@.Lc.`.m-M0....5Hm.%.K..'<N....6..d.....%.....?..V..I4A#t..2.V.&EK4.R..n......

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\XZXHAVGRAG.docx.xZdo (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.824626529053078
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:87QU3X52I+HyRSRxhtbdZQIBXXogD95U+wFBcW0jEzaxV6TNf7jYGe:uQlVASjPQPgDzOGJxVOWGe
                                                                                          MD5:CECBA2913A9E637CEC4117F3D5F7E756
                                                                                          SHA1:2B1C2F2EB69B9649AB40BC6C4634779110E3F32A
                                                                                          SHA-256:805AF5C0EE8CC1BB0D26B3A8A1D94FCFB8B46BD002561509C27A08B26CCA1BBF
                                                                                          SHA-512:4129323A96133E507D436CA68B62B59E2B66623D54173D384ACCA410CE4FDF84A04270B71BE11F362FA2AD0BA89708599AD58269E03710232F0DE9AC9722814B
                                                                                          Malicious:false
                                                                                          Preview:.e..........E...'.".OI."....Yh"(W...I....3...T.&.._...\.O...H.j!......X....3...8....D.IJ./.z...../.B....!K9.XU......9.Q....Ae..-..%...Y\?......H.y....:+..)..P../@L-..3 .....#...W.6;.......R.9k5....[.F.JPd..T...Q..`{..6..g...f?d..(...)..Ly..^8.T/2J;...b.......~......%. ...%...:.w.w...b.........1......q...Q.JJ.. ..eZ.<.......!.(..Pb.k..e..y...p...o...*m.@\y.a...P.n."z.N....(.j7<".DM%.D.~..H..i...a.9E...{..Ym*4...9-.nO.ME7.T0|.2#_N1..V...).\....,..-..4.E..d.a2veT..}...F...@...[.w.(.}c..g.P+...P...../{.(..r.6*..FtH.......EW#......:F.V..?a.4...Ww.......~;.W.......(..AD9...~2v.?Bo.Z.....c8.rS.>..y`....K.3..g;P..R.t...#.O.&.J.4[.....].P%\...q"4x.4L.J/... B.(..6..nMJv....@...iR.S..I..9........#O.../.....X5..8~..SZ.X.....O...7Q.U-..l.T.......`.4....C~.!d.Qv. .o*.G*.i...l.}.<........tx....I.j..S.R....>.AB! .D.l...dA.f.bs..f'.X.T.......I.....M..!g!.E.,.....KX#..Z.;E].....YP.le....J.mZ..SD..\........T.h}.2M.{R..Z...........j.:\..{J.Q.;s.by.AU..y......

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\XZXHAVGRAG.xlsx.fsGz (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.84712652817568
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:MSFoo4JGkgF1JN6L55VcjTE4KsrAx5xXrvPQik3KiY2v8AEvHEhMOSR:NO7Gku68SZxDXrQf3JlzIEhMOc
                                                                                          MD5:3B0D9D4700B27874C9687894D2CA3994
                                                                                          SHA1:B6142C25BED79EDA34A15BE2859E87C57ABE70A1
                                                                                          SHA-256:298839F7B1FEDB6AB84CC5EB369E5558FAD7468C9F2E1D9B898FD0ADBF4E47B6
                                                                                          SHA-512:164080E9B1AD91CDD69E5CADE5FBF6CA63A59403E8352EC299CB5D5CDCFD758E1A127C7C5A06265CECDDE507635D5298EF932ACF044493FF82BEC22590F3DD8D
                                                                                          Malicious:false
                                                                                          Preview:...m........0/U..*...+N..pg.OdznD.........S...X... >...D...N...lw!..4.......x..}4wz.......S..uw(.9k...x........~.._.#.......`..k............XL.O9.0....%R.2...-...b.:........6;7.c....(.w..$.O...R(A;..&D.}....gW.FU.t...B.....B.#.+..ml.I...V...3.....f.....#f..s.wa...)U....^z.u..`..OxXpV..i...~\.H,>.V..yO8........<Qn.....4<...M?R.......2.....A.T\...$..n4.;d\[.....y6%.....b......I#.....q...`!Zb...5..~.z...0.wl3.x=Rh.N~m..B.n..9.8. w<...&?...(hS...Z=C...d...'.....fb..=...AK}.....F.h^.F3t.V.N3..<c.A........D.a.EV.m7.t...[.c.[....T..u.B.b..2B.Q..j.F.LN.....L.Y..B.xO0.2.l.~@o...T.V.....D.-.7..tY.G.....a...,.2..ax....-.M.:^.;q..\.V`:.+...........r.x$U...DDa..&*C=.>z.4...9.S.9ff*|@.3B.U_.+.?IH..K....p..k..N..j*r.{.{.,..7.2q..%..m..d..^Sq.<.Qx...Im.q...M>....*.......%..9.T...].......?S..t(6-......2.R...u..>...bn.....|...\...'..m........w.U...S...A.....&.7B.KyPB.=N..I...R..q.1.t8A..+....y......N...~..A.............O9.t."...kn5W....,..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\YPSIACHYXW.jpg.hQMJ (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8281402199755705
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:rpfA0MIDT652gaDUdMI5Qm8kv8H9hkLJaTaYOLpqW+JdpLUqybnJiN:rtA0MIDk0DUKQIddaLJxSNU9DsN
                                                                                          MD5:36F997F7A2491299B6077E35B35B1767
                                                                                          SHA1:104B8E2B9E7B9E312599FD7C7F6F3E476EE7796E
                                                                                          SHA-256:5D1B2212E1EE49CABEF16737CCDD086660E79C72E1ED4B00E0A9773B08302F52
                                                                                          SHA-512:4A67CCCEE3DEE15A9A294C44AE275BBE7128F94A8CD21D92F0F6FB8DCEB5196A7A6148ECCD7A821896092584AECD3F244433BEEC15ECE0FE053510B9B8ABDC39
                                                                                          Malicious:false
                                                                                          Preview:...C..........DH.~....m?.[...I.nNm|.-....C....2.-(..g.IP....2..)....ndn.p.7z...W.\e.a........\S(T....U.I.;.m|.!.I...1L.bw)>.#(.OE.pp.Jl....B..........=ZK.<.&...B........5.or.....DW.........t.pO..8/@.<.8..n.:.".....;qb...?=.:_6....hS.....6.g..^...su6A.....4..8..k.z.02......`...Z.@.N....4.lg\.1...N..D._.....zN...#2Q6....?..6.a..a..a...t.....w.....&..w...s.D..^.~..tS"...Y.c.)C.k.....D...`BK8.k.......R.p..k...*...myg.....l.06.u...H.)(.t2.2...y../FN>?.r.=.@?.8!.dj.[DUAR.>].....g........}7.e!%...}...h .../.W...,A.2.k+.$...ZZ=.....5.....`!.4...5c..7.k..*.z.....R%..7....sv..i.......44..x.......:@.-.q0pX.-.<....7......K......9 ..[8...a.+..1.#lI...1R"bg............j-...zg..'$.2....r%...UG......#.$N.6.g*.V$M..]........Z.....;..4m.,..z.>.c.e.$W...<.kii.^.....o......`.2.:+.... ...9..f..A.}.kk..}.....Hv......\S.a..".......RM...Y -6r.....$....L_,.v.Vl.C.C.[..-...D.v~.;A2.L.m._....8...k...,K..s..f.t|.])Ap.en...d7.....D....e.O.....k.,!.[.......

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\YPSIACHYXW.mp3.EtTX (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.858225391111118
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:seKxclYVzWvr6cirmoxMvtO+3gs0+F6sIRdUsz5hTYCMxsw0OLQHYq5yWBmXhw:9OcWS0zxsZF9sdDXTYCMKB2smS
                                                                                          MD5:319071305D8AE0F8C4DBA19144F1510C
                                                                                          SHA1:2281434427AB05C5FDA5D870492C3FB1DD8E4B97
                                                                                          SHA-256:99ABA8745DFA531090527CEED7C240D106278FDC79DE5F60BD88DF9CB3C875A9
                                                                                          SHA-512:7C1BA39C8B651FBDFDC16DF4A6B5580300D1AAA02C4A6ACA95F6A95D406C24EC18247AA2947BD0E10884DC3786D72E7BADC470BDAF5165F04E6CB6D689C0309E
                                                                                          Malicious:false
                                                                                          Preview:.......9k .g=.pe.-.A....n.......lU9...R..P<..P....F/..d...<.[W8..5....A...W...R]cL..#.s..&...2..sP6UAdt/.....C..r.tY..s..o...x.{....w...08.&..v.)....u..i.Q1...Xwy%..p......{?...:......Q....EuM...6IWr7v.C.w..O.o..5.qGw.7.]..T.M.8=S.hM..M...C`.ymt.hp......Q..{.....6....O....3p...A..K&......^.:.><...5...lP...@L;......hH...$..<..OR7B...QN;0v.M#c.^~..a.hn.......f>g;..(..T0.-w..$.aT...\._.4....:B.a.]...&..>..Vd...`..e....+)p..IG..A. g.<.....v6 ..e......<.<..W.<..ez^....g...s...z...\..rTkP..R..5.L..s........?R......q...2?I....$.td.".4W....F...:.m...+.....-y.-./ .#...P....+..ou>Y....y.n+*.94}.J.#&Cf....{.E...%...)V|.....k-......Z.`..c....0o._.r)4.31..b.0j.&.-x.y.i.;ES9'.B....E........)..F..0@.}..<...R`..A.P".f...z0....nr...b.d...FM..x.W..u2^,.}./t+ .,......l..7.z]....$..o....rN...rM..:!.}...-A3;p76.e......m'.Z...F./l..O..v...eu..b.B.n....P..-../..wt.\...H.8-`l.....f>.z.$.J.5..pC.....D....|..a.i\..._........w...gU].e.[|.X..H..?.P#2.fa.....%..M......u..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ZBEDCJPBEY.png.FCir (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.850838932238551
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Gbjoah5l8B4O4xV3ACezf/e9BvYEkQY5W5QKtBUYNGmxbjYbFAh05Rl:GbjDB8B4O8VI/e9TkQY5IBfAFAh05D
                                                                                          MD5:19BCCC09798DB43356C1E94BAA3E9A42
                                                                                          SHA1:3FC7D2B401A288B262CE503CCAE584A2AC7ABB83
                                                                                          SHA-256:6914BA6C573D8FABF7FBA504C320A2A6E5B1F527D12D2CDBF59A8802B8E7DFFE
                                                                                          SHA-512:30EB34B7DE6FEEED8A52601DDDBDC8B1D52BCF7A20856C3E8C09F4216EA0229B9F8113939A3858279D208761467C8C6FF30F11E637D89ED5899D1C1A4A3DE7BE
                                                                                          Malicious:false
                                                                                          Preview:...0E.i".")..2...h..vC.`*\...R.\]....T.....B..f...~\.=.2Ynj..z..'J....B~JgIY']PJ..u....HC..v..m[T.Lh.G../(%....+.J.hk...b3/.{......gz{..2..6B.2...~...a.....w.k:.*....W.....e...H...~...+.ZsR;...7.............6.Y.X....K\.2.poN0?p2....t...Sa.C.8....,.H.l..ok.2QR.y.8v..Z..g.9.#O_)..f..?!i..<..&i...A[..R..F....2..Y(.y.O.(eP....h....K..z....`..L.8.....e.l..)..;...V..!...5S=.....>,..0+...$X..&...]...c..I..&..F.zmY.#.W;...'.G.5..u......=9.w...cM.o......xY...n.5..9.....L.....F.2.....u...<Z7l.am.kR.W...!...r.M>...pB..M...k...+..Zn;..$...;@.1..Ez....];AV..}.GURI.C..h0.%v.)L'a...P....8k.[.ZwOc...d....M....=.W.!.(p.A.......gR..D4.c.._.J>.X...@.HnK.o.t....}j...)8D Y...o..n.a..|.@.t.~.I[.....<.:"...`...FP.qep4O ..z.}pn6.G.y=L4p...].:....|B. ..Xh.w.........P...u6....0.e..m.*..Uc.....".=M....;f....6.+E.../i)C.y{.c.J....t.~...s...qx.n...._.^|-.OT...$N......Q.s.c...E.....qA/...vFCU......P.Tu+...G.....Qh.[.-...~...\.;h.l..L.zY.....c...md>..B........IL..2=..W.f.k.1.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ZUYYDJDFVF.png.uklg (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.85938493608507
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:HLtU4uKHmqtZvf+ePwkCiWVczibKeync6gaOdyDpECj2tqx9rhXii1vxixOsO:HyKHmq7v2e4kVJnc6sdylfycr0idExOV
                                                                                          MD5:EC244010C8FB95C74D10EE21E30F41AF
                                                                                          SHA1:3CB67263A534C00FB3F39C88FE88D87FF2E98BAB
                                                                                          SHA-256:B745116CC8EB2710C3AC796E127AB7BF9B74D942E26E77684D7B59E4CADB63D6
                                                                                          SHA-512:12B2DA31BE91F2CD1E984E4C855B3A6EE1E030BDF2C51C651095B0FF18EF2B5CEF76D6134220FBB522C5C1EFFE83E4C1D834052508462C4CECF92ED11A9EDD68
                                                                                          Malicious:false
                                                                                          Preview:%.=-...5p(/9V"'.>..`...|.#.4...a0..D...A.t3..,...I+j.D..G...q.L{.J.Hg.b..............LW..3XZ...j ...9+..ib..[J..K.JA..#3k.|....>..x.#l.R..t^D...E.zwqk......-......dN..m...O+..c..(`...l...6.V.~.=.4..8.e....M3...,i...D.O.m.....^S.*.H...4...'#..`!X.... e,0Y.'.&7W.Y..R..q......S.}l1...V.Cj.r........(..E..H.J...o>I... .b......|..p.sE[..z...8U..la......$.9N.b:....`...T..O.!..}n.j..&*.r....}w.~..E..$.n..qo8p......e"..%...=.").v.U...3D.P\..mHW.c...*.{.\...D..Z&l..M.......b9....cA\...,.tog....6....I....}<..../.]...h......;...I).q..%..^=!.....a.(....Au"..z.bW.=.S......P.?."ab.$...b8.q....As..3l......$.5..P]...v.O./c2...M...X`A.U.:+..#.\.x*..........].4..x.......3K6..dA`x.s.1...f..dM].F.t..C.&..C...V.^.,SPl....m.1vZ.(.[.."..!]...~m......v.Ze..v.`I.y.nc.#..Q.K.1./qH..........J.].........'M..R..g..V~G|9L_Xu.Q....L|.+Nfe<.c.....Ho._.....@...';.....=.L....z.r.....o..r..lX...'....^.v...*?..swisQ...z...+..........=.....\...Q.6..&3....2..h.\E}Yh EZ.n.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\SendTo\Bluetooth File Transfer.LNK.oytj (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1315
                                                                                          Entropy (8bit):7.862285145210913
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:zHW1vj+9dcrexdmsV6h72PTKF82lnTm+xX0NGERtcKd41qcyX8N9:L47+Nxdm92bYlnTm+xX0NGEcKd41qc5
                                                                                          MD5:1CB9BE9A6435C5AE0D1930B53F38223D
                                                                                          SHA1:E8F900C85E0E6D2577E938149EC939E9B8A1619D
                                                                                          SHA-256:FC3B5DC25F7DAC520FF1258FD7CBB7D45D20D5A1EEC390F0C5DCF480ED00BBDA
                                                                                          SHA-512:D4CAE288D64B36296A005E2F3F9994D974A5BEA5FAB58F6DAE06E6738BEFF9985A3358A7BCD36F74A58AFAFC08C500217BF5712A2A644D833F660B855EBB6F79
                                                                                          Malicious:false
                                                                                          Preview:LO........%..o6....>.7..o...&8.L..*7B.|.............[.A.z0.......!.......|,..\...3..GCqI!=...jr.-uQ~.J...._n4....C..k..Zv.ce......c....t....C."..%b..'..h.....9.A..5-...Y...2..5.8Y...*@...S..`....lMiW....M...)...H+1....Kle..NN....%z.}"...._.7..F>..g..lY'.;...>i...K.-.)...L.z....)5hx....e..S.V......wV..L..s.n.o.`....$:........~.U...7..Z.%y....q?;m>1x.7.y.@..7..r .n..J.T.{o....-.$..............D..`..;.l1).p.........9...............p.)..=.....h....A2;.p..xc9.......+..9.{[...@.........X'.....j`.>y.......;vVW./...j.....J.+Dx..w..7.s.q.. .r....CX..&.......~S.bMOM.A.T'.U............Qm.f..[...'..l..}X..7#...`G...|..I.e5i.wMV...7s........".dk.....[Z...H..V.1......:..~P]....Om._.H-.-.$.%^;......g...{.1.(D.8.X..[...@*...p.c.]q.e.3...._#9[..O....53..*.C.....k..DK9.Zk....+..@..l=.6t.G>.K.:..5..0I...QJ...o.....A..............s.bZ.&.DB.o....;.......M..l....>..3,JM..~........s..|\.#"...f..U..D..U..V.0Z...r.io.R.......u...?.*9.."..s]8mix.g2f.....%=j...W%PRM=.v!a=

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.cxhE (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):436
                                                                                          Entropy (8bit):7.538933846787758
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:RzSV0Db6P1Ox6TFFXlavztJSIoaj9hwxZ+g/T7n:9o0SPFF5wz2l77
                                                                                          MD5:C6DCBFA757FB948CA387DFD675802997
                                                                                          SHA1:7F002179AFCD86ABAF953EA540518C770528C090
                                                                                          SHA-256:9D024E53EB48F4AD7BF9248C0508452DFB00E83908182F3141FAC6CD1BD6A0A3
                                                                                          SHA-512:744626B2726A3084CC76F8C7BFC4FD20F603B604302F73B1C5FBD70323682FDEF4A0F7218B4097593E03E9BB7B6BBB0447BDC1E774855310147C8B0D8F0E971D
                                                                                          Malicious:false
                                                                                          Preview:K.[@.c.pq..=.w ?n.!<.<E.....n.f.<Nb...y.@....*. .A.y.c.p.$R...3q..I.4.!u.l.l.`...3-..1bF...4.w.C...O.......?=K...^5.D.;..._}.k.u.7..H..x.,.v...b..a...cY7.8.1.1.......Fo.KH&Q.E...Z{..}!W.!.."....}.%/..7..k.d>..4.....`.-......;j?.$...#.=;.......?H...w.MHQ92,......Kw..Y[..Ykesr'|..{)'k..h?L(..X...<.z.3B.(!.......O|.......|).6R..K..G..h.DX..La.H(.).L.QM.<...0G...E.*.x)D..a....,m......S.5.......Oq5&...0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini.iMec (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1200
                                                                                          Entropy (8bit):7.8429013415452715
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:+XQRChoax+a2cOI/Rh+PTiobeagwuobG44eCRo55EjrzgSGSC01nvUb0RRkuC4:uQUR+aEIvETioaSu4G40GzlLS7176uC4
                                                                                          MD5:CD2D283D9BEB5478531151EDFAC326AC
                                                                                          SHA1:A29D69B1CAB28D978515921662D1552D22D1851F
                                                                                          SHA-256:4DC7BAAA1F5F52E8CE740C0458003C624EC4BAC62F13744D5EFA7F7174B0062E
                                                                                          SHA-512:FC0FE4A326987BF8C5F7EB97CCD60596C05E217835FDDC27955BCA0864295C8C8B801A7204DE618639A484C799AD82FC3C17E4F9A614624360AF89DECA187605
                                                                                          Malicious:false
                                                                                          Preview:..z.o..l6.3..C.1.2a}...[z.|.)..`'G.`M.1 ...6\\..&...AS.=.|...-Zw......W.=...6m.5....a*w..'.h..;.G.7.o2.U.q>P......W....... ..ico.;...9k-.]....6y.......k.b(....HY)\.\?...._...n..[.+j...\v]3W........E.f..o._.J.iiB...:).}a:S......LO..V....j....W....Z..s..UI...7...%@m%Kf]vD..T|m...W....`..Y...DL.,..a6..@...V.wKOv[^.....g.K.m.M.{....}.....px..BMB........O..*......r.W.H*p.....&.q~8=.v.....V>(REHY...).!.ej.....h...[....k.<...+L ..8.r[.9.dU..Z...."..@.->...$.....|.n.JS..1S[... ..Y.H...A.!...8.{-"...:6.qI....RR. k....].....C..+.5..l..-+.+v...A.yX.@......S:t<0.|....q.....H....~.b,.....k...4..>e..j.....Y!~..)......:.m......!I.7..3.P..N..T.....d!.....t...2k..Y......=...-.0.B.es..H...#}...y.t.J.O......Q.u.q.. .4.Umn..U...8..B,A#...>.Y.J..l'.xAk.D.."..s.6@K.......Z.0...K....D..R...>.F..x..".....4S.......!hst..7..R..v.B.............Eu..#Sq.h..U\N\...S.9 ~....(.0b*"i%..l...+.2...........Q.....C..CU.%...l.!.5@.i5]XA.^......O?/j..&W.....d..U.T..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg.dpxD (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):67950
                                                                                          Entropy (8bit):7.851257782971141
                                                                                          Encrypted:false
                                                                                          SSDEEP:1536:YAgZ14pcGrjw2RAal82F5EwtJqF1WlDBGOFBbVEmR:fY+prs2RARw5JqFoJnbhR
                                                                                          MD5:968EEF4B80655C0296D27F1972AF1756
                                                                                          SHA1:1362E7FB4922F8180547CAB5E048925C86C28B93
                                                                                          SHA-256:BCC7A6B4A479B4E8B49275FF6C7951262C0172351303FE5836D1F28CCBA14E72
                                                                                          SHA-512:568F588AC8BB2D8914F40639E01E237C239FD045B15BA2F26778CDE00AE58908E29F93DC83DA79F680B2BF0894814849FA3B096678450CEB401D275FBCE41202
                                                                                          Malicious:false
                                                                                          Preview:....o..H....X.M.FE...V....<w@B....B@eQ..@...8..Z./.............}.<pC@.3&B&.........r.<.{Z.....&.U.2.l1.9.Q.G.\SV.+..fo.V6.i|.~......<...F"..P....A%H..jwR..l{.P..a.Jb...Q..%.'"y..)i..qa.....z.B......9.Z.f.9..&..*..R...'.*X".o.U.L.J...;O.1...-.>..[;n.*..:P4.G.J;.U.DX3..-..i.0....) .-.-...b..e.+.+...r.U......y.SP......G..gr.<.@.WE.."..0.._...p$9.......T..u.......E....cR..2....#...sw.1..jke...<c../....u..pm.....<..6t..M. 0........q..g..+..(%h...q....|.RDlB...*B.6f..F6T.....#S-...`.....+.6X..>.L&.0S..e'.......p.i......H....Ez{U+x5....:.)...1....Y..Bc..).......Yl....../.f...V"...Y...J//.g..BX..E.t......i.@k..'...q.6u...j....h.y.wc.:.Z.[...\.....N.... A3.V.*K..l$....Ql.j..,.m.Jj..a.Z.>".........fO..t...8..X.[qT..Y$ Fkb.=...2z.m..p..gh..d.....4}`...v%nt6:.9.:.-Nk..{.p-....xg..p.>t.#....T...<4..k.J;;.=U3.....G.&p..<.?.0J..jhP..$...0.,)S............P.}*R...5....`u..I1E.(._.....g..W4$....4y}....?..Ta...\.cy..oLR........$.+XT.M.%..:.AL.....6_.E.*

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.Eakn (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):112129
                                                                                          Entropy (8bit):7.709697389843961
                                                                                          Encrypted:false
                                                                                          SSDEEP:3072:bIUDIVYNhZBIDt9KFHgoYF0gOY0yLEJdUjMcpz:UfAZsVFF0gOjymdYn
                                                                                          MD5:E036392674EDC82FA1AEB503916B6B03
                                                                                          SHA1:AD66D23AB2F4BF547673B163346DAE1DFD451B73
                                                                                          SHA-256:94EA119DB87444DC6B2218ACC3F25E885420EB6BCC195E404123826BFE7C2E6B
                                                                                          SHA-512:78FD59247AD437C136AD920C08C7B14640617110260583CE4A9716A0E19657A1F380D4450AA16B182633DF898FDEB06638919F9C1C69D2E470E30CB0DF27D1C6
                                                                                          Malicious:false
                                                                                          Preview:...MX.r.R>..C.Hy...t.E.+.....t.G.._..V.A..{p:yA....V.8..2....{.trt..T...aw.:...3._.F)..'.4..{PU.....%8..xf_..n.6...#...`h..w:9...}.7g.B..g[.et]x,.....[...<..B5......^.?....<.Wr..........~..2...e.k.W.`..".C{.!..%.|.V..j+..lfv..0....eO......V.....7:.o.!...~U.v.f..:`..Ta..\$A%.....I.......\..DR.c...N7.R......U.r...k....<..lw..~L...........V..9........G[...K`..E.....P\...._&,.IG.:-.r.P....>U...$......G.Cit.40.E......j..i.._.l.6>..|...`..f.W..n...'b......@....y.w. ..74.?..u...Z.QCW.C.,.v.f........v....+.....l7.[...;6.p}^Rf..W...L....9.b..0.O.s.......y....U..q.,.T:.2N.B.T.7T....cy..V....K...O.bX.VJ.z.5..P.kZA".J`.L.G..'.a.>]...~5..5.jNp..Q.Y.V....r.!^U.[...Wi..YF.-.].N..*~."ur..I>......E.<."....V.St..k..r.E.{~c.%....; A.9z....@=%D.*.....E.$..)..C.J..L........}"1....J.MH...Wy.`G.lF.......F......h...7.?*_.s3.%QF...f" ..<..*fy.-.@.g.y.).A..8...kf.h.\*..3..*..0d,'.EiGt.....sh.>...Jl..6..."8.....t...9.&.../6.~.t..../.3]..m..C..a.T@Xn.G....(.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txt.wTgU (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):420
                                                                                          Entropy (8bit):7.444034053483834
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:oeEZIJu8tI+0TYUrBo7+Z+GFqZm+e+MU8EJfBpu/qaL0urHn:oeEZIU8t30TYlqZ+UJ+e1U8afBpuCanH
                                                                                          MD5:C28FDBE1B2365EEE01619DBFFCF04CFD
                                                                                          SHA1:4C4F06ADA00AF719D862F25C39567FEACCF38804
                                                                                          SHA-256:E3545A8645D40D9698F5FD1B93D17BE0C73D026985CC67D27227180BED7D33F0
                                                                                          SHA-512:B72FEE0640F9C28893F133B7FAC1CEE036DEBAEE25FFE4207F7239812E228F04B0FD18490F37474C1B6CB75C2415DFD2BE4060ACB63EF2DB6A4661E1A6443726
                                                                                          Malicious:false
                                                                                          Preview:'...^......Z....y....._.d...TIL.2..@.o".!.N.a 5..dj.`..H...7:..5............R.9#x....[.._.UX..g.E.m..F.Gy.!Y@U.l.F.%.RU.X....xU......W.lN..E.r>:n::|n:y:...(d1..X..T...g......:.....f2..".B^.?g.@KG...lX.f..C..i.MQ......&..!.G.-../... )i.j.....MNH....i.lq.L."F.6...^.9.*...0K.C[.....&G........2..w&..".#I..3P..Mr?.%.a.|.X.....q.......Y_.D..%9pf..e.:..M....v.>..kM..JeKO.;%.E..Y...z.._...].3....B..0.0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json.IqPo (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):2463
                                                                                          Entropy (8bit):7.925439188644138
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:XPEsgUf6+F4KnX92jpjKaKzkyJ2a2fuCgyKM6Qe4nN93Op:/EZ2ztCjKTJ2tfuCnKrQbnNBOp
                                                                                          MD5:9D2CA6BDAE81A6A38E1CCEB3A92665FB
                                                                                          SHA1:6F1099A69E45E76B6D424FF829601D8ADA3CA4F6
                                                                                          SHA-256:5C31714AD63B322939230E5C6F691B152CB584B2ECC43B339E4AEFE76E58DEBA
                                                                                          SHA-512:379015C442816C91B123D7DABAE5C83FD28BBBBCEB55A851F5523081ECF6670A4F58BF7F7D350662FBFAA23AC56228CAA416B0DF8D800D315593B4C8F786577D
                                                                                          Malicious:false
                                                                                          Preview:..1.........f...#Y...D....k.a...daKXn@..+._.-%u.......C.v....../.....#..J.......h.\.r...i...eU..1...o_b.+.M..M..M ..DU&[.4S.MF..2......t.}.!.~...q.:VEYP.$k..mK.l.g.E...1...O..?..K..Z..[....8.+...$.....ob.<.../F.A.5.(.^_U.F.AD.I..G...c..!..O..P..<1........"..,.4-...j.iIv.<..S]on.v.f.....K+.........mZ....".....4?.").DQ.[:].A.a...?.....hy...6k*..*jA..!8....~...U......!t_\.;P>. ...?.c..Z...$5~.....d..vmAU.s?.......Q....\...(?..".ji.!..X..D1R#.M....{.l.g`=.)z.%C..i........+.......d.........WD...w|.v...F.....8K...m...k....<jm}....<5....ih.\...}..6M..{..6.....P.C..T...r..g)...@.O.....o..\.P...A.x..B...'CB...........C..{....n0^..jR......T.TB.e....?..L.<...+.{;5.5...>,U...U......I66.9....c...u.....A%xw>_N.N.n5../..NtM.A.`1......U...^..^.......]...#ky.%fLj .IF..%...2.|."......P...dO+. ..'q..Xw.....V?.G....h....&\~..........%..9.,<f.\.D.....C. B.]...^B.e.GZM|.o@....Y.....7..lR. ...(@...T.....0m.o..gx=.j...o.t.#Z.....qdB.>.?..j....2_.....8..K.xf...9.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt.oayf (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):797
                                                                                          Entropy (8bit):7.776620386693687
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:MnaDvxP3XtjARn8b0yUoMvs0uLX9f441Hn2Re/zWTm7dols8+JoOLhUn:MkZ39jAx8wyUonTHEm7+u8+h1U
                                                                                          MD5:F01635EE2AB8E3C7D57A53C097424A8E
                                                                                          SHA1:AB3E137C2983FCE5AFBA0D2F9B6CC8A5024DBC7F
                                                                                          SHA-256:85FE2C1D7BB9BD1503ED745C925A64FF67C47FDD1367758EF323124A4F73F018
                                                                                          SHA-512:C3B448CE9483CAC8F1386B49D96F54629D6F30D1DBAD353CB68D35BF80935D9DA62E09124562506DFC098B50A04CECA9A8F27BB082BC7E6412D6F2D23DC7A44D
                                                                                          Malicious:false
                                                                                          Preview:.$._.-.1.h....d.<.mR>D..Fe..<.Y0-F#p^c.\S/..s....[]...U{..I.!.?.8gT....f...".j.v[U.4B....<H...`e.6..p+..t.cV:M~}w.F.....c6.N..@.;A.]3:.l?.."..h.7..#..n..@.T.^...I....H .%.Z!...{..4^(.......;.aj......KZ..r..]...6..+d.a0&D........~gSm....Bq....3PsK>Ql...Tr..b........A...e...=.vq,`X.........w....J..|2o..B.I...s.F..6.3:.4`>7..8y...6..)b.V........)..L-.-JL...1...b.]......m.:.E@`...qZ.....8F.......d...x...Q.P.'..)_l."U@.L...@.K6BT.../.d.........fxM...>...o....2.9..?Me.D..$#...z...HKx...`.u6....EOYzu<.M.!Z....T,0.2.....%..TN.O.4...4..04k.....*.(./.O.H..|..o.....x...=...../....O...e.`.Tn..`...*.y.....Y....",ntwUw....mn....m...2..6.a.;...dV..BQ#.D....Nt.?.I.g.D.'.........{..'.m7..&....u(.L.w...5....;.&9=.....%=y..+........z;Tn..F.$..N..W.v..m..S.oQ.q..[h..|u0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4.VipG (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):5688
                                                                                          Entropy (8bit):7.845811389377249
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:xwk6EyQkqbm1bgugkKga+CAwjKRNjaPlgDbk02PejFgZsVqo1/qTMgnBh:Wk6EVKhnXCAw+mgU03FnVq7TMwn
                                                                                          MD5:C0DB4695401468817D840E7D26BE382A
                                                                                          SHA1:2BC10B568BA07978033C6C5880048C7CAB9ABF8F
                                                                                          SHA-256:3AF2407FE6076D7154B972E0C0412AC200A0253BCACF5A397FC8AAFEFA057412
                                                                                          SHA-512:DA26AAED4655BE347455331FD7B5F0FF1BD62BF613501787928F13CFC15240157FE361E6CDEDF5DB0363D63783D0A4C8048E9E9392C46B4D9D3C8D726EC3CDB1
                                                                                          Malicious:false
                                                                                          Preview:.L...T.L|{P.tNo...c.9m..AR...<..4..l.#A.D5.M.....B..B.F.XB.....j.=....J.#......$.._..^........p.F.......(..4=C.j.B...4..*d...2..6...v.C....i]W..)X..U.........d...B.,...?......C....}o=.iI.S..)zP.....7.G$.y1I|.A......u._T|.wE.j...%...D....t.U.d.g."X.rO...(.....+>7.d.jA.s...u>.?...x..e.fz3..(..x...egE.'Y...&_..jR8M.P.......G.i...Y..F.=..)Z.... Z..J...1.....&..:....G>.{......42J.~....eP.$?....ebs.f.....e....|.e..b...h...;.....K...a..I*......MT.[.*.6.].Z...&.|g...5.(.e.6.:.a...F.P:l...=T....,.......&.:u.@........q.V..a.X..S.~.....BR8...rpSX.....$.$p..&y...h.....sl...$}..\i.......q..dI"h=..!c.Q..>.1..z...bd.h6..\..fW(. ..;$...H.A..f^......x.M...#......@.....X.l.x....r*.<...f.X.:6..X...YD...^L.....]....a.6......=.6./..u.a..=E....uA..b.].1.x.... .4G.;.].b.!ia.fn^...A...;.b.J.5A.Uo..+($QI..T....r..kc.[..;A....y..K..[.3!...Ht.VSB.....vH....[-.h.d[..5.`..<V&Oh(.......4.v.F.w.P..~...B ...g..q...Dj..p..=....y.....t:y...j......d+HE...0..'...

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json.OdCf (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):290
                                                                                          Entropy (8bit):7.179249317694012
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:jrp3QTKYm8UslrIGX4iLqNOh6HhqRIrmHXX8oJjaetkTQi3WHDTqkrDH+6b6Q3eM:jSGh8Us/4iq4hgMIEaeeT33gpDLSLYzn
                                                                                          MD5:2C51466A38819C7B5E9B8DCA8E331481
                                                                                          SHA1:93E98FB7718C8C795752B6A079ED6E893FCA7165
                                                                                          SHA-256:CF4CA82A82635868FFDBD60E133033B10A02264C3E50A6F590C6DDA3162F70C3
                                                                                          SHA-512:CCA3D13A57FD325DA77DE3D84DA9BB6861835E6B06A81A181081CE5F6D17D331244B80DFA43E7FC2ABD01941D22ACC9675135B76B726C11F2E4239F8D480D431
                                                                                          Malicious:false
                                                                                          Preview:OBr..w....u.ons":[]}J.j......3...n*._.n...'.DN-.,.=*&K.....3.g7e...si.J.|.X....v.?_"\:.n.>..}T...r~`>....8.$."+.)Fd.uo0..". Qf^.....>^D.#I.,%.VI./....H....M-Hu..K.F.Du..!i..V.....W>(......q.....q.....SP......0..>.m..T....j.T\..$......._.R.]..:+..\....HqDa....}....40xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db.aTqz (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):229642
                                                                                          Entropy (8bit):0.8761605108359117
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:nBpEEAqCYS58p1zkVmvQhyn+Zoz67dNlIMMz333JGN8j/LKXYj5ku8:jEWDpUUMXCyIg
                                                                                          MD5:FA1DFF7759FD57A862BBFEBA29ADDB2E
                                                                                          SHA1:C19CCBE797A5B1DBFA2BE4804F387362AD52DD27
                                                                                          SHA-256:764BFBBBC1BB5B07BC7F0083F6E5A1F8149C6C894F8A5F1F909974797440B59D
                                                                                          SHA-512:16C0E940E351643DC801003AA9F7087980DA40237472BA91DBAFBFC694C182AB35A192B5C6444E9020B0D8D0DD5614A5F570EACAD17968E58A9C9F1B914D88B1
                                                                                          Malicious:false
                                                                                          Preview:.6.bX.-]..Nq....j5x.k<.q.x...t.E....(zzE.J|'[ ^.D.0...[}...J8..i.~7.X.Jb....(.i.|.........l-.(......V...p{#."...y..(.W.\C.].Vf....^...QH.Qy.?s...39.Y.N.,.G...\....[..h..J..m.JD.+/<JT.=.....N9iJ..iB.]....#O.^.!.N.R..j...8..1.Lt..&).j.{&>@.x..~.j...33...@3...?..^....*t....E........5S..9...Z..\'..]..y...",...."w..........i........Z.%..np.......Y0^..bW....WL.`.4=U.>..s.....0L'.W;<....&\.!.V....."..-tW..R..NJK.\..w0L.p.8P..v4.....4..:...8A.%.)=.../...U.k.h..f5..qG...\.`-.i>e...d..iq.T...!Z.....x..<......v.....K.. .X......2..%...,.......y....r..$_d.....6.F'MM(4.\K.(...~T....P...~..'....W.8..X(._Bs.W....9.&Q'.`.".`2l@.B.....[O....45.....(%......j..P...07C.O...e.)...P.....UvW(...W.F"...Kb.}..U.."J.j.......v......E$nqh..s..=[.*:.#l.$.}m5...$..U.........%>....^....Iu..z...7..\..o..F ..Kp.._N......X..fD.....H.v.Y.>.Bn...-.{6$.[..C..Z...o......3d.*.6.;8fl@#S.r*..?]<d..t.E'..p.-Q..[4....b.~....s....W.......9.AQ.....F|9..b.a`l...l.....S

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini.DOZl (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):466
                                                                                          Entropy (8bit):7.4755284882980515
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:RbYIogoovNi5+QYPNw5cjETW54U7xEUZDxIqq/OHn:8gD8GmCmU4USnqq/OH
                                                                                          MD5:F4FBD04CE6C27D2EC75EDD7F398C4D1E
                                                                                          SHA1:8717D672B09F110DDFB306AEFCB3BD441EEDF941
                                                                                          SHA-256:88399CFD8FE11CCD2366390BB7A411024BDE27D36F866AA64C491B6B5C854575
                                                                                          SHA-512:7D13A1FC08FF6FEC3A19D685A8733506D7DE52EC8D3825F1BC787486F932894D8E87D65712A5B3DF82ABA5454B3032FE365E5E60DAFD34CA0F68D1EA583BB745
                                                                                          Malicious:false
                                                                                          Preview:.E{...t`...EP.....q......2m..L..`....<.P0.g.l..J..=0f3yAJ.._....`.t..b....t.C.x..D.K...Ui..k.N....odcs..X.......c7.V.X.=........_.4.'..ZJ.R..41.P.....8..a*!....5H.../....z..^\.Bg.....rowser..Cd.+...n..$.B.D........]Z.....{.a.M_........0....yy...i(gb.g.U..d..P.&......H9c5..8.&...o..:I9x.B...,i.{..C.......,.K..nuX.z|...D.|.j.r.....k.\.{g.2s.o.8..BZ.l....F...w|.Vl....]A.yM....@%...q..........JT..3E..9..w..2u..oK..A.A.2q.?..i&...........B...$30xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.json.GFSC (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1141
                                                                                          Entropy (8bit):7.810862086856516
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:RqTXWwsUxOwIBuxaxqt6holDQzUvR5VVtSXCnBDxzJiok0v1Tvf:wTGwr0xHhoizUvRXVtSXsJJiok0NTvf
                                                                                          MD5:F961E94C216333CCDE530737908C94C7
                                                                                          SHA1:FD81010D7AA7C1CB9D56741F3D92A0332A2AC957
                                                                                          SHA-256:1A03EA1B4AC7A83B6B8D496646528E72DACEC093BB412B2D2274C7504A335785
                                                                                          SHA-512:76728722F2677C845FCCE91D1D61C52E1D404CFD26320FBCC6C137B168987F21FF8BC4FED64D8F9CEE2D299E22B1CEC04C23452308506DC6884C6F0C1B74E78C
                                                                                          Malicious:false
                                                                                          Preview:..f(....p"...s.R......".@O...L...6.'..a..J....T..W..:Y...hG6..w...:.U..g.........1..Z.s=h8.f..6.E.zS..~..QX...d.z............O.Yw.#9.qJ........'1..:H8.y....C*.q..e.2...Eq...p.L.z.w..;nN...O.Y.]c....Q.x.kb...............TX.8..........A..B. ..a.Y.w.hZ...X.@qd.F.....tD......o...B...........<a.90..x.........9.3.......K..*.o.ha..(5x\...\.~(W@..6. .V.h..I.g..n.......p..!.....sd.[....H....}i1.*.).^...%......8H..*M...0&Z..*.-O9...,.-C..v.A.-^.]~7..lO.`.|....-~.....~[.[.w.@X...r......>..ZJ.DC.%|a'...+..]A.K.fk.......ic.k.....7.j.`.Oa_..7E...8E[..mO.!..r.....=.U4.o.>...0t<.?../i]..KD...f.n?...6l...FK.r....#{.s.iO.Vc.".....4.X]....3'..|.8/....z2..j..h."...X..-..Np".J}..b...,..!..9].eh^."<....w5.....||.y..J.......Sm..w._.!..m.l,Aj.W.l..64.B..).11.V....]s...7..z.....,S.Ai.nW.CX.......B.D.).@[ICZ..>.6.l......c..;;........hsKey":""}]}:x...X.v3G.0.X>.|.).s...FE.@..........@....Jg....>.In...CnH.[..`$.2...'..f.F......;[....9.8Y.8t.x"|PJ...........M...!/jV

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite.fTwL (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):262410
                                                                                          Entropy (8bit):0.2940889267237937
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:1ERy4M1fm8TcYg1CibDYuZoLNIyLOiShPnKy7bJyJZbaNkiledtMgl+mt4:WRkmnYg1TbcuZcNIyLPwKkKZbMNlITNq
                                                                                          MD5:9589E3317B206C0B97669A225A28325F
                                                                                          SHA1:11EBA4B5DBC63745D99C83F9D0F249FFBE3211C6
                                                                                          SHA-256:7313CBA8700228ACAD40D4EF2A675774100E48DDC189343FECBC47B5386BADF0
                                                                                          SHA-512:D2AC04547D39F4B404D7B9DD4B1B1E7ADEBE6F6D8E67418EA616A2E1C8376FF5F015EEF24C6D828B0200E39A606AE5E6C2137B92BB53A08B54094AFB4735A924
                                                                                          Malicious:false
                                                                                          Preview:-G.............>.k..^.Q....'R.z.......g{...#..d....83..s.:1uM.b..9.x.:.....<5.z.....k.Z9L...lR.N/......hs}.S...#?B.HF...m.G.k..2qC{......:..D.<.......2Z.k.5C.]..zv..3..g.$.....M..Lt.....Z`..&....a|{....?t.Z..I...}[..R...Cw... #......6......o.e.5....k...7km(....).....QK..9..?.?!.w.....#..W.P.}..........N..&y....^K%.s.a.R.s..[....K.'g..|....B..1J..,.t......L.....u.I...c+.`..gX.5.F1...E.VGp....&.W.M.`.$*....2.>.B.2..l.H...m$].x..|..{Z...K...c.7t..68.oY0w.2...z.>....eN.)...[.RF5.. .y,5...S^.~.BL,..-..@^....}DW...U.c.F..y...H._.-..W.;x@.m>^^)....L.H.Y..Y....-..6-o../2...J<W..q.\.b.eG.,.6......nj(._z....k!6l...I,...pW..8.y:..S..X.....f".g....."....u..h...3.tZv.....5;....+.p..{.z.....2..*z.....F&6.I.T......?.3.I.8.w\.(..>.*......."..SC...8..s..L..."..rNU.p...../.q..g.<[..s.).w..n.L..H.cWm^..0......1.b.....n=..........U..}.!.b2.a....d.....J..L..7N!.....#zo!:r.Zm...q...f~.L;....]..4.9...t.#j..&8N.........!E..h........w1.....'...C.F.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm.eKSo (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.6111615567059316
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:D9nXOpkQtxBX3b9onFqLAJKHS77gUlofNJq6UkxStYXN:tNQ9nqkSvl0NAkX
                                                                                          MD5:E8147227479D44CCD36E1E6D44A11750
                                                                                          SHA1:C5424788CF13A9EBF7B99A67A3E8654EE7A9DEED
                                                                                          SHA-256:F636D2189130B6DA43DC965FDC04DBDFFC9882C33F07E1FBE342D0F6768D67B4
                                                                                          SHA-512:7A9210A9592D4B3A551AF06F7E17F5B7651F9AD286859F3D4D2DC4C47701D8BB2C921B71E3BB51F2FE00483E73B280BF8A8C01AF03D1F7DF090A54A78CB40A3C
                                                                                          Malicious:false
                                                                                          Preview:..2...,..I...a..{QA'..........d..n.6.l..n..D...vj2.....$.`.<."..$...3.G.>i?=...dt8...P.T..H..4.<u3.)..q...gs9E&.1..V...J.l..Ks.g...TX8L@OstI.&.\..([..i@T8.[.l..h=......%....=G...........x.F3.8.........N.h..B.;;b.....j....A2.O..[..i=R.>.....DX..{[L..r&.?.b...a2k..d1.C......,(.{w.....j.N.a.}V.k&..{G.1.....e.....c...F2.!..G.k...lD.EV7+......H.4..B...zpw.'z..(...(...VU..u...Hk.u.....5..=.lh.."[.B[*[r...yn..}.L.D........6=...............x7...'..I....]....7.u?<...}..@'.$J.b@.=....4..9./h....y.N.knH.~.{Z..J.....sc3')c.w.)[.....}.p......6.h....g..=o^`.-p.E.$.x.f. ....|.b%7.Dg>kw.*@.[E.1Z....1...HM...J.[).-MJ.....|\7...U.>...[.W'......8...W.,..............v......H...8.L|.(}..[.......`?...8......l]j........<$b.m.OqQ......./..L....#X...O.pm....$l.!q.G...Ns.2. ...l.?xaOq.9...t............e. =...._;.a.\.c.........+..*..1H.(+b..<)j..`..Rm.E.....j....a..T...!.`...|...g..P.y~.7......}MM...uo....&..[....z....?e......R.~;..Z....7.Ga....2.w.........M..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite.WkfD (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):98570
                                                                                          Entropy (8bit):0.6745607484462334
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:E2WcZUe2rQOBd5/zUdbAgW88kXvvyuP83xGdTs:FWje2DdlzUdbAgW88kX3yq83xGm
                                                                                          MD5:AC1D5E0D02B31ED6107A05BEC870A3A7
                                                                                          SHA1:E4D232672BA28085FF544366910320CD7AD952B2
                                                                                          SHA-256:EC099BAF0B929AB6B8D022AB2BB15DBA2879A8092A7F4258838D25988838188F
                                                                                          SHA-512:37B9A8DBAACF4ADE6BC822851697D012682467B9469AB308AE52AF80A15CF7DE93078684B518C9F3F302BF933A29F725B2B20DCEBF8CE34C275AEBB07DAEBCA2
                                                                                          Malicious:false
                                                                                          Preview:..Y...]..e@:._.....E"...)...3k......F5y%.C.S.E1....|..zn.h.,....f.L.K....'.kY...^:.Vq.b....Y....y.....Bo.P...].g(A..A...+G....6.Dk^..).8_...].UK.|.#...Y<~Go~..~H..V ....+..."nDe...-.j..}..U>/..j...G......#Y%.:..L.T]'.].\.z....M\563....=....N....3.^U.Z..BF..)..=../.,......3Z;%...^.e%#+..].8.G.=....9k.,i.ko..?..41..L...5.W....p.....-.%.k.rc_".pp.k.Rd.C..FO-...#..9.c..-,...+...5..8...k..r6...F_db.p..^.n....T....OB..!.j8.......t.....\ym&.....x.G9...!..RN..Y.E..Q.J5.....k....v~.b.P.F.(...3.u\p>.P..j..i..!].J.]b.....h.b.-... .m....Z....s=.1$.@PM.k.[...{>....%...c......6s..g...z].S.8.:.R0..7.$......sY=..2..........4...[._.N..t.....V.}~.CI.5.aw..r.&k.q.)..6[......D.5.....#.%.".!..JZ__r..H.2W.p......V.S_d.>\..|......u[.@u.18.....*......\b.&4.W.4..~54be...:..Oi.'..5.U..._.........#..E.#.".x.Y..l...^.f.qS1.B.......s...q.g....A.....<...[..l..]pT......m...`....i.77(..#.-..sq..R....M....w..R.<....:..i.....|....z.8W.....xq..t...N,l..>..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829702.cde8135c-88c3-4c34-8670-7ef017742548.new-profile.jsonlz4.OBFj (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):4048
                                                                                          Entropy (8bit):7.9543294433458165
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:v4gdtxcC4d69de447DA6iHT+3sgxfQrFBqgIhBa4fodVuMSfUy:gBCsiv4/A+Rf02gIvqVRSX
                                                                                          MD5:868494E79CEAD6816FA8E52E0A6129C9
                                                                                          SHA1:C13FFBA21F089BD7172937F7E0D46E1BF5DFCCCE
                                                                                          SHA-256:69D354B017F8AEEF1060297D0F87D61A15FC37B6086B928364E3B3E94B0E0911
                                                                                          SHA-512:3456A31E5831A12BF185258150BE4AC7926B9700193E4C4ECAC0E8E96178B9F3CAA19E09F921D0049DEF6DCCC33237177A575ED0380275CBD9E1DBB6ACE6F270
                                                                                          Malicious:false
                                                                                          Preview:.......0m....3. l.h..P.I!.\.n....']... ...V..J.$.M.*>_>xFj..<.%3.sP..s...).o......fY..P|_.>........S........XGOC.[."....=1.@..-......4..&.u5.....L..C.d.....9.>...5..4...H ..^....).B2.Q.jI..._~S.......L#..Z....D.K...%.~ /;;_x..al.|..71x%A.......!...z...u....O). .7l.....=...y.(...h..Y.x..t....WK..uw.D.8wK&.".....bIs..l/.m."c...U...+q\"&E....m........I.l.Klt+....A..L>......a.;O..v....BR.D.[...>.<g..s.I`~^... ......~..^M..xN%.iu.xM...e.I%z..O.D.d..(e.$....Y.L.V.......~.B...s..rj.(AA.........x..Y..8;.0.#m..2K.h .z.....>...G..}~.n....].....5.......F v...C.....j.N\..pO|.D.'..w..Z'.o..\........Lh..?....NK....F...xvc}..6.)...!.1....H..x.-'...h.9..,..V..y.....0.8../Yd....d".-..Xid#...G.{gM....8.....R...@.E..N...^....R..e...W.....M.?..C..yCM.7..K..l( .A..8.MG...X..... .."p.O.D.v..[e.7......A(9X.%.A.t..{v.vt.}k".?H{...]...*.7...\.?....Ad.../hh.N...M8..Iey.u.A>.7........J...s/..7.a....z.....i.....l..G....t.@y...\9'..}.3A.v..0...Gz?.u..E...@.l..2...z...R.d

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829737.9f7a5e7a-2be0-4ff7-b132-b1f6e59a8e58.event.jsonlz4.iaKS (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Public Key
                                                                                          Category:dropped
                                                                                          Size (bytes):4409
                                                                                          Entropy (8bit):7.959246349606485
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:TvkSVNgl/jU0DOtdfm7A5vA35G+/PuKrmUxxSlbeF5YFokg:Tvv/glbgf4svAc4Ph9xS5O5cov
                                                                                          MD5:F9F2138342EDB6DB45DC4D3F1758A527
                                                                                          SHA1:A391BD6588A149DA9E0B44224588E6DB20C01894
                                                                                          SHA-256:11D930F1C2C565C2909DD9D7AB277DFF1428B716398C1137D2ED7CBDD655C27E
                                                                                          SHA-512:A4771B34C29EA4FBA12FFFF1214D48FE9AEA509E62B8C0786962A2ADA2CA1334B0B80FD4358B67100EF3DA22902C5C99C98151500C9AD80034B5625FAF0A08D6
                                                                                          Malicious:false
                                                                                          Preview:...P...Hl+g.:.0z..&.X.Dh.?....J..R.$meY9..t*Y...Wpeg..N<.....5.....=.#/...xs.....b.%p...l.L..^P...*C.m&..f._.cY..Q ..T../K....V........m[..b..1-nw.5:.M..|..b....k..x...;EV..0:Oda.L..<..u...l7..^..)..M....BG......!t.B..,....)>0.@0.......+.$F..'+.T.B.`G.d...U.S.0.R`7...Mb..oS..u.....c.p%.2^Nbc........geD.6.z.o_r...lM...N......M..~....*>F.a.!.q..2,.....D..N..).Qc.7..V.M........z.......p.h..*...J|..+Sj ;..."....^..pn!''...42...XU...m...1....<.".w...j.0.D...F.....i.'hH.z..D.._E."..R....g.s..{6.|}...=.".zf..wVlYl..t..1.{.lq.......B.(P.F{.b..j.....u..9...&.h{Z....y.E..i..K`...*v........oy..5_...].....^......KiA8^P.N:o.../3....i..,.....p.a....T.....zzNz.u...Y...Nh...w...R.n..^M.V.o.f.Yk.3..I. '..L/.).1..93s..7J..y.Hw.......U9..i...c'.W.q....U.. ...............(..c..*.....e.....]C."> .,"p........='^=.WZ..;.....Y.D...7.Q...$..N....w.....d[../(1...3..iy.3J&...an..(..$.x.Q......PQU'.q.#.G.}I.1.=....zL....Wl..iq8[..:n.........|....S.kdf..a

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829744.7278f154-e8f4-4235-84c5-c5c1c6af0084.main.jsonlz4.dMlx (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):18552
                                                                                          Entropy (8bit):7.416402294775717
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:KpPuG3kyc4Bg3+FlVB+hgMNMjJ1+qVKrvq6zOflExQyOsfbuylC+7BA5yJ/:0P7k4euFDdM2jJ1+MQvq7flExQybb1lN
                                                                                          MD5:0165FDB94D31A0585E86CFCEC2E9FA03
                                                                                          SHA1:840AB3576411867801178CE90A58758ADF03B461
                                                                                          SHA-256:F7F22D141CF609D8FFAE3B58481746D7D25EB7F104624FD2D3FBAD0D91D770C5
                                                                                          SHA-512:E275C38622F955096B7A4B77BB0DF65595DB3FFBD03F30F3405AD355C4F6510CC68BCA25C3918958835807DD649B48B8485EF60DC4560F5AF0FB58D4C3AF0A3E
                                                                                          Malicious:false
                                                                                          Preview:...`..t=....>y...A.%..[......'...8.......1.6.....W.4Y..s...=.@J. q.HX..y..e]..uz..h...........`f...v.E..V/'..~.)@.@.Ka.1=....[B........W.........p.....&...!....T..ID.^1\.....$m.h..E.....)J..S TU..0....Qc...y6r{.\..z.....Ws..../.n^.M.S)......}u.....q....!.!.\R6.x...tf.?...%...p.(5..W.{c.R......iS.F..E...y...5B.D...Zc.>..GI3...83.......Tuu...?n{..F8..z....^Vg.N........gz4%}....~U&............EgHx.+.......,.#o.qL.p..#\.wl..R......(>.k_.....3bqQdu.K...]J.....gv}..N.3..u>............ .F....[..a.:.&..D...:.<._.s...7......z^a..._`.c.G.s....X.u(Y. zp..x..`.k|S...&S&.^84.O.....a.Jb..Rl.!.7......*.c..fX../w.u.....N5i....B..sS.}E8.9X....e....n..#......`./At<.Go}I..#.......j*e....R....+...i.....3....6.Zb..P.z..@b.UP.. t.5....7J.{v."..c..^...7.WyC.HjI_=..t".^.`k...C. ..Ih...uF/^.d../....:Hh...... ...........&.&...>...B.......#...`...]TY.....'.....m4..g%...$...in..#aiH.R5...<Z.it?}.......`.N.2>C..e...(....B..(..Xu.d.M...x...u.....$r5.......k..|}. ..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829746.67aa4432-87f8-463e-b422-f6679add9971.first-shutdown.jsonlz4.rFfg (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):18551
                                                                                          Entropy (8bit):7.424270951790328
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:XkEIz9zET4f4LSVB+hgccMjJ1u0WKwvW6zOflESQyOsfbnDlo+7BA5yW:UJYTmdcDjJ1ubXvW7flESQybbDlTyyW
                                                                                          MD5:0B0A63CE776ACE3B6A0FAA66CA4E3188
                                                                                          SHA1:650281B06429BFBC502B4F5A4EFD2F6605CB7EF0
                                                                                          SHA-256:C13931DA0BB088F6BC4B38CBE0727E017F6E787CA70BC5C89961BAEA5B9106F5
                                                                                          SHA-512:F6F11AFCC4D4B824AFAA25691D34B05B6FD480B1A86347A9D749398CE32695DE231208643F56DA87E8902994F7DD6DA4A67480E5A05D8B82B08960EFCBB7E76E
                                                                                          Malicious:false
                                                                                          Preview:,.8w..6....S....y....|k.G..5(.&.:.u9n...E..mW.`.C..;..l.*te..[e.v..C....h..:.#...v:n./x...**m..:.O.....Sq.....b%..M~U.sH.i..@yA.C.-..v....S:.....u.0.V..myzM.>G4...sUf.".6..`C..{X+.U.x.kq..I.Ct..{.&O.5....0.g..;.C.-.ww.w.2No$......]...{.:.......~....{.E...]E...j..v...n.........Xj&~.X(.8..I:.q.<`.{.....}.3...MV.y.g...7....a{...?.<V.t~....}2.M.....?.b...(...\.^G.e..'.....g.Ro..$.:......XDt.u....+.J....p...~.....w..p..o..@l.r s..].m.c..%m.\...y_....;.+..].E0...1.....D.n.........4.!>..`.h\`7.%3.@s..........iu5.G.N.{.|..Q..pr9a.E..Q.}.t...,N.?..{..................k...q..F..L..T..+.m<..c..3..J.C....<.:.=..9xS..A.m=.y.I..&.8..R........E.B..(..X.....rf?.1.B.MV..?.c.."..=`.3q.<!.+....^.."a.*.L.mG.=8(\x.#6M...J.5X..."..kd.J.a..f1.y.%T...#...mh..;...;..Y;.~4..k.i.TZr.....q..b}&."~d..t%..'R...p.....Is.......*k(z..D....h.2L..t.y...to..>R...9'....[.,...s...K..I......KY.S/+...<&.n..s..3.>.9.G..0..6;s.|.+=..14..J{%.f..}..V..:....~..\.@.a?.(z*..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834580.6fc53411-ad83-4cf6-a5f6-905f0f3f52e8.health.jsonlz4.KdMq (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):709
                                                                                          Entropy (8bit):7.675084429622878
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:KoE8N3Oetxb8wvgSAZDuQiMTfsiuAqiqPHMeg3Nw3k/6hzdCLo1HbcYuTsOTSn:KD8N3Oexb8j1dsi0HMQK411HwYuTne
                                                                                          MD5:612ECE8EB214F799CACC995C7A1D9CE7
                                                                                          SHA1:5BC0194CC437133C24AC7FD87524F0AECCDEE2BA
                                                                                          SHA-256:31132DFA0DAE6D6A1A1AC83958AB770EBB5AACDE6B8BF9EDC7CB2FDA3A517205
                                                                                          SHA-512:512236057464CA75D89000480D40B61F5A2AC8B2CBDA72162616B69784B0628CF200E2F482406280C80E5B2DC4C92836399F2FBCCA341036A37EC56A3DB36F8B
                                                                                          Malicious:false
                                                                                          Preview:.......f0.....W...I....c..v...........&...XRc..{.u..a..%F.....i.5.........8k.74....8.....s........'..SJ'u..r*..hN.&P~..B.D..u.......d..B.f<.."xmVc"8.A..1.!...|...Z..^.j.mQ.P....Z......Ck.X..1.....1.P..WT..z.B....8...ed...w......N.5.rL]..@z.....b...TG.ze(N......-.........IX....gv.B..g.....h..'.".k.+.........hp..fo.9p`.uT...+.R.N..R......l.F.!.0.....H<A....Y.H.y..l..X......||.~.K..7jX@.G..l.5....h.\..9...4350de32c"}.D.E"y.6U.&G<.)..79uF..z..E..../P......p..|N.P.1..l....t...c....&....i.vO.`...'.-d......A.#....!a0..!..o.#-0.....W~B.yi...Tf.N.T..}]U6.........h......V.c@.]...J.....b.9N...o...4.GO..........m6`..5..e...+`q.]B*e......3.g..s\..........I..:B..!!c@Z0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834606.011115ff-9301-40fc-805e-ba07b7fdfce4.event.jsonlz4.GfTs (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):4413
                                                                                          Entropy (8bit):7.956952669969587
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:/m1Gag8zOERjtw40YVajL8zE1dkVAZmXumJ:/m1tg8RRxw40gE1dZguU
                                                                                          MD5:4A7D0A1F3727735ED7FA546105A54B62
                                                                                          SHA1:C570432D5484B5F534B1B2552DFFC84A94C0115E
                                                                                          SHA-256:77BEA2AA9596B7FEB4221632ADFD61981527A22612A2C56471F4C85DBD3E3653
                                                                                          SHA-512:3820BFA551AD8DBFEB4F8AA980C196802D87C12AD823FDB2375DEB84E0A7762CECF03BB6006D21BC02E01D042C0306051BBBA7D285C9027568123694853BC8AC
                                                                                          Malicious:false
                                                                                          Preview:,G......C.:..\s.y..ISU. ...w.J..w...k|.s.....Ln.-....PKTz....#.^....R...8y....b.......Y....,...v....e..w.U..fZ.D..H.e....$....&]..]N........B.....3-....<K1l(.T...}..`....l..o..}..r.w?..B.>...Y.`...#....STU ].wa.q......\...........-K%..@)...m..s.|0......@yr..I.....[7..*..X..7.%.2~$....2.|.....p)........E.X.3...w..+.l2..*....Y\..(ua.p..X.d...Wz..Z0.....C.;[*~.w......f..M.oZ.."X....v.Isx.++..N`...K...."....8...?..Wz.q...$.!..!..L...Y.&..9\...L..Z..B.[.....6r......,N......E?....^,H...."...5(6^.".R.PO.H.r.&`..[.... .'.1f..dA..j.......;|.......E..DN.j..x~.W:...DK=`.V.1.WGO.9.aT..G.mG<.$.4*T.d......=.h.E.....~.Q.........2.`......}....7...0r.!Y.`l....Z.q.!....#/.B..`[.TI:O/..........]..RTA.".....I.h.9^;9.f..iGw.....J9...p?.5E......1.DD<..Y....g..){E.m..U......DQx.....".D.....Z..&.f.....=..<s........yG..p....|._...k.<y...?C...;.2...~}K.......+N....4....%.5^.."..=.A..|kW.q.......\L.]....\..........q.\u.a...~..3..f0.9V....o

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834608.65054280-9d54-477d-a3ea-afcb1f88e001.health.jsonlz4.OxdH (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):708
                                                                                          Entropy (8bit):7.7363371970247385
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:IA+FTvtHxez12fW/hKCz6+PD8Du2juizZgToHjMqIJ9DU0XSe44betVSFae55OSc:Z+FTvNxY76+w6iz+IQJ97L3ezSFa2OSc
                                                                                          MD5:AE55D222179289D03AEA0090FD46C00A
                                                                                          SHA1:4CD0B15661C90952DD0E2F093C6921271AC630C7
                                                                                          SHA-256:6418B217C5C090A735E63747E26B7009536A29F78143CB75D84C1247122DA15A
                                                                                          SHA-512:95C08A3D481F72E9D587AF44631EE0A0F8BB6251DBA977CAD45C5C6FE3DA49F63EB0254BD5064C2E6883D433B17EF2BEEF4E00F303D014F5553AF076AD9B18C3
                                                                                          Malicious:false
                                                                                          Preview:...Rq...}.|..Rh.r.y......I....scmU.L.r.+.7.Y........M.h4>.=..{g../?....EA;z.p....J|.5I....*...U1/....L.\...6..4...9....E..jg.j.....b..\..~$..}...s....r.C..bq..t....C.....G..B.Td0i..k Z.....S).$......A...@_....r?0..Lr...t#.L...J....<...W.K."..nf.1.Y(G....p.QV4..v!W...XR.........+\+.x\......I.0..n...plg5.' G.<t..7...s7j..].:.}.h.&8.....K.o!"....h.s.s.E.-...RT....H..y.R.."H....?..m. U..._..w.....{&.\...n..YD.f.350de32c"}..Q..7.C...a.....0..zbA~v..J...3.".1..p...$.2.......a.4.....k...k.G.v.].E7..2...`UV...#........O.q..w..Re..|H..Hv..#.Q.6.!...U7.f.nd....HT.FI?w...t..fz@u..j._...nP#.S...W.$yZ#..}N....._....t].....n.&...T....{....Z.fu..`.M....~-.....{.9.2.,S0w.0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834620.c7889da7-33f0-4599-8452-58d47c58437b.main.jsonlz4.oBKH (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):15341
                                                                                          Entropy (8bit):7.380828708901953
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:Faejy9rebWb7H9IVLJl6XZGPkA6K7fNfmfbiqSD6W:FbjyNb3W1Nm+D6W
                                                                                          MD5:869CCE6DFDCAE3C7BEDFE59E5A92EB1A
                                                                                          SHA1:9044438F56B7E8947D26C7407A718FE4A2E27E0F
                                                                                          SHA-256:300681135291E579472A1339E5C67DAA50DBEE345F081FB2F08483F2AB2FF3CF
                                                                                          SHA-512:E031D5602D6D0859FE8F2689FC7AC0BEA41898E6E20E6D12CABAB7E19F91E56D8BAEF19865FDC6F73F1D625D244B957D7E9290230700A659DDBF4E84F89FB9BE
                                                                                          Malicious:false
                                                                                          Preview:.o0..3.../.#x)..Kc.-.6..Ym.R.I&D.....#.7...6....I.U.p.W{.!5.1...J.)..IYt@...&.Cy.m.1.(.{I9...K>r..K..I...H...@.3..?'.....q&/......ir.>....Op.x.y.. .e..%r.v..C.....S...^+N.....L..r....L......t......C..'.S.];.-........#3.......u.m. ....u.r...v(..X.&r.i..Jm.....|.8.x..tLy..y4..G...0..&F...#.../f _{......"..X...4h......jz..f....g.....A.....)f..,.j..@o..~+..n.q@A...j.).2..nT......j..../..7.<%]Fy3^........s;.I.3..i.o...t.....,.dc..W.."|.{.3{u.th6..I..z...g..".....x.[....$-?I.}..4i..X.vPH.h...($YP*f....r.KOK.4.!....cz.E.....g.....Q....6..k....w.6..u9.K..,...J.ie.......>?j*.l..%!'8.(.W`8.(...F...7$.B._...PB....t.1..b..N...C..K.u4.7.>{...hs.N.......k._....6...&.6&.(.Q./..B7....q..%..8..q......Q.......\...D^,T..1..k.LK.B.F....u..h1._...Q...E..e.(ELm.M..f&...q.w..:^. .%:.....5...Sk..i(.B.%....lc`E6FR.AB.}.'$.((k. .d.D..m.]lV..s|.U46R........@|....Lpcp....`..l...#!...K..|}....S.. ...f..^+..j....m..>..8E.Cy...hl[..(.......>..a.#.{..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857833.45e26519-596d-41a5-b290-e547b44111fd.health.jsonlz4.NqGT (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):711
                                                                                          Entropy (8bit):7.7317745822327915
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:VhyHRgsHVMM1bcZ691erv8CoaJbY5K+2nvw+fR0RUuHIlOA/5CldwysN4PWbQ+mB:VhyHRjMMtY67er1s5K+2vw+WRhrU5CHF
                                                                                          MD5:72FFA638CB928B4E302AF191C5F34AED
                                                                                          SHA1:7BE69F03602D4AC990F7FC388FC16B4D147F7178
                                                                                          SHA-256:475C98A0F8786A84632E8A4AB3D9904CD641BAADB67A14E71F8A06FE0B307288
                                                                                          SHA-512:3D00742294C424B52DFA40110472704985E8D323FDC74F7F5CE8F988A106887A7DD7D113D823C5CEECE00244EA201A887AA7DC53F62EC6FE0D55D8A281E34082
                                                                                          Malicious:false
                                                                                          Preview:_.27.....<..).Cv*. ...s7......I...:...p.....b`.r.....2.Z..-.....)pV...oo9.d..S%.....J...G....8.e.R..x.b.)Ha......BE.Y..E....n..[....M.......V.3.M..g.T.....xg;.i.K....X...I.'..W.fdj:NID..-.1....HR....1Q..cM.....P.y5..f.......}iVE....|s....aGA(.T...n..R.Q..H....Yz.e.Ad...FC|......@.L..I. .p...'))h...w.;.,Rd.p.!..8,9..._....&..v._M.U8..E...C..y..sA..C.p.....(I.hlU.Z2..N...>..I/......?3.$y1"W.s.........?.r134350de32c"}3i.e..<t.Jn._.....#.._.G...&hZ..,.w.h..E.6...F). ?kvV.9.....7/W.B....~..o...R3.T..a...".2..:DS1....Q..U.F.x..kA.i..'..g.......*.."..?i.....WW..46^`.c...g....E8.......t...OO..V.].$....SNt..A.#..<`],....5.<.Vv.l(..fPX..`D.V.`...,.b$.).eY....R...^0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.81ddb4cc-1d49-45f2-961f-e24ea6db2be5.health.jsonlz4.rLDa (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):710
                                                                                          Entropy (8bit):7.702854356445507
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:3C26nTucItZgfkW4aLMlB5MXWMcJogjX7+QXxQh7DrdwiYp45u3zue8LSUt7NGDn:S8cIt2YdMXNcmMX77XxgRTYpku3JVUvy
                                                                                          MD5:9E8DC409A865E29E51AB0940F53EBF97
                                                                                          SHA1:580FD7249FAC9EF1EE0E2DC61D93960C1EFAD21D
                                                                                          SHA-256:F59454C09B132FEAA40F0BC0C6EE8B5730067B15B472B0E8261FC0F22DE0C75B
                                                                                          SHA-512:4601EC94E35A43838DF3CB26810D3AB43108E8A5EF5B51A89CE59C449144FED4D132D64B232CD81F52D6C5CFE207B4363EDFC1B572F883D99C6B04CFC62768D3
                                                                                          Malicious:false
                                                                                          Preview:...X.c..?.}'.v...6...?.....M....G.!\..3.\..u@U..$..=..O.v....O.......$aW..`g........ZJ.0..l.3.3.37E."....dK.:9m...%.O.M.2x.dk..mJb.F.aQ!.&{..ivM~.x.Z.i...p'.AO..SB..].R.0.q7.ua.@...l.=....SZY...G.q.^..YU...))....>a.>..N...'..>j.......h.r.&..4.....n.(|...nRr'\?.Q.....f..d...OJL..9..I)k.Buc..V...j....."..9....g....u...G.....<..u..U..j.h..<"..].......H.F..[H...).........K.Y....4...5..9.X....m..Dk....r......34350de32c"}_...DX.F.Y..PL^...pi..P...G@@..;K.H.d..2....J.P.e.TM.}`._.w.SJ..q.......FJl.p.Z..B>..8O.8*!....4G....b4l..qu.eh......bJ6..mVE..jQ..qyF......l.~..@...h.n.......4..V"...V.7.G.r..IQ....|$.G...... h.M..i..+..mE.K...4B..|......._|.....>.{>v.R..q0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.a73949a2-5a70-4025-8008-88156c16bb4a.event.jsonlz4.xvNj (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):4409
                                                                                          Entropy (8bit):7.95210261401454
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:DIX6XLj2tSCgMbkfEUfGZLIVuXr6G3NDkoGIk+8QX6s:Y6XQPkfZfGGVSrt3Fk5g6s
                                                                                          MD5:B72ED6DB82C3D3F3C24811A2AAB50E52
                                                                                          SHA1:A18E4089DD37DDAE6E6EA1113311A2074C92649C
                                                                                          SHA-256:A2E5A0F99FE0FF79EAB7C7745318DF8814B15A974918841C7C9557B6D6386422
                                                                                          SHA-512:FED00131B2BB738B4AD6D9134BC3E0F6A2D0BCDC0C7FCF911F6418BD930A1175C837EA312C411E064CBF5242550DF9805A9B0F84628D69FF3DC1808854EA7A26
                                                                                          Malicious:false
                                                                                          Preview:@{..w.dmO..|p....$..`.b{...q..BmV....D.>J..z=.!.Qr.f/.z..wQ..1S.D.uI.8~.x.B<.KF.N0C...........}M.L..4.c.[....w.....x..D<....G.Z7..C.....!t1V/(...-#&.=mKF:z-,.k..-.V.O.8...:-..n?n. ...{,....!Q...z.K..V.$.>...q]./.e.g.)......x.eaH..^OT^Z...%0.j....T.^<.vK~.....)N... .F.2....'.v.h.jo.".....{)e...A...../....p....m'{.Pk&K.?...G......2.tB%....!....>.C.......g.(...Y..m.............oC.F.......NG..x.+.G)py....t.. .-.]...W... .nO?/.H.D#..4......B......p.....D...t:.t........kz.E:a.St.}?...}.6+....7..............i.,..u=H....CS..R...aseE.9...A.E.,T...I..O...>$.u....iKN.Pym.EDz..s.^.e8`N..y...t.......y..}.....0.~W...;\c)....~..#.._..[e..<.ljTy...Q.e..c...\...\Q.Y.7......ri..B{b..r.vh..p1L&6..^V..<.I*.1u<...iCe-G....Hj......a:....<.."`.w...#..s.....]"...C..o.(.....4..\e..OQ.E...X4."g.1..U... .[....u.......@[.. jHd.Z=.....|.%.".&.).......:/b6........>y..8..T....U^.RZ.L.;u...........N..h...#$:b..Py..e...R.ffj..8.n.n.....w...L..h_.|-...[....=r..>.p#.(CS.....F..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857869.95af30ae-acac-4802-b983-233d7fd3cf34.main.jsonlz4.lACe (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Public Key
                                                                                          Category:dropped
                                                                                          Size (bytes):14288
                                                                                          Entropy (8bit):7.417244728316184
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:0s45Fk+uPOeJ+7b+UHhM8x3uYynUFO623:J4HD8Bm+8Rzyat23
                                                                                          MD5:4A0FFEF295F0A7024C0594613B61ED60
                                                                                          SHA1:970F63D6CEF6EE5FBE12F8B5FA2DFE2F9090D540
                                                                                          SHA-256:5930ECAB299F1CFACA75178DB1F7F94B8DD94E4E326495BB664B7AFCA3561E03
                                                                                          SHA-512:C309F106028BADEC638A08698B5D3745543C24CDE9779E35E2C758F92592F92BAA88B91534739922FE41D0E2DCF53FDF7F92F24395D147203BB796D228DFF11D
                                                                                          Malicious:false
                                                                                          Preview:.^.!..\."!....pW..B.6g..`.P.T.[y..U.M.;..f..%*.F.!..*......g...0eo.....;..@..n!I...7...h\..xu.1.Ea....q..<.j..R}8..o.Y~..$7e...:.....j...=.G8fM.KAP.b..(.^...?B..-.}.!6...........[8W.....Re<...../.EY.A.."..I.<>.{...._..v.8i.O..\5...u.1`.7]!Fh7~...*..}.....g....c...u.8...i....k....8...)."....Dq.s..8....K...._..o.Cd....w...V|A..,.0...%..........E....Pm..O..d.+....U...D..A.+y.....T\...Z......W7'.Ve.Hm4#.....-~.. .I......?7$.M..s...'.1V.[v45..*.,'Q...+.I../..)......]..e^.t..U.xf..}..~e#.N..%...@.s.O..c....x."+..p.B-]B5.H?i.%.`.).dR..m.Hk.;...@.$.ci.....z..8...'\'7...hF..E..y...P..l.k~.}..8....[+.q@.rD..KI..X... .m.u.._........tn.3.E...5.d...k..,r.v1......._N....O.C.tI...../.Zf!GDr.....*kq'..|.....M.....?...!>u......(..%...{.}S.....A|Y...F.>.....r...|...9X....0...&...='.Q..l..Lx@...2d...>:@...[.>.Z.._o.!.o..J...f.....l.K&..\xK...zn.9...T~..?w..I.K.`...x.....L(.^......ub....3"...Uu........P".^..}*J.....F.%deX... .4...m...x.;.,.....$.....!....;

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\data.safe.bin.QHRJ (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):12692
                                                                                          Entropy (8bit):6.067803977736584
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:um3FAqxX8u4Pxy4+3+Z8aA6b+b+lb9bocJ2OPoir:um3O4t4Pxy4+3+CaA6b+bEb9blww
                                                                                          MD5:CF4B18CF264F68DAC5E88A927840D7BB
                                                                                          SHA1:8A2896C3F6C516ED950558D5FE030D5B8445FD0E
                                                                                          SHA-256:DF86CE0040B5B227BB179A17E8A6750895860D8AFAAA48B2E35280C9C08C51D6
                                                                                          SHA-512:FA186F61D71AAAB36BD558FB52880C078B9DBDD1DFE837BA7EE94150FCD0954085DADC46124406ADD8B216E9F5C14B87BA04439A06B9A6CC8E8A5A3D6F8CE1D1
                                                                                          Malicious:false
                                                                                          Preview:..|...V.....#g..x.........2y......46..O.l..$.p..`..jj}E..{N...`...Z...k...+.{....D..6.Q...IG.v....\...f.....L.../._...#.....[.x.......z&.y.Or._...?b1..R.o.(...{)C.F...8cv.*....E.%-..a..4?..`O..C.....X.....O...3...q`...w...Jw....<..8D..M'.a"4....sz.UG..5.....x....>.b.7.. s.JC..Yw.J.e.........B..g...K...6.-.o..B.b.=.k...hs......!..L;.....$D#..e2C?M.#.k.c..{\....<H:...F...,......n?,.7.ST.....?.My.$...{5.([[..C.M%.d...[../.UD..{./.f..QmF..KO[.]f...c.\.v..w..........x_.S.N...-3.!..<.|.[g..)-.+..kF..S..Q....X.X[.~..F.,.._Z....,....!....h..-{.....<..h.......+....D.b=.\.!.b../.d-K.0.GE..1gKI!.]#v.Q....D..LR.P.w...k.g.b.4z..~^.o.....w@.h..hds.|i.....Q..^@^E[..J.HB...i..c...d.../P,.}.s0....q.1...+4a.M.{..|..".X.6i.P.IK.&.w...?...b.w....m..Q/.|.e6.>.{w}_.b8.~..B.pG."o...|.9D.AP.P..?..).^.....}B!*4K.s..,.`.h.........[/.aD.-{....W..2M..KbZ.....c.Z.--!.sJP....+HL_..3.U...L3?..+...Y...2.......-...Vo<.%Xd2V$........~...:.......&8.%..(L*8.XR5N.....

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\background-update.wXrf (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):717
                                                                                          Entropy (8bit):7.727765178318773
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:YQAqW9GYeQ90ZY1WWJU4OJerBVuC5JDxNfswFpLK0jnSrb5BWK8Bv3s1u41ah0+H:YQHOG5ekWJUzKBn5JD4wPK0bSrbbW4bE
                                                                                          MD5:2810ADE73DD5A8AE901FA4362F2BFC5B
                                                                                          SHA1:617B0E07A2F96B8864A23A9CCCDD6428BBB2C634
                                                                                          SHA-256:1257AF98CBBACD6A4D6C13FDB7C341A9659F088A993F71686E3D0A09A880F1D4
                                                                                          SHA-512:B154616FA6CC5D89A40430AA0DD8D31E1B93374B1CBA3DC4C08F85A55FB40513D32E6C4372F41A0E1599E4AA958A7833BF09F337701D864DCF195BAF6C20E91D
                                                                                          Malicious:false
                                                                                          Preview:3mT_;./>ND*....i<... D.j.a:.z.]Z....'@.......S.....}C#...x...J.;.J....+.h..+.p...._..Ki#.Xs.{.*.....r....h4..+FV.U....O................3......[z.....D.....h.{.?%...V...Oc..W,...#...9..#....c]..RE;.G..].|..y6#.........Hjm.%.m9....}_s....1QI..C.GM.'.6czX......i8+....Z.rZ...H.7.#mp......m..0.......V.^W.<.....}~l=..._=.]...r..........:..<..a&uE7..)e.g.N..h..AaFv".....y;..xI....|.I.A.i.s.i..@6.f.xO..qy.p-&.{....v..1...n.t.;.h..B...P.}}..C;....$..R.'.A.$?3.{.Yg`..'E|.1.\..........:.....w....e..T.t.....%).PX..o.2.]!.8..6...H.+..HU.....o...:... &..}..s.$^pB,.YD.'......N.A...0.{.P!k.N...PK..;...I<q.CVu.....m.........:.Wj?b..+.F.3.ELY..n.X..\k..P..V.m0!.yN.TdK3...!W.......5..$n30xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\events.UcXv (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):791
                                                                                          Entropy (8bit):7.759266754603518
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:YvH9hskg03FdYxQejXmCooq1JhObkRjHlthFMH+GsD6VDWSFnh1TURJWmFcM6N/y:MUkgOFCDjoJkb0jHzPMkA0J3FclmtjX
                                                                                          MD5:5FF7F3C616C0DE130CCA042C7325A417
                                                                                          SHA1:CD35EAD5AB8C08C9CD9194AC5A08C9D73C2C66CF
                                                                                          SHA-256:517A74C23490AB4A18B861EA2B0C022B8BF7C08347D8D79805B64544231AA1FB
                                                                                          SHA-512:DBDFF3DA05D5FB6DC0046F516AE54746AA026DD81B5CA23D5E6E753C9EA772D580E7C81C0C63DD7DD48AB08863164B9BFC7AAE6C403D5D56384D40E3F83968E0
                                                                                          Malicious:false
                                                                                          Preview:.<..........#..w.M...MxR@QP..#.W..2.A|P....X.rmE....,J...z.IU.5.2..?d]..F.....r..h.Z.;....nm.....3..Ke$>.Qc.m...........?.%L.5.v....G."..\..lT...`-..H.i..}....0.k../.;C......MR...E...:.c7OCG.y.....h"y....q.....2....;n2.....1..T@..:..(...y..&..-..q.w..y#Rp.T.....J.2.....Z.k.?...vp.........[./..1........1p....<.]....t... i.j.w...E.(..I.....j....~..V.c...,4s[l...%.U....'n ..P..yG........J.$..l..`.Oy... .".YSjQ...L..WZ.g..]\...e...O.k.J.......:V......4O..i.B5...Q..`j......Z....Xy......^.XlityCache"}}.K....)..%_.....s*..G......0...w.....w............7.\.`..t.9^Tj.{...{.7q.UT..;....A.A....=p.U.v5/..Vk...\..A....q.l1..~?....S.]L.d..p..}..(q]..'.a`...9..&.K%..3"..'.u...e*.....^.jt.(....Z`.....@..!.].*..).(.~...V....q..........Q....9.....X0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\05d02ac8-b2f1-4670-8541-db8ec2bbf427.qfxT (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1945
                                                                                          Entropy (8bit):7.9056139633566
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:2VwgMROQCbkpuO9whHc8ZC4WIoi5RNg9+W82nyVuy6PC46v8:apMEApajC4dPNgN8LQCVv8
                                                                                          MD5:A04054C6E93584844966D79674AB1F5C
                                                                                          SHA1:FC8EBBCE269278213C884023E38F01D363A5E86E
                                                                                          SHA-256:12B006568C640D56972530797DA068CDDDFEDF3F02D6E2CF7740AC3F9C690997
                                                                                          SHA-512:07486A2F12522C7E778C333BDD5944283D36E8BD2ED35CA377FD18E51A39FA8AA0101AA30A2025E6DF8AE02244355A4C24FB419F676743E57774F883C76B5DE7
                                                                                          Malicious:false
                                                                                          Preview:V.c.E...e.s/0...'.....D.!)..;....%.9iN2.w..X.......}D*.Tk.#...."S.~......).....^..d........{L..u..:.Y...Z...P.../......:s. C`.{u#......a....&..V..........f.<>a.b....r...b...c]..!.Y......_....b..l....._.....Y".T....p....M+...P.x.MA..Y....x.2......8.....xB.........[......K....wl0S*'....E.T..G.:ZV`./}3.2....t.........p...'.%C.m...qi.{.^..}D$.24....q?..?{..0........nh....[=..|.B..#...H..(l......^}..;<.E.W..S.f.......aG...i...-...G6.rZ.'n#....i|.=].#J}f;...l...r...K.e.`\.:X..e4...."....pU.`.8....cu..E....j....../.N.]....'...p.rG.fk.'.....p../...I..l..r.a.p....yV........6. m..z..z...u.ip.>0N.....A....^..+.ajs...o3RrHeA)9b\GV`x2...:.+...!....%.....8.[.mzI.NV...E.TD.Ez......6.s?.+u..m......>....ZSh..B....kALY.C./.>....#.3.......Z..N.".b. c)U-.,.#.S...'[.....|.k..Cr.....6..9....V.dB.w...p.|_2..<...C..).3Z.R...../L..........W.O...^..FG..~.@...-eW.M.Q.6.qz`.<.qg...6*....fEA...lg3.L.s.C...,.?.u.;@V<.tbO.".;L(.........H.]...R...L..5..V.......W..GS.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\12f997af-c065-4562-b9f6-11000bb95c9b.mbKs (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1579
                                                                                          Entropy (8bit):7.867495110128875
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:VVmWZmpnMbiFTN8OM/yNVqtfrZoRHxAYw9SZkGO3I9IBiFrR:VV7uT3LXqtfCRiYXk73ItN
                                                                                          MD5:CFB51F60ABEC3ACF0821AD0EFAD21C9C
                                                                                          SHA1:44F085F582F6C7FD522EF0F78F74965A4E858E14
                                                                                          SHA-256:6C26DAF0AA3BAFB31A98851A661E6B16918E93E9EF01903DF2F09FB7EF0C9249
                                                                                          SHA-512:F394E003C611876469B5F5CFCEF046DBCEFB07F756712DFB842CA3C2045A2924739A3BBD03358472F4D009E3806478745A4C7336194AB2D0AE7231D883C36BFD
                                                                                          Malicious:false
                                                                                          Preview:.0o...No.M17.2.d.Z$lG....\s{./f...Q..X..*4...H.$.r..:.7.#.J..........g........Wi.~oADm...6]..k.LQSf.%..+....U.I+..%....Np.%.N,._.?.[...A.....f.%3.2o.eOa\2y]Z.i.+&.|*G..$.@....'. ?.Ff..w..h+-.9...{....W....Nqd...&M;..=..........6...S3.1l.i[.&.........n.5'...7}.....E....~e.dM,.JVF.~.qjY.3e0..@K..ip..w.O..z.a'2.U5..f....?-.].b.g.2&..L.3..`.....!...4`e(..7~5......;.G.s..a...gMg.. .+...W...dG.w.l.....S.%...KF.@=...4....[..X.fU.k.......q!i......\....Keu..&...r.F.mp.:.].]....a....8;_Ws5.......:p....!..{..1z....0.o..r...N...o..h...-...`....r....M)k.....a...3`.....f..P.p.O qh1.....s.-....#`.....r..f./..1x..@..Ul..Y..r..n.........P.......[5z.8.f+2..u.......Fq..}.....V.L&F...{:;...........0.W.e.....Iw...U`l.U.A..-._....l..YLq..Y#.o....k..{..-.+..........P.(p;.m.....|s.9.o5.....+gr..z......"YK.-.F`.I".....q..`.H...&..Wd.>7...}[a._.@.K..S..ud..w...P.0.e......\.`.=.k..........G....i..JcG..~..u.r.F'!..8...vk.[.\R(..L.....{.w.aS.UD.....DbR.....u...R

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1435a377-bbaf-4c9c-8706-0811a779fa3f.oNcF (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1945
                                                                                          Entropy (8bit):7.907286810133279
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:qbWsMV585BFjy79tux0eDHnO7TYrf1xbl4DxbesAQqD2oXaic8KsxDIvd2uJqNz5:4bIOx0CH2IFDNKicGKATdc2TI871J9
                                                                                          MD5:A49006FCAA0F8476744BB325D0760F80
                                                                                          SHA1:FADD868CDC51A8D1DD4F2FD2289E338461F6EB50
                                                                                          SHA-256:BE51DFBC95374C13682099D4230C5434C17DE7AEBECC7BAE6905E589D0D6438D
                                                                                          SHA-512:3F410CA057663DBC6E7CB56060C7E066394B4EFACAF0A72B1206619E89E78BA65718C8AE172248A0E41D0B942D359B1962DB6F06B9D132EE0AB55F6E1F7B1D20
                                                                                          Malicious:false
                                                                                          Preview:=..+dL6.I.2....p9~.a.~......G....o.P..VW..C.=n.C........UTl..o...e..e..fs.G.N........."...$.....K".X. 5..;..Z..M{.4.[.....z....S4.8.......O....p@.......*h......v.%....}`.I.>.......!.0..#.q#z.oMO......y.pE.:1..<C....>.)g.-n%.S-..5$-.L.yK....\.rv..t.0.g.[.T...x..lr.X.l.U...].m..C.^...!.-.%...i....XW5".vP..N.)`C.a;.oe...g;..9cP]@...j..a2..$T...2....:Z......b.T.......P..A......Z...K3.....8..M.9.^..(v.......U3......M...5....ao..b.!..1..@F..C.S.d6.T...f..Z..`..H.}q..59..T.^.h.m9{..}.<..x...bb... ......Ny.}.r"...).E.pV+......]..GD..p..Vj#W..-Z#.hs.G..r..E!.`......l.nD....34.MR+..95..2.S......;.<....A...<k..en.imH.;;...\....Bz....'..._#4j...)$o....e..c.o;..hA"Y....4O......hj[.^...\......".=>......"!+..g...&..Tig~k.;...KH.f[....8~[.k4B...Y:Z.(T....)..J.v..|.@.Y.....c`!.6..(..J1!..*.(\........aQ..%.4.....^.t9.a..]...9..7!.Yeo...*m.....m..R.......('U?Q....`....I+...5..._.5.>).lqR,Z........u...~..&..K.t.. H...,........O......i....\.f"{...+.8.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\15f01145-7764-450b-9ad5-323693350a9c.oAMd (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1580
                                                                                          Entropy (8bit):7.890527260382246
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:3WzemYmVNhFA1DTxPBiTVRMsiO9O6SMEnFmr:rm7gPmTvMK9O6snFmr
                                                                                          MD5:7826D51DFF54B203941080B3DCC5E774
                                                                                          SHA1:ABA90F48D203BB2ADF805D018CE4F6163E19ABFA
                                                                                          SHA-256:95757BB6B533B216B7FED58AD0803373EDDB0A8A33CE308D814CB037C5A95F21
                                                                                          SHA-512:62A64D5D5D77F7295D5291D6A2379DB5A157076C66040C7CF6E490637D4A10AE2ADEBBD835C4AE4CAEA6D8BD92239563B12FDB87C468912D23CCD823430C13E9
                                                                                          Malicious:false
                                                                                          Preview:[pa....P'2.{.i.T.S.~....u.....Nc.Q.zPY..m.7...:.\......p.V..z.C.4..gi...I.Y...1...r...~..Mj_.(;O...7Z3`.hvGeou.u..& #....`.h.B..r.*$;.$.".~....(.[....=~.3.W!.S..a..R67w.....xB.nP.S#.x!dQ.>3td..A.`5..>b...!.=......3..2B...X...j.?.0...sw...<....n.5C.7.1@..:.}.....*RI1lj......s...fO.X.......}.Dp..=(...2.3K.&....k...]./........V[.h.....R~..D....2...b.M....o..U\.....-.![....8...T<p`..|........s.q.,...".P.....lDA&...n...=;..9...\........2].q...Bj3X.d..G.Ox...}|.".g..e....qr.6..$.d/.IKDu.a.EYl....h.<..H.....Q..N.9.%.*..g{.F........BV...p..~...IZ......u.-..;..^q.....)w'....h!.....@...q...*.....j.......K.#l....ud..n...}.u.d..bU../Pn.!..3...o.p...9.....(`^..:Y].2{b.-.S...W...9x.f.....a.............V.....r..~+6..B.../.7..&v....'..{z......M..Y).rBZ....B. U....?.R...'[LSf....I7.o.&>HD.a...@...s.]....G.).-...@......&D{....l/T|5z...|L.g]....D.#-.4.....?..s.....q.v\...'.Y8.[..Ms.5....*.......O...S..&P.;...}.:0J..k.](.z}.g......~Y.].b..E.N'...>.>2

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1d5599c8-3f43-42cc-8163-9a43c60a06d1.zIOZ (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1828
                                                                                          Entropy (8bit):7.894597557686664
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:HHfzRp2WKucMSFvk4Msf9XMLdn1KlZeU0swDwPfePO0I0Fq:nD26c5v9mdnC1DfeG0Nq
                                                                                          MD5:6683F171C4C80DCF0E50B9C53373484C
                                                                                          SHA1:6981A7686886824CA798D948B52DC563F715A513
                                                                                          SHA-256:AE72F1ABD6BD2F406D83D7CDAEC43AED1B063E91A7DE217295F2A60B3E563908
                                                                                          SHA-512:E98F696A62C7ADC77F151DF4D678F6A23A43033C6AAEDA6949D41FEDC024701FC145F93C27B431C376E255E0773FC065A6E023B8D1D2A320B264F51A4F63E629
                                                                                          Malicious:false
                                                                                          Preview:=c6B]c..B.g%8.E....Ep.qJ%?.1..L....(I.....UJ..'P.........C....1o.w.)...-16....Oh.;P..h,x.@...n..'.X[J.I.%nt9..d..&.o.1.j.H...L.l@.../..Tb>.XW.xD...../...F/V..Q~m..fT..:..o<r..|.F...|.w..R..I.H....c.+.....<......o:..D....J.Ht>....=......HO.....*$l.........3k.Cb.:)..#g......{X..'....E>..G[...d.e.#..Ok.s....s..G..O.bN.-.:....E..B.1^.zu5=.<.y.........%...b.1...6.V#...^7P.c..........R..E`.....IK.......Y....'.B.......?...d..K...j.k.=..X.$q4.!f.e....}.,.\ ...B..U....r..a..rS\~.@..a.h.E.%...G6O..T..k#/....E.q(<.P.... ....Q.r.'......~...i.9J...n.8.D.u....%.xE.....s..).A0..L....i.'I.<?..v....~..F.7.......E..hv.O...{..d3..3...fDu.2.M.o?(.....q..yagN...G...2.7.g..'...4...l.4.....Y}.*f@P..."....M..~..-...;Rc"m....K'.Q.#.iy. H8t..i.KE.k#(.#.....I.g..@z.).w..K..mg.....i.o.r.m.T...:qB..O...4...b......F........YY)K......)i@d....6.D..-.....f...L..x.$..OlU_[y.v..ao......jH._........!T.....=#.zO.....;|.k.u.A.M.-Q....J..k.....Z.)K?.x.v..m...

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\277ffbb3-8e94-4f3f-acac-7a401d130160.mALM (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):3832
                                                                                          Entropy (8bit):7.942418863655013
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:K/CFm/hk/BExqgJpXuJPMpNVIVZP/YhZ5HPv8WAtbbt:nFmpkpwqgJduJPeMP/YD9X/AFt
                                                                                          MD5:2FD8BC4F479893B4DC14AEED825281E0
                                                                                          SHA1:28A88831295096065BD86F7B03DCD7A1A2AFAF8A
                                                                                          SHA-256:9794B1C554E88A5D3682B62C365FBEB4E31687249BF9665A3D1F19C322157CB5
                                                                                          SHA-512:A8D3158AAC27286C91C46CEF7AC40AD1B79F73F9BFB8A691B8FF7A128DD6A28A755256BB0294CA373CD432EB06189AE5E04F48FB928A423DBF4AA644EC939D8C
                                                                                          Malicious:false
                                                                                          Preview:.'....U.s.K..as.Z.W]..a.O....n..g}..gN...{.n.`...p..j`..O_...o.....b.k>..|^0.Y$.].E...c..s.Z:\..Ro@.......r...W..b.....f........L..QV.6Q.@Z.....r..X..(..B..=nK..J2...}.+.......(.3...........|.4..i.}.O...<?.G...t..jd.azj..'Jw.9..lFBf.Y.'T.:.a..5....K......;}.}.r{....~.;.t..ni)._q....,&......d..Y..qjKa|..<..a..\iIM{......M.v...2L-......,.......\.V....]j1F.......).eE.0K...L.u...T8.......>.UL.3..E...Z..E.TV/"v.P..,g.6......@.b..z~.{..4hd..K3.. ._.J...=.VuM........A......q..K_...Wjj...=.1.....`?{...".....*..$..3{7W.).....(.cP....i.3#AV.6w..j8.../.K....K..Hw..U.......(..`..........{]4.[.l.u.;I...`....h...='.;....;.\..o.....2..G}....}.)2W.LNI.y...A..L...~y..I.m....l.G'.k.#..W-..u9._.g....`S?.+.{.)<...w.:.0..!..L...Ll.....f...n@....t.2...'..u.d..MZE.y..`&...0.f....HC..D.G.O....X.eo=.Gil..6L{.L/..C.B..[.X..W7....c...r......n\Az...0..4.zy...J.K.z@"5M..v."u.......,E.....+..\..y....<[.....^o...VM..4.....f..y.l..ufPufq7.....Jxy.=.M0.W

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\3a40aaf9-3f8b-43a2-85e8-88e3ffc7666f.HEjN (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1208
                                                                                          Entropy (8bit):7.824088527069435
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:sqjKyRBnwcN3Hyawdc26mQKQ1P0J8CE0Xm0poAZjaXItY00fNarC916uX:pXnpNXydcSlkPh0XHpoAZud9Ueeq
                                                                                          MD5:44694C3C0569124A2F043716638CB6B0
                                                                                          SHA1:D1C540A90AF0D9F3CCA69729BEF2BDC5F3CAD282
                                                                                          SHA-256:28822169B9DDE3A4722F9FE3A3DB83B8D63EA26533D219F5EEC493A055C46D28
                                                                                          SHA-512:EBA4DF5E904F285021B3BDD352C342D6A781604E9E11C4F93A85B4215FE13C8CD09110E24C836D8887AB06610A490FFD0F709A5E343F82F607B786BBCF8F6542
                                                                                          Malicious:false
                                                                                          Preview:W;.5x.#xd..&7.[..FB...F..*Bt....K.....K.#.......u.\.~...b....vR.:j[...~..?.......t.....?..@....jl.......j./.......K....&:/.*.l.hVN....E..........0!...H..5.,.[..G..9..3.Bxv......^.N.&.q.Zv.k.no.@.>..j...xG5C....f#Jc.f_....k;r.........+.,.......L|.A..;.u.</.....t.h.n........Z=q./k.......Y.o....^E..I.A.A../G.. .o]. ...!).s.!..W;..Fs......O....:..b.M.a.'nb...k)....Y......IRN.2.&.O>K].W.@.&p..e.)d.../..,.n.m{.8..$...W_. ....Z.H.<.N.w..'H.R..i.D.h...&zZ@o......w.%..s..o.3.'s&.....c.R....a..Y..C..n1\.YN.B.6.....g.l........f?.N....p7...2.....n.'..C~..dA.....>..J~.\..U1...O.....A....C.........&|$x\.V..."..~.%,[..l........o......c$H$.........a4.,.(x..c..b.....o..J.e..!./*8...I.G^g.Q!.....5.9.C...dn.(..bd.jf....h.E.u$......J.....rj...M*[S:.Z.:e......|..Nl'.N...g....da.q......w..r.bGF.=.a.#...T....W..@...:^..._5.t..j...<.i.X..Tj.!.zm...............#...8.....qW....E..r..ponsors":[]}}}`........C<.F.e.r....v.*.[.2.IdP....$+i.y...Fp...x../.&.+

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\78267ebf-1fb3-4b11-82e9-903e54a2a54e.QDKT (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1488
                                                                                          Entropy (8bit):7.869625322337634
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:nXBwNDr+lttdqUiqvHsPu5ZeMJDc22Qs70xbhsJh7z0J028JqeFH+MZFxm:XBwNGl0UiqvHSuTVJDXfsAhsJhz0J021
                                                                                          MD5:802DC6A59A5387CB139826466FE6A0C1
                                                                                          SHA1:F929B0AF32ABBEBCD07A02BBCD913B73389EF1B1
                                                                                          SHA-256:23ACF5B308D2A1D933E35A84C0C8B19340BC78B4F05BD455F9E5CF1B29F68ACF
                                                                                          SHA-512:36997CFFE5EDD71EF60CD06807EFD7378ECA7C5BCA2AB81F002A71904928782D487D5AC5B3D7796FB9AAEB19709894FCE1C856EC482D167620B4767AAC057A3F
                                                                                          Malicious:false
                                                                                          Preview:.C...k`......{.D.....uQ..|.....D.....p.R.m\hk.UG2..2\.....zR...B.x`....p..+W.,=Po........>...].......-...t.#b.\.n.././.b.."...,:}.. .O.....W.i...n.........&.e..cj..Z.,,M@..m..O*wWwx`+....<..){.....A2.weW.W#.Z.l..=...u.NB.8.....>.4/..6 .1.q......>....|4GS..M .&...r..Mt%r..R.u.^...2...p...].4...".].....I..^E..u._......k.D.y2...^.M..V@F...}..K.!c/..8e..\.-c..WZ~p..a....Tq..).....n!.(."....Z\..k.....I.....[......d].df'..1,+.x.@.i..w.#.a..._...z.).,.l..ju...Q`...j.....(<ues.<9..v...a7.SE.l.oX...o5.).I.0...kw..z...+aP^).)........e..&6.f5...}..B._@.....I..8.....z/@.e.;#...#T.4,[.WGv...ID......`..7...[....C..|.f`.....t-......O..4.p'.-,...I.%..i.'.~...V.l.'<CW....);@...e..(2z..G........s2.4D~.h..#..~<.T......zJ.6r............70.....".y..(.\x........(S.P....G.|..}..J..p:#.....k.dIL\..Z.Wl...=.3G.....$.9m......f....&?f..A.0...R.T8.c....d..ls.Q.J..W8.[.67....6.m.!]0....>`.2[&....a........q.#Zd....`^8...........b.Z.n.i.v.v. R...."u..K...lz.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\7d12ac42-15c3-4db9-abfe-259bc8d249ac.oVQe (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):3840
                                                                                          Entropy (8bit):7.956241456624824
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:Mtg0akmkwnex/kL6WgTlavwjBCEBYJpLDWRvemPF4pmbq1s:Mq08kwn1LjRvwL2mveHpmb0s
                                                                                          MD5:3D2327867D678AA87284C23DBC93FCE9
                                                                                          SHA1:5F60B9CC57972FDD5C7D6597D0AFEBBA0CD4EC55
                                                                                          SHA-256:8282C3314D56544DC2807F9D2371860908066D3E4A735F328F2DC537098F56E8
                                                                                          SHA-512:CB7D1525F4293292E37576225EED6AD10A1AEF5A4B12ADCD68C5138849B6A2E1C6CEC57FC9233E6DC99BD04C86C44440AE0C5442F2FC37D7B970C85402E5CCF4
                                                                                          Malicious:false
                                                                                          Preview:.F..}.v...+=.TR..L.@...V...u...YZbc .Kn\........(IEJ.nEr...I.6.6..X.R.u`..n.N....)...\......0&.%b.j.V....H].G?..o."D..M....u....x./,.XO.M....$.)..O..s.^m.,.R.6U..nn..U...5.A.)x..7l^.(....J.B..G&.x.`.d..Q^.....@.^......G...!...F.=..m.y......Jm....m<.^B.. .9..2..9/.QM....R.w.7.roH...M....1.......O..\+...a;..2.Njs.uY...C.M...AZ..y....b...].d.%.>........ADC.!....e:......\..e..Hr...T....q..U.l|..;^'.E@...C(.3.!]|M...J.W.#....G......>..$(...+.5.........z)s.FI.ab.L....BD...........s.o...2..}.f(.......Q<..V.......&....psz......Iv....o._!z..)a.......b.LD(jN......~..'.t.T...e}`...U.0..U.0....2...c....".v.2lJ!}......!..N.+..7K...;B.P2..v.].k..(..tY.%...h.{.5.Mj..\. +.]{A..Zdt%...`V.^.2&....f%ba.D.y4.....2.Y1UuXO.).\..mRl.&..j]...68H\..(j......tu5.6,...-..Ai...QNX.....#p.......b..Z.J....<..{.d....V;G..y....g.Uc.L...=Z.T\..^n.JLf6.`.HC...s.....>s...tzx.../...G..t.2...?.n.....H.^P.R..........u..t.R.q...xG..".A`.9kUwy.F....U=/z..3...r...o.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\808127e8-e7ed-4078-b3f3-7f09061a011f.alWG (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1580
                                                                                          Entropy (8bit):7.871778212410197
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:AkIesWAx8PW/L3vehbVpnk3mbNLMIyIzjR0f3JU5rN6SHagU+aeJrFDT022TEHBJ:AkCtLfd3mbNIIv3xPagnNFDTf2YHBJ
                                                                                          MD5:8787C5D59A91AB9D6751123F64C85AF9
                                                                                          SHA1:455907EC6750521262473DB878EBE0C07A41C4C6
                                                                                          SHA-256:F4C2D8C3E985A41A693BFC49F5245CFAE1A741805E2B62F3536B81F2C60B1BC0
                                                                                          SHA-512:BB17DDADF4D8227A322369F3D86DBF9F3DA29790625BE02E5A0496B31EECAC8751CA56322C0F88B7D8DC38E537BF9810217B1EEB8300B8759DBEE75DA71DFA3B
                                                                                          Malicious:false
                                                                                          Preview:....H.R.k.U*.....b.......rJ..7AA..O...q.>B...e...^v...j.:C2..(....c.cc...z.].............|n...#n../..K\N7...9+.T.g.......n..........~.#.^Z..e..l............."~.[...z)XH........<......7.N3.fxiam..><Z..'....b.82.....;.R.g......+]"........}7......D^.......[....M.h.[..N..().)...X...4d.W....+..b..O.k..........S..*w.s}L.)&g"......U..x.......?.I..?z.8..k$.8T.hs`^..Y...c%aX.f2...'..7.....8...5.SlT..F.g..1.a.uP..\{.h.S......Db.z....TF[.W..@h.J.....R....z.j^o.^eR:.f/.A...=...Fo..M...$.l..|:...H..E...-.sNk?....J..w....d..B.T........#..V.C..dc.....I..1h..lt.\..2.c_N..NV.=.e....a1^.5..M_.:&~M?..B....?V5...v"............/f.......$....h._...^....{e._>.....tn..t(h..!...ae.s..x..hO.^.......g%'..T.'lr.....wy*%T4...l.C.Wj..k..vC@.p.({.8[9+..D..*.d$z1\Dr...X.........R.....2.`=...z.t.Z.....G(..k~.'....F.V..AtkFD.Q&.7..S..<.......o.4K...6.........p.\..@..f....E..q.. M.\..u"MV..9.T&.l.}...W../..08....Q..'..R..9).&w..;..\>+q.(c.>..o...N.....

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a5d6ec76-765c-4778-afd2-1e05a1554d8e.eoPi (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1579
                                                                                          Entropy (8bit):7.89067033712225
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:7pyBZvOjyg1FaD0cfxfLoGKNyKSgiLBRM58O8U:mCZKrBRMO8
                                                                                          MD5:2DA4ECCB669BB755370966C7807B1FDF
                                                                                          SHA1:21C0B7F3A47B506FF82B9BD266C764F038D63D11
                                                                                          SHA-256:BA76A86E3070FF1AC9C2CC19F7F3DD3A1674B9262F0151CCF818403BA5FB65CE
                                                                                          SHA-512:B3E9720466A102D931917AF4F9BB703AA0FCF4D0F3A8DB0B9662D89D96CF9E08FBB47B76F213CC42FC1E41556048F7E97BF5447E16B1B58FDA4EF282D8E2C6A3
                                                                                          Malicious:false
                                                                                          Preview:...*..D..@.}Z..>.A.....y...{.[.z.$..T.SVe.Hpj.......AS.uO......7._..ZS3.#^."J.I.>...#...l..2.6...28y......a..K..T..M...xq7....{/z|........r...l.V.v......c...iFv.$.Z......5........4...Z..EP...,..~N>.zb..5<....d..k~.....L........I_.......X@..~.aK.NsTV".(.B.F.....pb.=6....^.y....2vZ.......]....._..Vv......D....rB7..-<..Y...,U.$L..r%..d..T......4Epr#..a?.JpVx..,v.6.....=...J.un.@...l|J,..*c.....T........u9-.....a@G.......Ko..A).T..=..%...o.}....}.....9*....b!@./.......EDMA.!.Rg.|...F=........A&).!...t...+.....f.-.v.H.....N......9&..f.bJ|...x{.ImY.....!.U.S.3...F^.:Cg..f......s1...b...3.@x.%.W..*.;....9.y.j..hO?...[k.|..>......@.$..Cg*%U.;.YZ...7.).f+.7.:.*...;..UWAi......"~.C.....!....*]b.:...w........b.O<7.....9....p.....;.....)..x..w@..W.@.ye...;..BH..u.7I.\..6......qx.v.M.dw.7.Y.*~/..{H..9.#.oS-V...h....`..CT.Y.....=..g.#H..9t.hB..'.S<.'5.6T~.~.......\.......JH./O..b$Q...I....Z.h..0...Y.x.6..3"9...:.2....K..e........Z...T2.u.&.a..C...t

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a7174184-f177-48c4-876a-8a51c2ed8fbc.Qzlk (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):1829
                                                                                          Entropy (8bit):7.9089470697991775
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:MnaV2PJWr1spFWybqkWiJxAgaDNGSit2yw2lcIsG3w:MaE8roWyJwgeGF2ywUsGA
                                                                                          MD5:A63252D50116C5929BC2DD9D9EDC6F89
                                                                                          SHA1:E0B0FE6DC9CF5986FADC6A2ED17E964C72FA460D
                                                                                          SHA-256:B67DFD13BA783584B6647654E5FB04DC8EEBD3DB216CD16CC6EA38A41702C477
                                                                                          SHA-512:A560A30EA80FA8D0C2A14BE7B2282EB220E15ED31D299CBCEF71F1D7C93EB3401888EBB40DDE3C42127ADC6473B6EA7DB5D2CB69B4D6B4ECEC7DFEF29446E946
                                                                                          Malicious:false
                                                                                          Preview:..!......|.M_...8.^8gR.*>G(k.5w.k....Qo..Sp....[7.Q.X.,...lLl.....JA.3...P...%..t.z.......F...ns$.U./....F.#<(.h|...R0....if.#.5..Y.Y..........b.m...D_...a..iM..[fd.r0+*.YO`..2w.FW.b...8/.....dt.5......{..)o..?.>Pm..[/.v.N.W.ib.U..?..^.'.......&...[Q8...GY....1..4o......6...H...M../....B....&.A..T..$.....x.A....W..{.W.*..E1P.Rt..c...c...4.5...Mg.3(...e_.a..r.~..~.^.g^E......|L1...K...J..2P)..F.Gq7=..Z.AJ4..#s....;.e.O.4.C+..W..o$....u.......N(V....1`l....V.....h./......W....gT}.....z..E_.qf....MZ...4.F{.,n..?..TsQ...2|..R..^K.0....W.(iN.$)...j....T.J..j..".55...i..Q..Li.A..0..F...R..L./3Q.zx.t~.y..G....l.XyA.s....h..b...s?.2..>...U'........-..w.9..}...W.P.d.@.$!.-..5Ip./...E..h. ......y.0Z....Q....~........S..=..K..^....3.".3...>j\..S...5..&2..W.....Y.zD.IJX1q.X.....]...x..W<..7@$.....ei./l..............U\\A..|..i...,.6.C..n.J.#..g..<g..S.'syl'l(].<..._.&....`>&j6=@..58...g..|M.W:....f.@8%.W"..<.)&@..?.C.hs...-2..E}.s...5...r.K.P......s.~e.9W.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json.xXvH (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):427
                                                                                          Entropy (8bit):7.532332014951942
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:pd/9/f/JWzl/Cx7JeuhYFcCTlML0wYzcI/cX2a4TA0DzhrW2tOMLms6TrIPHn:nF/lx98lU3ZI/cm4GzlWMOMLR6qHn
                                                                                          MD5:6ED185DFFF33CED8F37F4A3D9B1AF2B3
                                                                                          SHA1:03D5CEA1D034774F4C60F911A0562582E34D41CA
                                                                                          SHA-256:454911A226F584B88655B8F5CDC0DA576DB4C1E5728B411BD4C27E1B437FA174
                                                                                          SHA-512:DAB713713710163DB6B2534AAA4D98E8F99673B05E17BCFFC5405052FC252F3ED2022872D7AAB1C2130048CDC4C7AC6E0D24D3D6439BC22325281508AA72638E
                                                                                          Malicious:false
                                                                                          Preview:...d..o~.#+(d..X.MQ..i.!4Dw,?.B_.C.D...-..k..k...|.k%L..,.Vl..O(.$R....@..'.^A....?z........3c.g.(.d.Y..'.2.Z...@v.j.8D.....5...8!%...|iFRz9. .JMU .&[].}.i.....).a...*.7=.<....b.%d...0...M.c.D..Jm.. ....6..LQ..V......8....=...l}.4c....L..._V.G3C.......".I..."..n.XU.(!{...A.4........]4-T.P.6....d.h.DVC.0.Y.] H.QXf.......q.~U..<.....=.XG<,....*:n..f..#..o.wc`!.?.....t....o...p..];.){..2......h.0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json.JjlP (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):317
                                                                                          Entropy (8bit):7.289654065190111
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:Eq3jVyBR6YK5VybMy/698E3arDJ0Tt0XY8zqNFQoSijvwtyDOHcn:EYUqYK5V5yy9876Tt0BqXQL2vw8DO8n
                                                                                          MD5:C7F890E58292FD516D6154DEC59488F1
                                                                                          SHA1:CE9956E50E3C1E72B557183E78B68F770845B9DF
                                                                                          SHA-256:76E63DC68AA16CECCDA722221B5D1374229ECBDAF02E19D3823AB95AE7995D81
                                                                                          SHA-512:9609CB418F82457818075CD07003831B2D515C15008228082EFA6A700378036E65279088BF00AEE41B3ACBF29E11AF9B11E4557B44F162E92613A4E5770E2F10
                                                                                          Malicious:false
                                                                                          Preview:...._.N...^.=.....h....'00M.[......yQ.@j...E6Kc"}4.....$c....na........W.H.0.....=K.@h.....rQ...tn.u..0m.....i(|..zO..$...I...]....G.r.7.I.|...:...V..(/I...\$.{..S...M>#x......+.........J.5.@.......lV......k.|E.EJ8.8..yz..<..k..PZ...w.....v......p..I6#......0.I.8bj....^.8...........?EX..0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json.aqwT (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1355
                                                                                          Entropy (8bit):7.841384869252655
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:TzZxAjAlREoDX3sbmERBbdNIfJfW09IIb872Q82Zekuj7DH9ngMAeeDz+c:xxpCobWmTfZW0CIdQZ+XSM/er
                                                                                          MD5:6A92BF793C7B12454C4CAD0AE3803FE2
                                                                                          SHA1:7285E9DBB390344C45E0F3C28A822D3983ECE684
                                                                                          SHA-256:D0F18454ADBA89A3B22FB2C4840691D012A534569122D65A56B52FD5F5BE8D91
                                                                                          SHA-512:300BAC5F7A10F50DCC14C2AC83FC52BFF220D5E6F81A5B4C7B53F85A364308430C36185037C7CB8E473F7CE11C23B0069811F2CF6DEF48DCE121E5D37ADB640C
                                                                                          Malicious:false
                                                                                          Preview:.m.......~,.q{.......K:f...O....{.......z 1R".Z...l.....t.W(/.t.dq...0_.P>.h6..qA.7{.."..WO.z....5V..pph..#.....?.M\.7..]<v..B,......g...4.U.M...H.'.X.g..wu..D....sb..oI)....,....A..*..../->4..4?..B..U.9.~...'3'.60.....lp.P........PY{.7...oia..Q.M..Mx.d.E.3.....*.(8....B.N......s.rL@#.3..1GQ.u4....X.>...X.eWW...lH.D..7........6..~.... ....o..?v.........Jef.K..n.v...m1*O..'*-.k...k.(...:LD.ss......v.X=....O.'y.l(/.H....\.uU(%_..<A)I%IW.#7.'z@X"=..!.'u.&.aI..D.b....o9gV...-g.w.{..&OF.>.6..R...J_..H....f.|./."A`r.=..H0.&e..K.......... ....)..{.....T....+1..h.M.."r..+X...a..8....l{k.[.........i!..J....]\...........-#..).....K...V.2t..3;...>i.}...a.1......B.v.U.[3...(.H.^.NT`..N^Z.M.........rQ..8..-...x..N....%E.}..;.cr.3..ir.Db:...../.^U!.%?s..X.^..*.e..1z..".E.B1....e......uN.,]<cw.=..tll...z...k..C....)!?...5.../\}3..j..M...|.....8..._D%@.',$."W(....XZ.@....O..7.i...v$.k...9b5n..#.w..K......"..$.s.....Bj..Yz..M....e....ZrA.z.{.Ug.$.$....4

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json.QHJd (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):37096
                                                                                          Entropy (8bit):5.8100675260768995
                                                                                          Encrypted:false
                                                                                          SSDEEP:768:4TtP4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ41:4Tt7fdvF
                                                                                          MD5:A5CD542F3C96D7E1BA2686B470F3AE8E
                                                                                          SHA1:B53E74C6ED7A5303B3E82B1A78C1CCAB7F6407F9
                                                                                          SHA-256:42862E7B5E46D085DA450BDB37DEB54B3CD2A0E59676C5C3FF36E879624FFF87
                                                                                          SHA-512:41DA13577FB7B874994D46A199194734E3F361B7102391FEA650BF04BD9984DD60FD6305120B9EBF3DA10DCEAB55220D699EEA3224C112D63C5A418D492B8704
                                                                                          Malicious:false
                                                                                          Preview:.o.\......`[k..u.n...%..'.....M...fu..FS...p..rZ2....f(..?A....0...)..RU.YW.t..Z.:...L7h.>._...!?.u..f".J.Bjhg3a|u.h.E...v..tN..?i.e.<......}Hm..L..8j<..g.O.:R.X.?..c.{.C....bY.&c...>."$..O..(uo.......YW=I.?..g}......X..n..I.2.da.F..........0..&.P.jh.'...+9.[.G.5....U.....?...K..'[0.l.t....-J....H.Z.....r...<..\...7:5..?311.p.....9.......8.....H.qoR#./..Y...L.k...iy.S..i.e...8.).k...U........]0."...A...>..s.T4+$.0.uxr....m8......!..l...e....`~...sB....:t.G..|..Q...5e/2J.A/?.T p..,.?.sWQ... ..Ew8.2.......|........+.Qt.?(.3....,.*...M.._..)..\.....HxV.Y..'.[9}"..3...;....M.:b..\BC.._-....+%..I.7...b.....I.Cl....).k...L.=......p....WF...X`V}.\.2..d..PI..&..a... ..0.C.9!.....L6......=..2.....H3h...Z..y....CB..U.G.k..8..h....40.=&......V/_JE..$.|.A.|.Y.oE.....|.......Y..!....5VF.$'fI...aY@.I...|...ibB..q,6..fj.2w........<aHU......^.,*...a(f...Z.c?Y.D".67(..-..t`.dbq1.E.lx..[!...k...&.Lc:..!.".x.(ku...`.....6t..?..O.-g...3.,z..gq.=.x..;.W.L....w...^.j..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm.DePz (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.6087444557925417
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:uxiLnh6LA15OvsphVrdNOU/6D7iu3D7jxUcX9xIraCWlVCa:uxiL4wAvQVDyD2u3D7jxxPIGC2Ca
                                                                                          MD5:5B46DC4A6C2760D38039CF7948DB718A
                                                                                          SHA1:7876AA4475B7241B79D7D5BBCBA8CE78F2BBE7A8
                                                                                          SHA-256:4F25A4560F2911A5A683B4FF78B1AA7BDFB8EC73D3DCEAA116DD3FF85B83F24B
                                                                                          SHA-512:3D33C5B6D3DF5FC26E2F8B5BC65670D4D55C7B5D25E04D906C05F8B23803D32AF8F13AA2300DF01F57EA811378971A284A856287367E381C2CA261D9D98D31CF
                                                                                          Malicious:false
                                                                                          Preview:.5.pG.w#.E.1@.!...~4&...?7q).A.{.:3{..2..Z.. :q...=...;q.#...l..!....LS...{..Q.O]7W.....j.T......_d...}.y.... o,....).:Z73>.e...t.......+....Qxi.........o9..y.......M..u.jT.LBi.....y%....Ji.......$.I...p....c..O.1.u,x.]..V]P.#.[[o...L...M...&.6.....q..g3.....+Wi=.c= ...L.....z..U..a..j.K..&.,..r.N....i......u...| .r".B/...]:........)..k..<...$.......:.x...6JO...'.Ru........#$.D^...@...N...b."G.d..ZI..4O......m(."...j:......@7.>...&..B.T!..,)......T...CK..PX..H..c.n..Y|.....U#...$1.13...}p.../......y..c....S......u.o.t.6..D....@)........B.....Vm7..>..B.M.....'..7..\.f..A..P.~4...DM...|....*.{...<...)?(.rhj....Qe.....Z5......1...}.......,E.Y.. ........Wt..U..Q......a.O.z&-.5....p..[.Uy.=..y}iw./.<N.3gw..........u.?....mH.....`..K.N......+.....G.....Y...F..?h$zH..cb"x..F.Tw...$.M6!....E6..z<..?..8.i.....XxJC..Zvk*..'f.>=K(F.,t......D..HNd.geP..c.i.T......=.^@.....P...i{..Y....D..$..x.4...D. ....nT.,c\.HZ..*_.;.46.1M

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite.wUaY (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):5243146
                                                                                          Entropy (8bit):0.07334086906790116
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:bKWolkFFOKopn87ftn2+8sTWosbATH8CHAAAAAA7Lu2+PFTUOLu2+PFTUvLu2+Pt:+WoK+Kotytn2SsbJeZzOZzvZzsJ
                                                                                          MD5:A8BD3BF77089A188169921C276240C92
                                                                                          SHA1:E6E42BD296BBA66AB0763CA03C39217DEEB3361E
                                                                                          SHA-256:2C0A082A2F970ECC0EFE4AAF59956DEF570DAB09A33C799D3085F89CD34063F7
                                                                                          SHA-512:2C013C65C9856F14046D1FE3440DB368C8CF8269382A12C267454E2F7492FA376921140BD44A60CE391D3F49C4E4E538505A0D9B2D4450D07990F9D7A54F3E34
                                                                                          Malicious:false
                                                                                          Preview:.k6*g.).j.E)<....C..*..8.`##.....;.."..o...=...t`h...O..k..sU..Er.uJn.76.E.....P.N..7.W.......-?R.z.....r4.....#....R.}.r.>.E.{.(b.p7kxb_.,&~.......q2%d_..{.G9...z.M,.F....QL..bp...............[.L.@UsV..e..7.W.b1..+.......JIJ...r?\l...l....|.....w...B..s}..g.0K .b.0..3..;..b.-..L........=?g9..h.9.xBG/P.4.*.D.q_Fe@..p.X......]...e.....(.,.vl....`.$.{h.........`.....!..Z,..[...h....M......qX.Jb9pB.G."S....,..q...wH.c....e..(T.7...5W... ...nL....1.4........F.e..>..F.C?3.q...DY..i......(....h4@....^....NtC.m.q.T3....2........V....\(.....j,.XY..E...e.z..%...l.3..........>z..*Bp....i~Wb.l.;B.q.._....P+$F.....4......w%..s..QVo.....Sb..V.7v=R..,......mR.D{sQ.......3..;j[L.=.8y.._@.R.>.@.. ..,.fc.3....._...hH.....{.7.p.k.A....<..1*.P..|.].....9m..4.D.......#...j.L'%,[79..ej}9..VP...*Z.m....VyZ... .............'Ff[}.....U.3...2.S.6.~...Y...N.A8.....A.q......$..&.@ .H...H.........|@.....u.....#".1.3$.e.].g.......J.s......6.bl.....z(...&7{J=L....7.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json.atyz (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):646
                                                                                          Entropy (8bit):7.677146704312571
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:otp3V4hnu+YqDSo/h4tghiBY5IJwBAu8Ue777V5wNcnfR/OhNKyn:oxiu++iKDBYiJvvBRu6EKy
                                                                                          MD5:5DD7BD2F5E798D3F26080985A2BF29F2
                                                                                          SHA1:EE14F9628596A9C04053ECAB1F3E2B3C2928980B
                                                                                          SHA-256:F950FE9D5B4FDFF2363F5DEBC8A9F970697A95034652941F2F86F39044DEB739
                                                                                          SHA-512:5200986DA2484E2FDD083F3BB31822F4D048E727AC1F35FF46EC32408194CCED94652C1C12DF2E4F3A738032F858B84163616EEFA11F066D67D1E931D25F4000
                                                                                          Malicious:false
                                                                                          Preview:Z~'W..U.`b=.......nf.Y.*.. ..8.......C...|..y.]?.0...o......y.e.La>D..'n.D..u\........#U.*L.T...-@.l.h..+...*.#Y.f..m..7B......-~+...Y.d|p....g2......./~...K..w....g......,p...|....m.....VA.j..sR.{...j........b..Xt.5F..;4@...Z-.7o..s..4...j.....4.3:.U......[...(. .!.A..y.<0...g...B.K..P....x9<-...G..+j.}.G..B...O.@......u.)...+8z.]._.7_...;.x..~..Fated":false}..$G..C.....(.-7rr)$=..SE..0.m...,.,.`!9.......HBJmO....<g.i..@.+.....9.6.....C....6.8..4#....*....O.-....8.uOw..Y9../.T.H.c.8..,%..x..}o..,..M.C..p/......X^E....../!.5....o.>...A!..M..D.....{.(>;`....r...f..e..)[o.Bw8.n.5o.K."f.r(K\t..L?..../0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db.XWbE (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):295178
                                                                                          Entropy (8bit):0.30018052104248
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:8iDyxn/cPgXxPp+Bmg52jVaBva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vI19:Hq0iPp+ogP1zkVmvQhyn+Zoz67H
                                                                                          MD5:F42344436FD1A0B65224DB689FCE7A51
                                                                                          SHA1:6DC2CB15D20041994F7FE7211DFC4BD29CFE33AB
                                                                                          SHA-256:B2ED75A7236DE621465ED67E4301B7E5D593A963D7151F461F38B22498BC08B2
                                                                                          SHA-512:9F5AB0DA94BF5FC211E5D24EB06311E29FEA43AF9E63E4D8878483F8695530A7B994CB3077F34C4477F7C94F466D1C09BD9306041347B07BB26CE22C5538B052
                                                                                          Malicious:false
                                                                                          Preview:......?I....u.........".R..".......W|...x....r@........[...m.;y..i..X..I....?.T>.......:P.b@....<W..y....c.....CtC.V.. ...7.y.[....=8.I`iu.3.1....>{).M.%+..l.p.._.*+X*WHK6......M....P......9|.T/..... ...+.C.y.eX.!.m..<...}.e..Z6oD....9.@.g..._..YV.8q...H.......`..7.......@..0.<....Bi..L`...bf.;._J...b..U..>..K$.N..7I.._.g.,U...Qz).-'n;.......e.......L.r.4.IB.....4.{.>.G...c.'.Q-\p.4.......-.4.w..6I)..q.M.......yE-.%.S..........-{|..D.2...FDb.m...K.8..-....B`T;.`=....4..&......$.0_......M.m.....]...{..p ..m+.........X[..gd.....As.K.f.J.8..WA.m%~..:........l....w...S..E...!.:C ..Y./^..`.....]9O.V...q{.`V.ux<N7.....H......I......\...X..>..k.Zk0.O.y..XRQ..83..F_...Q.'...?o.>o3.q|8..6....c.g....Z.!. ...c......"Q.v.X..2.w.'s..`..>...;..3..3/N...XrH.J1M=.>....v...{..f.0............G=2...F.....m..F.R.... '.$/.Q.J...S......~.^...A..T.=]..>0..SgP...D..k...T.Pz.............{....x..G..$..\..U.~...)..J.B..:..w+y..d0.%.....-.Ia..S.|....{Yr...G.>...)..[

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite.Uioe (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):98570
                                                                                          Entropy (8bit):0.6580379369771284
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:SEKRHel7PATKvpysA6RoNWlC8x4DqDlGO7039ujYBjTZVK:EUlLYsA9Wn4az/W7K
                                                                                          MD5:807BCE9F9B6192A109AA5280D11F7C4E
                                                                                          SHA1:BB7A8A1182FA0E42FF7DD36F04935A531CAAC3CD
                                                                                          SHA-256:9A30CE438142FAF6401C02A7C56251B6F118A1E0C51BA31D2FE94A71889D4EF8
                                                                                          SHA-512:38044F26B1497737B517F0FFD0B67C4815449BB7A304AFBA9B121629BBFF41AF045BFDACBE88EC16EF439E9DD4C1C9460A5C7490FDA4EFDEEEE126E8E59F23CB
                                                                                          Malicious:false
                                                                                          Preview:W.Qv...h.e&yg....54.!...P..{...@.I.v.]...'+h...$.o1..@.K...#....l..X.......%0...H..=.lP9j..#.F....6..6Q|W..4.|.'.....w......^.6..b|...4....I.....T..K..8"}...(n.vV~.m...-.._=|........_....J.A.wyV..]$..e....l;...,..U...Hm.q.R..?..q.z)'A..G(~..j_..@...1.x....O..=C..*H..4.r|`..O.w..... .......9..J.. ...MP].B?..h.]D...P..^..rL...Y....wR.".F..,.$..Lf..}a..')..... .`..........g-(.F.z.4}..<4....)...+G.>4...@+xYbYP.o.....h...O...... ..(..i....u_.Vxv{...ZV......!...._j.6..0.`...7..C.1K,...v...!.7[y.....)...Mo...01..$7...+.6....=.n.7QX/.S../.<.....O.v.@y1....b.!...V...q9..do.........z.$.E...M.>n.,1.....G.gh.9...l.....7.R..d#........i){dN...[z(Y....{.%...*....9q.HR)..m.'..F...K...U.{......&1&"...`.(..0...&..VF.f%...ST..]...V..Gi.I.f.W......f...F..e..*...u.n#R.....J.}.....4...`..0G'%..rl.@).P.%.b||...o...."B(....wZ.%.1$P.x.|.......[.K.... ....B"...c..F....).`.pS,.,...L.....y....f......_...QZ...T#.P...e......VQe.Pb.4......&...m..Y.......3.=.pD.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt.joFi (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:PGP Secret Sub-key -
                                                                                          Category:dropped
                                                                                          Size (bytes):783
                                                                                          Entropy (8bit):7.747770776165886
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:w11QdqenhQ3XG4n9znMoopc7FwPkLwj0Ig4BO92gWQ/s:CQEehQ59znMoopwGkMj04B5FQ/s
                                                                                          MD5:C385299C643E4F30EEB5F6C1CC9321E0
                                                                                          SHA1:A3F2EB8EE787F0288C38A7E22AF3B0EB03C2BC6F
                                                                                          SHA-256:FD5C1912F6B7A865B5B01C6E5502D3FA4021FD6C17DB63E4E890999278179B81
                                                                                          SHA-512:E4BCF4467D3D6FA1D277A108A4FC429B72FAEAF68996ADC3C7FF45424083A79798FF2F01519BE4CE53D362BB473988DFAA53BFB97B8992380DAF6E6FA68DDC3F
                                                                                          Malicious:false
                                                                                          Preview:..2..%.W....:F..}j...Je..H.J..8....T.n..'.=<..S.9.m.S.....z.x........}...-..B..e..@H.l._tB/..&........V.Nm..sL.r..&.'..A....P.h..Mnx.....LKL.k.._...&...d.....A...[......:.q2.N...=.....,hv{A....>.......z....N..<......;.O.l..&.O.N1...W.o[....?.m...hM..N......).u.....K.@eg_.R....7X.7..W......}N..' .:.... ..A.4!...=l..G.......WF...|9.4|1...M....i.^.W/.{..R......d..r....;.)..*..a...7.hQ.+2J.....b.P....Y.QF..$..H...nw.W......Z.z..r..O...u..'V..6].......3s...!l.p...j{r..G....p94.?0.)......k..q...Tq.......=.c;.....:O.D....V.gL`......}<.7]v.~.2.a..e.1..J$.)..@..\..t....}..l.B.|._."."......J9..\.....,~..k...ED1$.B.L..3M.:...d.Z..8..!..Et...;.Wh....jE...(Jh..j$.g...]H5}.`.^..v.>....Y..2K.6...]...a{.).d......^.2R"W.....-..a..O..K3..).V...0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm.VQvE (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Public Key
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.607635551582054
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:QdmUj4UVmaJ7qttnMCiBHf+0dpwJCjiqrtTFtrH:Qdm64UsaJWMCp0doWxt5trH
                                                                                          MD5:74FAE2DF81AEA83EE433EAD294635BCA
                                                                                          SHA1:7E4245B582B65DC73CDF6D6B4EABF1A62D328FFA
                                                                                          SHA-256:157DF2F893A76D16D2C3FB8244A023C6B4BFA29EE9D463AFC580A83399F2086B
                                                                                          SHA-512:7ACCECEBB0E3CA641C6EACE9D6D4496286B223D3FBA29A62AA734F14F3FD429BD2132FD51E0D3A04A6C6BFBB75077BB35EEAB2FBFD9D53B05EC33ADB7BF32A42
                                                                                          Malicious:false
                                                                                          Preview:..s.T..C.O..67n...H..a8.~3.....h....F?..V..).5|.1......!.XYe.(|.7)..h.s..#.....w..@.."....tL..g5Wp.....3"...W..O #.[.Ip..6o?.Z...z.........p_ h.O.*..p.s...;.s.u."....C~Aw%.^.....@.......>.....s.D}.g}..M..|7y;.....+....+._.h.y.....,...........P$.....`.`...........&.....p.UG..........)......a.I.p.....) .........6%..9G.....y2_.W.l.....}M-.j...'..........3.[....../...y.@'.UhQ7....7/......`}+i&..lMR....(.V........W..z........ofl.jf..MJe_.M..g.xn........Ee.....9.<...q..V.$.f}..\.3.....=%..l.DD...W..c....V.G.9.b.ER....NW ".O?..VH...;'..R.J..0g.6G...Llx.>s2....j...D.D.. ...."..l...].....Y-!L..{.(..u|c.W.ln....0.g(|U..W..^\../.....P...5HG.u......4..c.=`.T...M...R.#.=E..A|..:'..p'.K..Jy.d.............w....B@\M....Ge.N..m..q..."CQg..I.I..p...|.FGI8...]x.+..p.<..u.o.6v..m,9.k...c......zB..Z|..#a~jI.....|..E..=....WK....._....6D.y...*` q..?...V..g.$............Ts.V.;.&..t!v.[..C.....-j..97.7|..}i..)I...dt...SZ..x../....c..b)r..;W`M...-..(....

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite.gyQi (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):5243146
                                                                                          Entropy (8bit):0.05241424789202152
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:RzJfXbZXZRzr54w0VW3xWZWdOBQFal3dQj:RzJf5ZlqVW3osUdC
                                                                                          MD5:3589620D60133C10464EECAF999070F2
                                                                                          SHA1:5AA0EBE19FDB501D0A50ECAED56C0C140829E941
                                                                                          SHA-256:018D730594D19CB597DA65810FABBD3A792FFBBACAEA604AD9A3DD10BA4971F9
                                                                                          SHA-512:3C63FBC9B9123DD45DCE9E1EDD0C9E63E42F89620CCF47678147D4311699FF3B979AF7E4720E2595639A8FDCA18A77DC7BD31669C10414010E70AE4025763A14
                                                                                          Malicious:false
                                                                                          Preview:...oA........].7G=~.Y..\P.....c.0.NO...am..o...2.....W:...|.nF.c..uQ...n.>O./{..m.Ti..]..q-.......T..S..&...E>.?.........QVO(..6J@.....e.J..!..o`....*...h......^...j..U...<......m...Fk\?...Bx...0p.....7.......:.C..>...f.....N.V,.5.o.X].3.y.-.../.0..."IE..g......e...................].p.#uM....#...B.x..'.....;........Nc!......1..5.~.".yi.O.1-?QL.<'.g.rr...cZM....5..w...W..A"....ew n..{ .d.....&0..f..\HB......G.A.t}..%..t.3.=8..... ].w"B}...\B-.+0&.xV.317.VPV.!....n....s@.4TM.`..O{...Y.....N.B.o.[...%....P...D.O...}.."k.mz.2../6.5.&.p.,..N.9g"VO.3...^^`>.{4*..z..G..-..X].S.%..O...ga.*=.........<.."].)J.g6..?..Z..V~..../...`.....d..{..[..VJ.e..a.M.c.....]yRih.j....>Zl..!.O..N.%.BK.o<..?0.3...N&...).sm..;....L..5..4.my.E{.v|....Y...b.6O..GG.!j.&.}.K....OX.b..p..D............;sH...-...f...._.OT.%q:.z...rB.\.W33..0..g.....Jj....4..g$.G..R._...w.)'..:..(.%v*.....(p..E........<.......r...v..........m"a...:ic......AA.?.......I...D."...m..py.>

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js.EoqO (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):9837
                                                                                          Entropy (8bit):7.167279232365294
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:NsUldBMIEuFKhIEkpHuRxBmycuF1qSoyaaX86KKkfGNBw8DJSlHq:NsUAfhIEsiBQuFkDumcwQ0Hq
                                                                                          MD5:4769854EA77F6517B73956A483C6D933
                                                                                          SHA1:D107656C513D8EF34C261638729A758E9A7A2571
                                                                                          SHA-256:732B236F917D4B5D7CD664B7EF85D433AF28EED43CA314C33842351BEC92EA05
                                                                                          SHA-512:3E3E25144F6C6BC4848D3C6B8BC9D3D967E2B6AB896938227B55D9611CF37AD6F5F98D53856BAE4D3F100E1DAA651C48F7F425053C940DCFA8679C4F18EE9943
                                                                                          Malicious:false
                                                                                          Preview:-...fC.e.X5O.#].%.b.......%./..<...6`au..<.-!..;..dG.?.7@w.t.0.!.....=..S...V.{......]pp.?.1...;..s]....r.p.+.....B.........sg.......'....;y.../..~...s..%.0.Z........h.N.MO\...q............{^..OO..o...9.]j.j,$.$k....3.._...G..K..^..Xg2..!l...r...5...a/.?..T}/...!....|P..ZL....vY...`.<Wh...s..?..}.6.}...M.......`...6f.2..5..lj.z.2.*LpR).a. ..P. .}89n8...j3.V..-.K...R....`....D...7.E...f6....&.........ba.C.d.%....<g.[/..Ai.az.Y.g.O...(..O.h.78..wO.&`...5..5...7r....i.k...9..`-..V.>m...\5.....?.N...J....@&...y...D............H....X.....k.(.^b..>..=..w.Z..Z.cE....[v .ze..>.W....D..$..N.:..+..F......_.*.~bsz.&r.V.........-S|.C.c.K.F./.$....U.u!. 6..0.>.....S.u....H.g....CX:t..O..S^..t....#......8.EH.U...4.'....j..7.]...+...7j.F..[W.`.z...h?..|..1:..>.Or#...}5..c.Q.*..._..8.)....8W..J.w..j../.?..A........9.F3ok.N..S_.E....,r..m...p#.....9..!@..H.`x.B.5...&.Nw..._._r..<*./%.?u`...=..i5../.....";E...Q....G.L5.....yu.9...1.\?c6.E.`>...-.Qh.?Y.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite.pPcD (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):65802
                                                                                          Entropy (8bit):0.8991905049722114
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:TBSupCvUF5q2fbf2vo0z91b7xrQdFfu9ma3pgibc+:TQ6HqAbfQn3efSmah
                                                                                          MD5:84AFB889AEFB0B7999776F6A0970DEA8
                                                                                          SHA1:8421949580AED672B8769928333C6978446AE1AF
                                                                                          SHA-256:BB7E132EAFF5A05B6C9BB382DF1D365BF9C698E28CBD27C981EA3493A908A69A
                                                                                          SHA-512:19FDDDA7047ABFC3825E0A5FE3885AA0E48DD9AD99E13AF1BFE119CBDE453D04B7593AE3A602CCDD789F92A9AF435D8A1902D6D343BC906E9E46ECCB25AEFE40
                                                                                          Malicious:false
                                                                                          Preview:ou/..ZQ..+..Z!?=.[....../}...I>..Q..*.m))p}z1..]......T.x...6l...o.I9..S.>........n..5$n...-.c.gb.6.G....@..V....K..Ws..'/_......u..42.l.Z........p.../..5a<m5t@,u/?..?.D....Y..f.....+....@.tb.j.j..@.|5>;SF....1O..bQ......y.t..........[....s....0......5&.!.f..k#...1.;..i.SDF...}.....K...I.2_...B_..o8.... ....3a..}.$...e.^.Y-..]2cX...W...K.p......&`*...d)....X......C#...h.<.=.".n......U.......G......Xk..m.v.....t.u.f;.X...lW._x..f.....q..{.H.#.].6g..oP.jR....,..s....f....a*<....G.......HH.E.Ol..nQK....:../....yC.......*....|RQ.y`V....+S....k:%L<'.3c....W*E.1...U.A...+.I..p.w...z3~..\.r.w.s...\L.57...h.=-*..l...da.).2h..b..JGn...uN..........z..&T.j.".\......x..`WL....V..P&.....u2.......$),...pHX2.D.X...x.u....5..f..j......|U...!..l.u..B.5..@....|....;..c..qj.y.9.X.....z..j5Q.G.s.L..=..]#.......f...5..^y..0..,T...|...:0...."2..j.u.f....5QV....>.......a#!;,@>....=......@..v....I;./....".R...yH..U7...^..e...0....6..g.....K....t^`F...b.....

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\45e26519-596d-41a5-b290-e547b44111fd.cmOM (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):758
                                                                                          Entropy (8bit):7.758662670794124
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:jsIf8oZBiIgXsSWZIVpPtdJT4M0o5Y8ziAGeuc/Eja6QhXDqA6TaOyka+7JMNk/q:jF8oZo2l2VJ6MEAif/gMg43FLaq7/QBl
                                                                                          MD5:255D0F4FE8FC0FA7F4CC491D692818F5
                                                                                          SHA1:68E5023C968BB01A3BCEC353B1B6E10C0B66DD9C
                                                                                          SHA-256:CC6DBBE1130EF5039E5C43F0DE7065C5CC02D39F88E73E833AD3CCC2B971BE3B
                                                                                          SHA-512:5918CA11DBF7B7DD78B044E27D0CC0BBDFEB002FE328CE2A1DD8A02866FD6F8816D90D061D3A5A636369226822C3E7D6D4E656CAC5F1A00380A7C027C31071E2
                                                                                          Malicious:false
                                                                                          Preview:..M-....@......K..x.......h.........._np....a......p)j..y....J..(........C1.......&$..0.B.....@2...Z).ta73@.).a.,.. JJ.czl.........U.n[..Si....8.......T'.^..(9S..J:~..4._w...R...A|./.D_.]$"....!Wr|..M..=..sn...o_....m.a.3".#..q...}e>.....L.......g..]..<-.m....%.n.......7...hV./85.]t..b!...2.D.`...(.\..@.=......JbO....K..o.<......<.?...<r._@.m.7.O...^.^.;.#S..s7...).].M<..g.1.......HL........lUU.9Z..V...,IC..p.zs.u...|....=;.../....9.~*==..x.^.jKx.h......<.34350de32c"}..f....$...~....'{....../S...".~....-.(%..!..Y......EW,b..t...>o.........6W.8..k...KS.y..A-..?*ui.B...X..f...1.%=. D.ef.g..P....\.".>q|xC...e'..8.,=M..?.......'.Y^C..x_..t.i..J...dIb.B%..../X.1<0f"......<....8...lPU.5.>o....3.f>nF....r...=.k"0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\6fc53411-ad83-4cf6-a5f6-905f0f3f52e8.zPtN (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):758
                                                                                          Entropy (8bit):7.659275204885763
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:mBAriU1sR1f/yCd88F5UqpJTUf1RyWg1cEeNlcIqVDUEQRSNEA0BfVJWNedID6sJ:lYRpFhXYfHyu//cIiUE3KA0Vye657Gqb
                                                                                          MD5:814526B5A09C473011555FB10385AA24
                                                                                          SHA1:5731C47C0D977F202D958567176EB966F8528FFF
                                                                                          SHA-256:CDFCE3B523725AD46A0D57D8085C692AEDBA971426FED2F39B5F9479786A5126
                                                                                          SHA-512:344EB16CC81708ADD39A7BA8E24211169756D7FB49B089F48624E715155D2493C56D41189E7AA9AF9389A89260C940959F3BAB84FF25CC9E67CC453079059C7D
                                                                                          Malicious:false
                                                                                          Preview:u."A........I.\.M.2.0.^wB.t'\BAc.....^..,....e)g.x..2-..{;e....e\.{.j.....x..<......e....`......G...C...^...m....E.'....;.C.i.w..+..S.%..j.<PmM...3.....O..).Z.J(.e..pA.....f_..e..l..3..X..h.A..#..!].J....._A....h.|...D...>xD.Z.I'V.....FSy..l./k.ZV..".1....|<_.}......5....%...r.Z...@.)!.......).~On...*b[G..;...0.!.......:.U.........c.g(I...v.|.!.........6..'..@....l.Ecv.......|...G..SS.F/._...S....R.K.6..."....\].XP!....<G..GW\.t..iZ.....*,W.@.`}<34350de32c"}.ae...I...{""._.. .........r....n.%JI.O..h~.........z...y.$...*...Zv+.0=.`...^..VY....U..;.l....m..R..N_.?.".UT....'X.}c.g.Yd,R.f.G(...r.e....>d...bIt`..c..x...c...o.W.}.........T...".b.-.lJ.....-./...?zs..~?*....?..f*E@.c...Z...;...J..t!.....Y0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\7278f154-e8f4-4235-84c5-c5c1c6af0084.Imki (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:DOS executable (COM, 0x8C-variant)
                                                                                          Category:dropped
                                                                                          Size (bytes):74436
                                                                                          Entropy (8bit):5.6101737050633735
                                                                                          Encrypted:false
                                                                                          SSDEEP:768:zZ07mMQBEL2drnJq4WJIai8UwKs+VFzFNoXzFS5Y0l:2zre3GEwKlVFzFNoXzFS5J
                                                                                          MD5:5D32F4613AEEF679F5F419419C82F091
                                                                                          SHA1:9EAE1CFF8F32078F1216CE9DF687BD4CB4440739
                                                                                          SHA-256:01BCD08B58936F893034DF87D8A3C210A67120C7F24455493EFAADD8762B386D
                                                                                          SHA-512:7A5E9E65952C42FA5A6C1FCCCA6174957ADC05D7E009CBCD8217C4C27729E4A52A9D65B6F3DF0A0B75F6D863484D010C057D2F0ECC2EFB52FAA4DDCE100B0E62
                                                                                          Malicious:false
                                                                                          Preview:.2.{.......}w...n.t..o."k3~..p#..9#.y..eg;5b.&...){..B.....JK...!.S.t?..2no;'".....-.....O.{E(e..w....Cd...BL../.N.n.S\....Gy../.Z..U...m....Vaz.+..V).d~8....3~..e.Q.._.5.s ...O6|o..L.n$.!.2.R.0.1(~.AvMl.d..Z!5.3.M..2e..H......Z...o....'..v.Z..p..C.{O........|y|-.....2....dg9.y..j.Q..9...._'..V..O..Q+..'..4cG#..A.......%.{...kt.H.3.t`.......)...........a....Q..#.&..@......2.F"..Mv.B\."...>...;...^...wf..=.t.....{.O-.U....|..4...I.......I...~IR s..b..A..y...4........+w.Q/6g\.{uR^...6...:T.Wt7Z..}...^.....}..p.b..%..O...,"..<....,.<.`.O.pt.7.......IW.8.Q.....~4~.)..J...w`..,....S.v...@..u.$......]..i..m..eH.xsT$u....E.U_.Q `$..1.J.V..p.eY.=.*..x]$.O..<(>.Um.J..e...*...x.'.1......D..b....V..!..i.Lo.K...#./&i!x......&jl..._.V$..s...{..r.0Y.....i.1v9.s4...:..g7..7f.|SS.x.{.f$.Q.2{..\.~.]."L !.........A@..%...:......q......C~'s6C..P....L6O..:..O..0.Rc.&...z.1.h.....x?.oJ..2J...2c....T..S.+.@..*..x.f"..Mf..f.mt.........O.AE..3...Fk.....4s

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4.Sbgj (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):615
                                                                                          Entropy (8bit):7.6385367737610315
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:KW9QQo1ehoJqmv/0zqTZzprlL3cM9JzHG63w3s0QuOrvBneV2D/uT/iDGzP+Hn:KW9QzIh+qmv/0zknlTFG6g3s0O9bD/Ay
                                                                                          MD5:FA45F4B129CF86A4CB4E53621882EA39
                                                                                          SHA1:C77A031DDB1A82505A42D548B1F0D8FF8235D312
                                                                                          SHA-256:176F4B73C8F6BC95CD70CDAE61B20BDB30684254EE6091F4755148E479D9601E
                                                                                          SHA-512:2CDBA7651F4328811A32A704E48460A7A162AEB6614DE21E53B5AE0F3AF1264B79B3152E13A98304CDEA8A8B7692C4F21BCBAA849606FF146CA0729BD299627D
                                                                                          Malicious:false
                                                                                          Preview:.....1...l.cNhe..f.<'cW.._l"... ...........|.....x_.z.\<...b.+..v.(1U...l&x".X2....^......4b.d....-...[....Q.B".GFK.;..N.p...a.*/.l... L.F.2......xc..!.o..Rg.R...c...R.....,T].Uc./h.w..q...[C.J.,...HSI.....1t...m.{.D.s.....^.%......*.^i.X......4.m^........UU'..38*.C.p.^.w.P.....]U...6us*.(".E.......l.l-.Y._rd....:.q......Iz..Plt"}}l..2..3g(.WaQC...E.W,....5Q..}Mr)09Z.....B.`...f[...x.5&.....-......;.V....$Z..Tusu.8....@E....D...yR..o...w.m...~|.W..mEu........`EK.............&.2..9.j... ..C.Lm..`~.......9zM....+.!m......v..V 7s.Zq...V..N.O.<<T.5..'.Y....2.^.D....x.Q....?ld0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.TQGa (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):554
                                                                                          Entropy (8bit):7.58267447445682
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:EZEGaK8/MONzpusxMynrPata6WvUYgsLz9fPXRHz2n:Ezj80ONzHWHBejxv9fP8
                                                                                          MD5:3FF7284C7E7EC64F05C5CD23FA0DC010
                                                                                          SHA1:FF82DD2D639006069748FB3087742CD950404A95
                                                                                          SHA-256:01E8F92799573CDA0692C4A263D15D4B1A6A45131D4E78F6C36C1B2EB4E78BE5
                                                                                          SHA-512:AE2EAB01C837E2858CD4492DB11A64B96319F15DC7564C8432AA4E35D8FC43DC31A070C694E65A079C39DED9556DD31C304E297A6DEB494371CB05084AA4D6FF
                                                                                          Malicious:false
                                                                                          Preview:Yn3.....mC..57KY...T+d....O>..........g.r)....9vu..d...<Q<.j...O...'..Do...m.r#5A..5.6..Z..@ni.hy..7(...q..*...3...qD..eqaf....u...K..]..1m...;n.8G....I..8.hz.......>....w..16.*q`.%....$AxI.V...*#.](.7q;.:....Q.o:.Kx......d.N..V.'s...%.^..j.m4...k^..A...y.'..=re-change":true}T...".*.m&....x.(..^H...3.\......\?"N.cU.s..;jq.=].c.v/..i..9....^Q....,.U8a.a.^.....9.x..{......2.|.3#...@.../.7d..r....|.g.-.....91..z.;..R.g.."..N.*Q%..4...N....N......u1....J.GcJD....f....F....z.1.e.....?.tU.....F......jy...&.o.0St:;.......s0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4.EqVj (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1482
                                                                                          Entropy (8bit):7.87004799249267
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:gGPiI4hzTkWqrRW80c7elK+gdSs0LvP16I0P1vr5wkh704u7rAkdllQRCQUH:gGPiIBRWkelNgdGP16f+kV04kAKcRiH
                                                                                          MD5:A147C583835B52E55C3DD6C2E990997F
                                                                                          SHA1:FE326A130DF113A3B5C72C40471DD2376464554C
                                                                                          SHA-256:209B663072B12489B281935AF1ACE04EAB7AECC8F33B4FFE18D46D303279428F
                                                                                          SHA-512:6E07B0DDE9E1C112B67112E51CC3BF058A16234FD43105F133FA4566D3D190F6D7BE5A0BA97806F3A7BC992BF1921242857FD89F3B869AD39B8BE0DF2CC676AA
                                                                                          Malicious:false
                                                                                          Preview:9T.\.Y...^-.....o^..../..Ii.....&..>U.g*N..g_.t.c...q..kM&[.....aA._.a...4./|.D6........wN?..{.T......y....X.z...._...BR.B....[.<.^dU..........ME.T..f.3}..-...2Ml.'....'..Vb.T.'1.#..=,i...<..4..Q...Q..~......:..n.pW...Ob.v./....=.X.-Bd$.p..?..z.YC/2c.@..".R.lQ....!tg.V03.^B...[.aWbv1.......1.:c@..g.I`.........U. w..l../.c.)q....w..,..A.1.8oZ.&.)4.}=...VY...9.....u/A..!|Lh.b/.Ue...1....H.....p....../...y.....B...'=...?..@..n.F.,..b.^-...-6.....#\....Q.Jj..9....X.f-{.o.h.... .m...._L..(...M3.=.c........xp...."...c..m.6._..0...8.=".\.F..i.$..0.l._.........V.xkQ..P..K....{8&1 7.[.\.,.....4......C./...c....-.?p*bH.......'g..?_F.Mu._..~.fz.m...N.54....r...5.R.............{.......6....$......O..Pf..l._..|..[....`Y...2V....]."E.D....i..s.i....9.1.)(Z5w...M..To.rA.]O.\.....w3..7...*6....+.....f...].......6.B....qhg,..D..,..c....U..Og......y_...#W{5\..>O..>'....\....q]!.2P..g.o.H.!.C...>..'..._..P.I6\......2....T...,r...]..;<.nl...7.J....%

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528.qXnV (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):4681
                                                                                          Entropy (8bit):7.947504457521908
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:tHAd1qwKvZqNXO6E0SXPoWyed+0mnI2UpIIbXBvzbFYSEwOQCsc6MwT:hbHkNXO6E0SXAWVdISqaRvzpiPlS
                                                                                          MD5:E82C15075E61EAEEF631D1AD452F90A2
                                                                                          SHA1:99062FEC2B4BC044A03D6D18E25B60824853093F
                                                                                          SHA-256:E41F8F393ABC5313CE163FD632A3F687A6D29786D08E8A4E43C796D6D729A752
                                                                                          SHA-512:9F7ED6F6560E6FF7A338AFE130D7B0E500A40CB1C9A4BCE4441B761D44C5C6A6EDA8812A0FC804F6F346469C982EB326A1F88816D91847E9F64C9781F0BEF0B9
                                                                                          Malicious:false
                                                                                          Preview:.l?.;.x.-q....:.-....Qy.h@M+C...j.i.V....0t.._Gb.<.....:..A...H..B.....j..3...qq.?_4..1.;.L.]...~.-yD-.m.4P.|..3...Yf....(.W..)..Rw...j.].......C...........]....o.{MfK.^(.P......{+.....<.M..2Aj.B...k.../...V".t......M.TV^.q9.R....{D.'wTb..}...x*D.aE.~....>."O.fXf2....3............U.I.......0J.S.......g~.d6.t...... .1.aQ5h.st...4.............=.?/..=..E..a...UO.&....#.".u{..i../-.'}.....t@...YgP.9s..+Y...`m..>B$G.N..]..$4..2\.....q:B.k..z..\.G...9.g=.[...%A4F.^|...?*&T-b}......(..%.t9...f.N{Et.Yy..^.P."..{.6.BU..;..K.h1..'Ce2r....%@.x..$b7fL..n74....3....g&N.).<R.e....L....2...~..@.sG. .....@.....i...}..JAC3.iS.b.)..n.0.!.k..D..m.#.W....}_Q...=:.xT=....?.<..30.&.3*u.;.;sym1V..I.^.B....o%Tv^.....g'E......D.,..T...`..+.G.zF..|...K-z.....9&}.....}$...n._.L.r............_....iH..A....h.Z...w.C...f|P...C...v7.......`..u........o.t...NZ.Fi.M.G..8.D*..].x_...Jn.!m.U.E...h.;z:...,@....m.O...S..-$..`9..(....L..........wvW..RY.`.Jc...[...

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4.ZlgP (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1484
                                                                                          Entropy (8bit):7.865389087317041
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:JTbTvi3sFZ2WZSfkVmAU9emoBazt3Jzk01M8w2n74J31Iarxq9m:5TLBnVmA2N2Kt3dk01jw274J3149m
                                                                                          MD5:1B5D9D866ED890E893D2AC185ED81C08
                                                                                          SHA1:903D778F8CF7643266E0EC4B24298B698E155B3E
                                                                                          SHA-256:B813CA2429CBFF5BAD70FF4A2D3509A030431FB82C7CB443BB66D9C78B4082FD
                                                                                          SHA-512:A0BE1ED06DFCD69738D7E4C9F70BCDA6B61B087326EAF89DBBD97385CF691D103A677E5B9016FD2B204A8AC8199783690650654DAB8E7859F580C076EFD4990C
                                                                                          Malicious:false
                                                                                          Preview:...w.....Eb.@..z.....f...%..q....UiP5.W.....9.*.....[..t.TU..iJ.#._%m.,....4.*....%;......h.mrv9..!..D....j3...{..m>.(...'.c..%A..=#E..... ..jN....{.....'.9.......s2.3*D.M.W_nH...~.2.Z..H4.&.~.~.....*.,..!..........X....C.^..j].......,....U...Msv..m...,..4.%y.O..*r../...n......<....y[.R'.......2.........B{....|...0._B.%.gR..$...D.r).r..m...].....GC.b.gD.H...=...i..2K......mG.i..;9.P.w......wvH..N8.o'.........5L....Vr..[.......b....g..%Y7......M.~4.3'NW-.x.....[M.....F.[T=....C......i..... .y4.<.o>...qy.^,..A.......|@.[y.^......[}|.P..0.t>..bi....>.....K.e..W .>../...z..."..|..(.yU#.....hI...$ea#0yimf...D .....h..4.U._K....)NEl...>....GE.......H2D...vY..n.|^..R,.o..0#....B.R.G....8m,.........R......i.H.V.f.z.'..../..gIrp...zc.+..9.Cs..S!tR<...Z.+....W.I>.Xd.......<.$....Q....*h.iJ...X(.N0._8r.).N]RH.......'.td.=1le.3.Cj....x..5....../..PN...|....H.yqQ.Q.:..C....PtW.H.K.C..../.V..b.U?m8.C.5...|.|9..`:\........H....!.....l.9..`/.g.f%....G....

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json.vfpO (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):284
                                                                                          Entropy (8bit):7.247711677586645
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:8L1oDarNb7h3wtemPqprPBIqa7de1fMqkfD8Yl0f5n:XDULAIzrb1kfD8I0Bn
                                                                                          MD5:3BAD010FF97721A6479B9A4ED053A8E3
                                                                                          SHA1:3FBD4EC78492485E5147337912FCAA09CE8CA627
                                                                                          SHA-256:558BC2E7CF2DDB5A8F457732BF0334F9192CA8C3F1525BB20D6138974E8418F1
                                                                                          SHA-512:C3C4A9B411957866800013579D831269AF5EF8BBB118E6A19353678733162106D41E4F13578628501F1919BE00706544BD8588CA1EA495BF23FF2D5166ADC4AA
                                                                                          Malicious:false
                                                                                          Preview:..3u..{OQ.[.~Wt}}.qg&...[....r.B....m.....q.X.A..H....0..k.i....Y.... .Q.........^UEk.L.}_BY..(.S.H.l..K-C...L..7.....r.......MMR9........q.....*....?Z..Y.s{.5..+....g...0.c....Yl./.W..[...o....D...<....E....K..7F.d.b...s(@.:.._.......DX./......0....&..].9.0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite.qKTx (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):4362
                                                                                          Entropy (8bit):7.954641231084235
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:JCEu+U+mkZ2gMT7wZz43Jzn78WRJaorzT:JrmkUF/wC3x4WRJaorX
                                                                                          MD5:69D247EB582F33724C19B5B04DF915A4
                                                                                          SHA1:6D39093958EDB526AB28F65B0C7B77030F43C020
                                                                                          SHA-256:9754BF664822EBAA82CE958F958387F4FA36DE001593552B47B998A03A437DF4
                                                                                          SHA-512:E6494476918731F323685B8A78851C7FADD9BCDCBDF6BCF1543FE24CBF57A4D90D73C3C0653704AAA2910F89C6AD02B332D51B52C9DA82FEFF4DD7B9FC115D35
                                                                                          Malicious:false
                                                                                          Preview:..'x.je...l.|......I.....%.......o...S>2..g.>.Y.9@..[.......u..Q0.g)...*......I...M.\...'.y$a_...g(.q....9.N"A9..~..?.5..A....O..e/>l..qH.....G.D....r....qM...A........y.\.1Z......r.x...t.1.V.Y.TU.G.`.~r.......f.j..8l....7..1..7.^..l...uo.7,.g.S.......O..:~y.[..y....W2Q...;..e..h..........p...P'.)bKZ..../."..G...!ut....;c....o.....]...4Q.....E....<_..3......W.-o6.zC(nl.........,..I.C:VPu.=E...BD........(!....Zk.S.vz..6.]...b......X.,.'.Ql$.B.'.4..>.dM.P.:..Z&.[;.........h.Fp+....&.H.p...~..Yy..,S...:.......G.7...gK.%.5.?..2...(...D5.b.S.Y..3......yE..T>..t.+L.{....U...]+...)..]..~.8...^..6..v.Bp.Hp.^...O...d+l....dh7..]....K..p..cx.22 .q!~...N.R..4...2..m7..z.A.B..Q-../.....8...!.............8.bH.+.P.#.vJ.{.Ih..^"RvTE..q..!.K..ai'.2._....kXMI.....o.R.i6....(..E?.Q..Jc...e.<.y.dX....;t.....ez..BH=>...T.-.ek..y>l.<.u.~.?...Gi...\dm.c..A|.<y_..^PE..:..7.e....i&VTS}..M........Q.W..V.....%../.e.M....DlU.c..*W(...a.;.H.3w..L..nb.i..0....J

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite.ElJF (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):131338
                                                                                          Entropy (8bit):0.5078382965045062
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:R6NJ2G1sLGMlCONhxdLFR5tbddJYcgCavdM0LpPB304V8snNgaa:R6fhaaMlxhPXHbzJYPCalM0L1Ha
                                                                                          MD5:F097632E580C4B9163BF7E58D3958000
                                                                                          SHA1:71B64A5641408C14ADF11C358660A608B2A0711B
                                                                                          SHA-256:D551F513549B498FB4F98E481A70A2ACA7AA262BFD143CC9A41613339695647F
                                                                                          SHA-512:B8335CA404CDD7F6990A451527A3A512D338EE44AB89C5CAAA1F41FCD3BF113A973FB44954E734B65DA7EC1F88CDC985CA8D39F9CAB2A43988370385775C1279
                                                                                          Malicious:false
                                                                                          Preview:.v{?-2.:...#.:..sE.?...../}.&..S.h.P..IO.1C-.v.....T...'y>Od...J.|..J+.a..........-L..d..*.....f.T........=...w}..%...4C.+.9..........D.S..<......^.`..71..7.A.B.....w..../...`$..?O.C|C$.;&S!.D....o.xl..*..X...%......|_.z.D.[.w.C..X..F{.7..>8....U.-..........f.g.ao6.o.........^..`(*G..Z...L.h..-..3[.W.67..F....IO.KZy.......#9np%'....Q.....].0k....."O..h..R.e.....<.....{..U.Z.......+..W...........t..U....S../.........)...:...$...]z..K*S.~ ..A|....".n.!:..0.]U......?.^i...xWU..d........_...f".q.P..+.d.....frr..vf.L..UH.&.. .5..!........V[...OCG{[..rT...p*E1.ff&...v...]......F.../gK.zB...,w.$E/..@.s~.X>9....FO.....-&.0;..;.g..}.w..T....}.....{...?.........I.P...J.xs5."=j........?..W....[ .W..P....J.A`..x.]zaH6H2.....3hn.{C...EC4.<.Uk }.lj...).2[.*y...Fx..@......u..O1.BW..:.C4..o2.4..c...S.b...W...._...`..C..;A.~++A.*..}d.1Tb.F..CNW.tz...~p..z.......jI1..`-.]l#i..9.Wh.3...5*.h...n..~.....!..U1>u..3;K.5`.V....mAm.N*...+.......!..k...>..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\.metadata-v2.FdXN (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):302
                                                                                          Entropy (8bit):7.254593419750205
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:4Zn7n8qAlAAOULWfP7/21lidLxX/iJHnSvNVVI71BOmuQi+n:4ZAqAZW3z2vGNVVKXRuan
                                                                                          MD5:470A8A7B9DE9E718D51179060A82ACA4
                                                                                          SHA1:FD5E63359228FF1691D785DEF5F9DACD9AC0FF44
                                                                                          SHA-256:EE7F4A49E87DCC6456FA47A9638AFAB8D3BB32A479C7C8B7DA137A284328CE48
                                                                                          SHA-512:64E69C3C4EBD34DC00C868B6034DDC6BEC74CF51760F731C41CFA3879823F92D8E7A8B1E23BD1137BB4E1C2B4F94469839B8160416EE3A6A991C267F03FE7E4E
                                                                                          Malicious:false
                                                                                          Preview:."....qB(...,%...K.....f....0pome...w.....V~....K. )..#..=..\i.<c...L...m...oi..(s.Z..@..Z.L.......o.B.A.]~....#;....hc..uG.....H9.....(.',.-=!.bJ.1F...Hc; v.z.V...........!Fi.bs...6;E.xZ.bdte..........?O6..\.5?.kB........\....n...Jq"..E....~.....7K5....3.h9.......>..H9.q0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.Cjud (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.6105299555770998
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:6crCczsyMOJyIELQV524qW2UsSNH/Ixy5/jtZvLrKLLJVtGID2h:6IpBMWOZiNQy5/jTyLdVah
                                                                                          MD5:1AD1630BEA57D42A919C7AFE097EBB3C
                                                                                          SHA1:F231B78E6BBCAB53D1B7A1968ABDD528863B8707
                                                                                          SHA-256:867D46535022CCBADCF960E18209E3EBB7F9DCE478FB2F32250B8FE3F9F8A9D8
                                                                                          SHA-512:859F4B7AF49FC2FA16BD27E09BBD9DE38E6BEEB1E9366470FD39B1EE1B4BD3D6EC546363B4F6A5908F52D7037358CF404C9751E1C7C084A67179A7C1B50E77CF
                                                                                          Malicious:false
                                                                                          Preview:.q...i.L..^..b`E..4..9.`Z.Y.....z....B:..L..........%.P.+.k..k4.^<...e......7..0;..Z......!...p....L....u.c.<w...}.bq.1.$..N./...=.>..Z,.!O...}.........#[..;{...a.^%....5.k...K.-.u.{.'Rj.A.vR.....-.lh.s..._.h....;..S6..9.....y.../.........v.wz.I.%...../v.M...4....[a_...Q...@..X..._..l. .Wv.e..m7.Z...k...X<.7.).....5.x*m..Y...-.&o....F.A..i...I..KvG.].p.+..^R.E.&...!%.3..._+g...H'.."...yck.D./.|S.t.>.-....,.;A.p....u$...uMK\....@.mo.b9...2V..z.....c..b....i.0.Q'. ..5-.m.?.......B.>o..ZGz.:..T..D._....N...x~q+...qJ..>.....$H8'..+.kI.F.=w2.{N......DCFX....%..",.wd...*..#...{.I...H...x.$?}fP...AU......:ch.+.Y..S..pD....G.;r}.....F..f.a`..7@..'NhB....k.ez....8..v.-u...+w.....J.H....(5.__Z.....T/..i}O.jt(.[..nM."gxg....3......Q..\ e9...Bk...#..z..6....L..R.g_....>/Hz.. `~o..<...L.<....lP}.wj...x w&.N&..`....wI..y........xS....c..JP....'_dF.....~.6..z@.(.\B.).a/.#d3..@U...{.....9Q..S.........A..&.......4..Y....^\W>.M.....t......].5...w..}

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.nIZe (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):49418
                                                                                          Entropy (8bit):1.1558058422774429
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:x+KlxFSq6ePIndEvhCl8kbL8S5UcrFsgMqu+6jDZUP+iwXem:XJZzClLL/r6jDicXem
                                                                                          MD5:FAD31A06B3C7BF7AF7B75E2F04B3F5B0
                                                                                          SHA1:1C3271B9096D13E773C16A374EA3A4314F58D1DD
                                                                                          SHA-256:DDA3E3764AB05929DDDF5F1F6E89384563181B614E5AA5848375C0D99038E759
                                                                                          SHA-512:99FA9062C54E82E6DA7D62193FB82F8BA6518DE2311471C3A9BB68D88E85A197234F74D127C455C26AE82E88B862116FA29C13CE8E0E3B5D674415B10A65C997
                                                                                          Malicious:false
                                                                                          Preview:....Y.*.Ph....~..s.F./.7...f..0>...h;....;.K.....R....,..n.0...q~...o..M..[..F?o.[E#..~.X.M...e5...RF.1D..L..(.D.?.....`..c.......L...m&.dH./....M.....E.I...7a..(7..i.A....I..^.&.=.....>..F..!M~..G....0...q..O........9pY.s.....[G.n-..W.gjo.V......).j.V.>.z.V.0.n...y.).;.b%.O....T7.HI.v,A..fo..M[F.9..r..w;.$4@....&....C.f.P.5....q..99).n.....+m...Xi.+&..w.K|-F,.t.f~r._.y...P.?A.E.......k.....D.$.m......;.....Z....A'D..].R.....*..T. 8.l..(.....B.W&...(...&Z.\....K.3.F.....;.}t...Fr..Y.c..%..J?..&.?.8.2* .y...4Q...>..I.4.....E/.."1.].k..W.L....P`Y(.P.^S...~M.d.;....b....}<\.....C.QJ..F.......!..."..@.f.I.h..D^.I...w......@..fk^`..b.>..B;.. 9...s}.v.[........e.i>z1S.lt.?.\......&.".R..+.H....tL........i.....b.9..A.....!.R..Rl.. ..R2.?...5k1.$.../.v..s.#y.B.....s..\d.........Rm!.'.].........W......~.....6.^....^=tgl..R o....Z.8....R'..rE@A.'...x..&ezD...6.W.U..>..o./J...H...-)...vuWy.09.........N.Wg...^....:.......2...."[0.. ..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm.HVvO (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.6073680045020615
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:WuChcKN0BTHcNgCX5T0UZfh3Wny5h5+tj4GGkCxhn3ZqviA:WurHcNg+TdhGnihk94GAv3ZsiA
                                                                                          MD5:A2F4F82345E09C5B0A194F77EC5A05FF
                                                                                          SHA1:FA402BF7A7981024BDAF38094B140B5E781EE67D
                                                                                          SHA-256:821B923C64DB0B62F8E6F1A003FDE52C2D2C94671A4FF441CC23B83789FFAEB2
                                                                                          SHA-512:972A2F8BA7FAD7DCB15DDF14A3A2C13196D6B74A0198B630DF50CD8BF2E7E4078BA30480160EAD5D23E898EBF8DA53FCAF4111FF88609962B203383A355E917A
                                                                                          Malicious:false
                                                                                          Preview:.$...u.....y.......{..6ef.3....0Sxf...+...x.......{LLwf.."C.\X...<...$L`...:...W...........E...Y...[8.....\wK...at........Y0.,.H.{..<eU_.XOr.@...SU7.'[....`w...Cl2.{;~..A....9Xu..>.!RC....w...hq..-0...*^.8..i|?.\.:..,..q..n.8.U..]M2..."@.Ftj0g9..5..vl..R.D....|.......=....~p..(.o.I.......@.lZ..A.)...}....h...).k...F....p0...4...Qh|..t.....>.e.e9w..it...{.A.F.%\..F.K6....j.#.L.....<.c5s(E.W.z(.j>..0 ....,D...*..m..n....b.t........1+Am.%@.`......?..Z.l.7F.Z.&..?.....EYl.....z..E.......>.r..u.z......:.'.S......jJ,B..=.#]....G...6.E.Fj.).....,*..j...!F...}W1.....^..f.B.%..*...w\..U...............F.......q..1.*.6.N....:A. .".uq..6.5].l?....fq.f.&P........x. ..+..c.z$).|./....#..!...>Xr.X...I:9./#.9]....~.;t.d.A)iH..S.......WC.......V5.Zg.......F..o.).%.......sG....v..R....].@".8..Ml.Me...h.a...7^t.7A82._.|;...(..A.A....'...S.C.......0l.+....p..f%...H.c...(..U.:fy.J#.[...X..8........9......$P1CfC.FYjLzaL..(6....fU...D.9...W...)...P..#.i.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.EqCM (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):49418
                                                                                          Entropy (8bit):1.1780507547658536
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:ov17z/SX+3NN9sBmUp4+yPurL7GEhWMcP6u7Ctp3zKQaeyIlx:gXdN9/N+bjAvJE3DaeyIz
                                                                                          MD5:6CBA1F2FEED9911388372AB1B0995DF8
                                                                                          SHA1:E7B56DA89158CDDDF13937E6D29F7FD0F052D24F
                                                                                          SHA-256:9CA649CC5D9DA290B14A5888198C5218307D215BF1B651CC549457426C47BF9B
                                                                                          SHA-512:24FDFB7D25594B5364CC8231736CBE50AA083671904CD152282B5B3CF65EF07C80ADF399AB74B451F392D244F48F198594810795AE6D9B4993D073C7D94A666A
                                                                                          Malicious:false
                                                                                          Preview:.U.>.~..p......{.M+W.........ko....)..2...q.#.:.....)..).Nj[.......p.'....9[..E..M...g..].......y....6.h..?Q..<.Z.{.......I......C?..}.%c.F...;.+1........F......!.L.x..s{.IK|.].uA..m..=;.....|R.Q..9...C..T......83.C^...8.2|....A...^..I..b...B..g.....Y../......$U>.:.=.{..R..<P..)Z7 .,..6.<.R.....0@......,..\(.x...q.-Y?!......;*..n.4.fH4&f..r.--.>...jT........l.;....}.r J..9.......nq..+].>..........8...E.C.G.. 0.."x..XGY.\..-..J.....#>...I..m.Ls.C..Y..f. GY5.U....5...@w..(...w.............|E].";..Ie..e..L...(.`..y..Y...Z...}....B."...z../....6.On..H.qW!...C......4..s.Sx..\tc..|.gESG..b)1.....I.Rp4...7.l..{...#R.C..F..L...U@@A`.|1....r..,.<..+7PrQ9.{..........o,nh[h.k...O+..xr....&Rg.......1E1...9VY......t.J.*..xS.f...\7..&(A..X.@...._.%Vz.e..='"~.z..Pa.:f.Jp2<X..".C...e.b.e...`..jR...u..,.GgC.9..?.#....N...DD.F..BS8=..7..j...,6..`w.U..&.....E....WO.C..D.|L....!..IL>."..F4.~.X../..`9............g.p.;...Hx.....Rf8,n...?.:; P.S6..K.W...co....#..L

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.bWcr (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.6080393698775075
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:anW4vpQ77mw5K5Gx6mFAhLOtEWcjszphQ0FGT7ewXVzZ:Vj77j2GghLOtEWfzrzqec1Z
                                                                                          MD5:C1644F5E0DB6635DC25A9A9DFCC258AD
                                                                                          SHA1:1AF83556184D4439CD14A83D6E9FBC0601277117
                                                                                          SHA-256:1EB5B2CE48EDC2D0CA4769E56FB720B8B2EFDF1DD3E52E817462F8B52BC67D6E
                                                                                          SHA-512:4C2C14950E49257937ADE823F584F48858F32F7A79C3DC958E25ED640CF3AABD00F847C2E7C555EE0160B7069D5716045F1D889E28BD803C9670763C8DDDC591
                                                                                          Malicious:false
                                                                                          Preview:.o.\...+..-.Y&Om.v....%n..... .1}..o`.?vO.[.k.2..A...4...Gs...Jl>....L..Z^.]^.(.[.fC.Y...KJ......:....S.Z.x|>..l~{.e.5....u..M..k.`hh..|..H....z..i.3.|P........1i...b7....n.hX.,p....F...jHc....@..`.D.._P.Q)7.r....... .....i........N. ...n.^.G....pIT...W.3b.\.GP...I...X.-.. ..(...iv5C.)..<N..<CSN...$..3..m......9...~...=..S..RI."..A.Mz.)......%.._.H..".}?~.L..&.{..Y.o*&."6.n.J.........e...............V..."...U.j.s!8.@_./Fx...L.R.S.L...........>l..z..+.,......L"..De....|.$B?.k..iO.;.3....X......rX.p..X.'6.s+^..#1....n.....fv+.1 '....t.GY..;....i...^e^..O$"....j.......v.............n.`.&.O..;..)..5.p}D........5.. I...U....z..y.Md.l!E^.W.&....z,!C.[0.....-..hV\.dcN.H/.W:...O.Hx~<.\..P..L.:A8..........f.$.@2$".*"`5.`4...,.8<.I..}...TC.d...[G-.....0..f..].e....>qD..c..;..(.@?.....>.n....E.[)...xv..dR.<.....Iv>....P.N....>|..NO.l........F.>.../e.mY#h....S..T......#Qe(A-....4...........>...Y.j....`.[..>........<6.=....D'.Y.....A.7..c..u.......|.<.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.XybN (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):49418
                                                                                          Entropy (8bit):1.1538112478602425
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:h17B0+kbB9xy/9ow7R4UYuPt6MBqUbehJdhGIuBcYI5sFX:Dd0+g9xYow7R4DuP4hRuWA
                                                                                          MD5:BFC379C8B5055119852B8B2B8D150888
                                                                                          SHA1:FC42163AFABDD38B4E2181231C07ADCCD1EF7017
                                                                                          SHA-256:C8ABE2E536A5A37848AEA07A1CD3ADCC6056284D2D233CF538AD0C37C68A7072
                                                                                          SHA-512:9F110CC50F0B3DA35AB611C3093FE7F164DAEFFAC1874FB9095E0DB23EF7CCE62922320822A645C39C792092B1954D5360D2C02E6974744FB4BEFCDB8D5B669A
                                                                                          Malicious:false
                                                                                          Preview:.. ..3>i...].6.n_..!:>.L..0.0+z0*K..j._g..!09.u..@...v.Ho.+..9.+......Zt.K.P.._....b9....6"..B....0.2..J.Ru..%..J..2...q...{......a.Y...E...p.6.5.+.L.........1...t.DM=..zH.)E...>.6.SK.S.6........8p..y./.m....l...l..3.p:hr.f..(x...h....}._..t..t..........c...+...B...j;.........'c....!Xh;.....y+.....kR5v5..g..ezB..1..W..+..qk.GY.........2Pc.....>..(..Cf..n.....}..U./.L..Z).....D..0....Q..p..w......&.p..r.\ "g.......~......\.s\.]>..s..........sT{Q........".]....7........\j.C<V...Up.3.....2.v.............0.`.a{.=HV)w.nP....a..}r$j...._3..V......@.n....N. j....8.-k.VL...:...e.LC&B7....B....t..`PD(Cieg.].....~.T)+DDJ.G@Q.?.>.".(../m.p....x.T..%..........f...$..1..e........<&tO......`N.H....'........Z|..wU....v./xn.M.....x$;.......`.P......5F...+m....o.A......0..$...?.|.>./Mu.r..!..x..x.=+.t.Up...)..2..5..rz.i=6C..x...g..,#.T<...ow..u.|P........,f...m....w.......!..#........./.nZ.FT..}".k......Z2..8Z+..2)/g.....M.I90....%.N...l....1)..v?

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.WtYC (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.6083749343394051
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:QFnPabSUWBwVWvn7TRfmjYMjM9kl8+phH0l2+S8Dk:Oy+UIwkTwjMal8+/H0lS8I
                                                                                          MD5:415CF61E087ECC647614FA9FA646E497
                                                                                          SHA1:B5B438243DBAB876A08418511C4DBC399A9F4067
                                                                                          SHA-256:52D897C08E090282991DEB197912D438D95233C6E79B517874022EC77598E9D6
                                                                                          SHA-512:098D3EFDB2A507B615E7725872A5D3E0997CE3A31393D3EE04E12D3EDBA5CB72BD88431674A277520FF94157E5BD576A2EACC393598168598BFDD69FF0721017
                                                                                          Malicious:false
                                                                                          Preview:..N.`..RF}..;".l....>..9.z.Z...A.f...&..........._.Ll?.ZX1J.....yCuyL....l.. .....b....y..].<b.^.<..(4.!.iV..}...........kjU..z....3.../Q....3.O....."~p...T..........oK...b..9?...Q...3{,.7a&z....vn....r..A)..!..ta.,I..oU.......N..&..J.. .....~....y.f.V.w]....1..l~U..?F.....@n...[...s..H..g.e..$.z.D.'=...k.......[..BV}2...JF......*`!_.......:.n...T}A.<.C.>.X.c|'..F.....U..~|....A...9...2.d.R...o=......A...3@hx.....g5Q.B(/D?...._$2o..C.yhu.....1.{s..X...... V..+..U9.~kx...Dq&M.)..T.q..qU......n.Yz...us}H.3.......~....`7/ sJZZl7.+..q.hD@........THl~(...p.p.)..$...z.1%^....l..u.oqv....o..*s.m\.;.}..).i....b..F.4...Z.-...oH......A.....4.o....!....LL..3....\..^6m.....Z.......0.i.v.<.`c..'.P.[.....O...3f...yfI.!...ZC...O..Gs...>.......Ro.l....U.Q@.......6.!..](N)"b...m7y.F...*N...>-{c...k...o)=..[....]k.........0.-./.$?7u6..<R."]N.V....[....E......B..Z.jw.,...g...f..._.....0s..Fa.].+;..`q.LR....Jf9K...U. (....e...$m/.D.l/\:.;B....s.,;..~4..2c

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.JKhA (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):49418
                                                                                          Entropy (8bit):1.181659436203414
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:S04FIw47x6akDWmIt8QUTss+YEUTDcWLRNV:1oINrkNFeWLl
                                                                                          MD5:9DBAD88BE0C2F96488E327BA864A6EAB
                                                                                          SHA1:8995BA60078623D257B7F7F7844E0F29B7A7B56E
                                                                                          SHA-256:0827FA6A62A449FD97DB641497F2B74A79376C55C1BAC94230F04833999FCAB1
                                                                                          SHA-512:5122D278CBB6A67A45818878893EB7817866849D482F913AEEFAD7D7AFA22BCCBCD9911AD4077E501EE5169F3ECBF8C66C6CD6AC49214976659D99D03741A69A
                                                                                          Malicious:false
                                                                                          Preview:.....b*.......XxJ..<M.4..........|C.d..{Fk.....f0....o..rs@.o....u.7....5.?b$..pI*.].:|.<..n....kg..!.Y.U......./D..f..u*.$|$.&Z.......[aa..n.`~..4......f.b..ZH7@./U=.gh.ng.0FP+.,.....>eN..i.X..P..d..Z.......I..........]?.h.4.....u.....I.....O"7T......+.te...[P..._......6.u:. .......=.F.H..%S.@.s\..-f..dS9.b.....s.--..).k.)}...nXd.6.......+...P..&.M...=.0.k._.........&f...$L..GHaF.*I.............*.G!.j..8.g.3.m..l....r...c...3...Eu..:-&..|p:Z..g4v.p...T...o...fRhn....d.IZ.;.pg..66%=..H......6..H..j.oi.L......H..P......^uk.\+f..d.-.J..J00/~.".o..._..~...t.2..\..%._.y..J=(.Fm.u6.6t....H..I..J.E^.....V...~..y...^...nX1..<.K.G..............?d..@..N..LN.`...<....*...._.........#.g..'.~.'r#....g........u#.Y....L.h..^.4.4...$.Qy...K....)i0.F..n&...nb>/.....0...d..|....h.....Lq......oP....F....w.Y.-.V.c7-..X... .g.K.#..(...*v..|.OpX."x..vcJZ...J......G...CT...3F.y[.rm..<`)..y....a.`WL.....}i@.M.k[..$K..OQ....:eN.....;3....2N8.w............

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm.BEef (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.608007095398162
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:0fnPjJxZQznbd+dluq/gBgOm0x8lP3tgPFk3FO:0f7bZ+Evd2fgtvFO
                                                                                          MD5:0276965D000ADE139AF53B171130FCD7
                                                                                          SHA1:7B9FCCA188E91785C9A3CEFD4FB0DB73A38177CC
                                                                                          SHA-256:66E6FA74E3E5612A77F07165F430508F25A1A133C8C41FF639FB0ADD67163530
                                                                                          SHA-512:C20423E570C3C108CE231C2DC29476027B7A9FA67DABA652AFDFB20D4523303057E29AFC8C11CF3963ECDF4A464A41F433CF3A7B7277A90D4EC04307B7BEC101
                                                                                          Malicious:false
                                                                                          Preview:.8._/.1.......a.mg..j..l.-...9BF=.....Ze....l.W.o.(tO(T..Q..G...*)......zG#.-...&..XiQoA..;....G../...zc._.q.'...m..^!.....p..2.83...........&.....>...{8c1E.&..|k.H...-u3l...v~)...z.y...:&!.`..T.r.;%...+p.of.nG:..B..7.....=$......eP.%Rz.tF...^}..-.G...Q}...T\%..4.C..8W.]33.@[..B..t4o..s.s...1..Q.M..tf.5>Mv.n.......e...t......_$mKp...............I:Kx...KWA.Z.LL..BNBu....J......&.....2.......x.l..7G....4..%.%.rXve....v.l....Ih..y..NZ.-.....M.i...c...:x.?H........E.}<1.P...j..._cw}...u....iX...x$.Hh\.+w.D...(..3T.......}.5....\S.S9.O.N..|K.'*.-.w%...b1cXD..y~.l'..:...0 .Mr\.hs.q.ct...lk.@.e.+......R..[cb.-.?..{.....7. ...M.*dRGQ..r%..[..w....^...8....'3.D.w..0|#.?..<.*..c3.uX.q.uT.uu...D..M..Z..J.Z.?.l......\....%;..C....>.........vy.sE..r...5....8.y......F.&..p......E.e...(.+..3..L.-.B.....\....uNT.2.}.d%.WY.6..K....I.&h...\..P.........:X.......Hc....'...W;KB>+6Tk...G.[.d |..=..Hj.............5.............uA.i.......^E6..O...\........Y.zu;j.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.vSrH (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):49418
                                                                                          Entropy (8bit):1.1548478938116005
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:rqagQ+2XqUp3HHDLc05fUOfXo8RbZblXEXxiz1tf:rtguaUJDLckP3RtRWxiptf
                                                                                          MD5:34B3E84B26351028EBB1B33D6B5321BD
                                                                                          SHA1:A2AF2BAFBEB6365B5DAB0943B6A9B4EBD190A25E
                                                                                          SHA-256:7978AE0E2634FF7E62B3B72A6A2DDEA6B6148C5C82F184670FF6F519CF70E161
                                                                                          SHA-512:64D31DE1637B52736CF469CD0BB9E8D7C4E75059EBECF647A92C2299B64213C770F66FF08ABA14B06B4CADD9D1ED56D15DDD183A824F811A8560841C45CFD481
                                                                                          Malicious:false
                                                                                          Preview:;.k=....+&.?*.9.q.B......)..T.J......"4.R9.Z2.........k...j....\K...*..u#..Y.p._....F..>-..#..k..Q. ..rKeX.t....n.J.."Ho....[(..[...&CX.-dw.,.Q........A..q3y>e7.F..F?.0...c.N.#.+...T=..V..wwX.#./......wE.$...r....8.o..iW.<...t...A.2...-..r3`B.R,X.. .}f..?..2'..k.E.......-:W..}l. .Y-.....E..X...u.)..2~]b.#c\~w.,.G.. ..4B..S.3.~J.-f.s..\.....!.....7..g>..h5.$6i9.&t....w4k..a.l..g.5...C......&..\a.v.w.%k..4eR...#.n.0.j.!u.<e....;....'|...h+....c..H....p....Q...m..~......!..`.....O_p.WS<.@R7..`D..~..x.....=..J'&....P.d.;s..WI.W2..d.-.....s..da.J.].6W.,.agT...,*e.\QnB.R".......,i.%.9g./%..x....qm..|.j_..\.vQ.......{..@.|.>B.{d%.*.|S...w..?)...*.._.M..6..Y$|#..hn....Gkj.....3.K..`.vk..O&m....|vL...;.0]...3.Zux......_.lT .ip..H.0..)..e.......i.....&....8..9-.2......&...T..2.$..S.l.Mn.d..fMf&....X-.l.*.y...N.X1.K.Y7.T.....2KR...2F.JyS[k..n.H?.7... .t...n$...._i.5.!a&<.+.w.].C.Z...-j....XUq'...:..c..NP.t_.1.J.....].D3...M..@Zm..m...FQ.].I

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.SrgX (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.6080407530303797
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:3tu/5Awrma3DI7rpBiJMvgetzvdncb3OZqQm4kD4dBex:3/s0hBNp5RZqIX7ex
                                                                                          MD5:327C59C88A34490DA1E949B257C98875
                                                                                          SHA1:B2E493D13EA3B875CBFFF3441565389A9AA6FE71
                                                                                          SHA-256:87B5B4A6ED77F467C338069FE72198CF99CB5B24F9DDA1742921EA9AD50F4AC9
                                                                                          SHA-512:1A68BBBE79A1947387E7F1B6844D069F2C40B65CE91326DFB18E18B567340224AF508A8E57D14323F85185A4BBF924E12FF021A4C7D03C4328940B0ACB5FE858
                                                                                          Malicious:false
                                                                                          Preview:i.=.. ?.Q.$.H0F.1.p...x.= L....c._..H...../&T...Y...d..c. .#..L.e..C..H...A1..(r}.c-.J.~.....M...0.-_Q..*..1\^.ZI.B..7..2..]s.c<."uG..o.e....9.M...v....../'...k%...V...9.........eO!.'..-.-.P....E....{`...$.}.,Y%Oc1......Q..{.q..J..........5T.....1h...#.NB?2...r..K.}....0.X-k. ....(..7..1....(.q....._.P.w..X....W.h....q$es.'....f....b)Z....@.D.d^.......\..5.5.V.u2.t....9.......C.|}...M.x.[F.......8.=.v.p&.vI....#.6.W.....Ea..J^..k..'.A.|%%.6...A<..<.aQ...X...*.[.$....RX...^QrzJsW.s..n.M#-........[..PU+......|^u*e.-.....ChH..}[......p..!...G..^R...eQ.*Q..5i....6.WZ..T(.4S....!..l...E.:}.F.4..r....G.%.....-........8Q..sE~.....5...$..P.....@.\.Xf._.w.+TL.z.At.a[O.....bXr...7D.]sK..V......p{..J.9...{.-.|..}.b......;:Y..0V.s.Ik+-.g..=..s..b..mh...G7.<S..'h..p.HE.Q.....R..4.q._=.4..@.D]....(.nd.;.^..iu..P.h....3u...=.....i..r.;.n...................7[2&...7...M......Jh~nb.;....}*i.u.....f.y..o......O.>.|......>..[L/.>JBS.....1....X.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.VLXe (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):581898
                                                                                          Entropy (8bit):4.368885758108065
                                                                                          Encrypted:false
                                                                                          SSDEEP:6144:PQTHbcE5nCeV0igTEwbz2hVAGkGBqD7C7G/476:oTHbcE6igTEwbihWGpqD2GQ6
                                                                                          MD5:CCB5CD2D0834F5719A13C25E04FBC24A
                                                                                          SHA1:1AF1544E06ED062902FA2BE3BF9F3A1BAF81357D
                                                                                          SHA-256:69AF3E41563CDDCB5F0B7D34767FCEABE39A2E039054B18BB2A7934C07AE3C09
                                                                                          SHA-512:D0ADE44C56A9435D57CC7A4A87F629621FD1A307A9886FB2304A9E947111BB64D2642779D353BF62C4B54C7A3415233ACC638C1173EF996D9825E48582C8265A
                                                                                          Malicious:false
                                                                                          Preview:..wXz.Z..z..d......h%*cl.SM...Gd.1..E...\....`.*..C.B..<....)...^.J.R...d.:%_q.EtO;.Zi.;.6?.'.A.$....l......#..H..=.e..;.CV...(m)_..>....'r4........p.,.B. ..d.K/.q....0.{*3..t...5.my?.6...a......n./.F.x....$..q.t.\&~.(...ph.s.3.?...-!J.W..$.#..f.......d....6.*....|..=m-...9Xl_.[..*..[..f(....}.....G...".H..by..w..[...`C*............G.....Y..8...._.^].....8.ts......L..o@...j.+s.].W..d..Dyd.W.n.....co&M.'W.&.4:..C.F..`!ReS..0.......o....*W....P.#.,.D9...6or.U;..5@G.iRv...%...)..[(VS....\...G.^.?.wAX7.q...W.%4C.Rl...i..">..I,...n..l..2&...2=[s(]...L...{Z...........s......q3.{a..}.U7T..SD.(zy.r.7..N..4.....N..'.o.u..7Z.O.-...%}@..v..z.Y.l..Z.iL.....`.%J..6n.S<>..{......F...m.i..=.URO.u;.......fV...I...].{..O*.8.......%....GP.{..........9..`%...=...#%Q.H..~.).|..Y..*..AC.i.O.SC%.c...l...U/#.e.vY.\k.!{.r%RW.2..H....*s..j...k..u..../.}N.L|..._...-..R..Y..S+2........|.G$..K;F...qvQ..W..x...q..-.#OM.J.u..%../f.E%..M.l..&;p...k4X.f+.....Z."N.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json.JUGL (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):3953
                                                                                          Entropy (8bit):7.955615973932801
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:1jvKFOItvOT3ATOg0hoJJ3/gmu2GwBkT0zVOWfgT60:1jvK4IU3ASg0hoJJ3NB+0zUMQ60
                                                                                          MD5:366F55F94203EF7D2C24122290123275
                                                                                          SHA1:26A9547938C0B9A430E2D085DD251C2EA894A38E
                                                                                          SHA-256:355C58C67FD4200BD7D7D0E63E3873AA66EA434A623E4756BBBEDF014083EB13
                                                                                          SHA-512:B4A7D1ECEB98B3325AF19D66D2F70732D59FAB187DFF319460F9D5CE2DB06E02C687438C004C8D33F8B5EB518DB3B6EC75E62949B1373E490BF3C1791B21883E
                                                                                          Malicious:false
                                                                                          Preview:.&.[RE..g...B.m..../....~.....`....e..(.9}N....TLw.... ..|.H\...9..;....+.F......s..J.a..........a..Qj.....j..l_...0B=L..p...d}S..j....d..d...<k.4..D1.....uk.%.D.....h....#.Pmk.....&.....&.R.$.w.y....$..g4.<(.M_.x...o....H}.A...b.0q..".$X....z........ .Z...'.R.U....V....*`.#.n..l.b+-....r...K]+....T.^..[.!....[.(..[M..............y.{C...KmR.1......2..{+.....p...).G.K?D....~sK.*.....00.q..g..p...:.......u.......Cb..KO....v.a[1[......v..j5.1.Re.S.Z.R...VvM[..F|+h..N.E.o->C...b\a.9..w..L..}.6\.h.pg...&...1d.b..-h.J.&e.X..p.#uA...1..s+..d..>I....-~.n...j...T..Y*AW}.C......R.i.....i6.|=..DJ...T*_.....v.$..'.S.t..T..iz`.<.wE..v..b2......E.k.%.N..G/.\......1w.i.(.....3.s....R...9..T.... B.]Sv....A..j..H...D..&..8......^.@....&.P.6..c.IO.<!g.q...j12.:...w....J4f..&..;..6...+q.....].5w.....'..x......._.8l%.._n...t...k...(.@<m...#qV.Daf.z.....U....s0D....2.t*P.c&P?...9....UM..H...Fc.....,.P....[c#...w...y.;..L.[.g....b!d^{.l......Z...l?.3..

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.json.KBuV (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):316
                                                                                          Entropy (8bit):7.342385259419188
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:kQBLx7k8zyaBIp7uWJhqUmt3blP9NzsRooE7jVjyfmO5ymn:kULxUiJ9NAG934fmmymn
                                                                                          MD5:48729B0740A51613E6849BAFD9F26FEE
                                                                                          SHA1:706FEE27E5EC8A67E4946870596E595315DE6246
                                                                                          SHA-256:15C899813A25ECFDBF3D9B415CCAD0C28226F07F32A92B95D2E549FDB8B8CC46
                                                                                          SHA-512:3ABCCD14FBCA4808344E4FA8AF050FD07699EA79210319BCE4EE751C82409650C7D4C5799393EC94462568B2CEFBED8E0790797686C407A6E9798247FB92E9A9
                                                                                          Malicious:false
                                                                                          Preview:....1...Z|...ZX.......#.....L.........../...m5}]..#i.../....{........u.....j....]..`..R..Q..x..^).!@ I8.\......u.X..@.....B...C.z....P<....m..1..r....J]}1.....l..^...*.n.q'.<h.A...R8.......j~;.Ui...L"&....D=9.-\b...Tv..,Q?.l&g...D>#e....X.v8.HT......m......@[..N...cA...f.K.n.s*.0..yh..).0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm.SaHy (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.6100479849225153
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:tUyaPl7NwT93jXKufQE3Vn0wJlCCaDfwEz5PJcuM+pyfdb1A9+:t1aP1OBzKK5jCC0z5PJoZF1AY
                                                                                          MD5:7F4A119BC1DA33362CB10141839FEE68
                                                                                          SHA1:63858C22E420B5BF4FA58202ED6D5290DF59635C
                                                                                          SHA-256:5D3645CF589E2C394575E01291645E7A75F4D94B96EA7CFDBD054152BAE3F499
                                                                                          SHA-512:8A23EA92B8719091B315D41654CB5ADC508E52379BCC73C8098336D28F84A6EB4AF4BD1CAC8FFCC56CA07C157E304DF41558152264000330A630497EB5F28731
                                                                                          Malicious:false
                                                                                          Preview:d.....=..T.S..^..4..X.`.".>..6Ye.q@.Y../q....{..H...P.V..WS..i...R...OYX..^/..o..Q..Fo...T.'l.o.'....s.`...|.......S...B.{.I...R........A.E..V.U...1.(...2%.......F..F.....$...W.Q."..K.l.j..N.....C..:M..6a.P..k..}.`.k.Y..q.,.l.}....S:Z~...q.3.......5......-.....n.u.-.$.....i;'......~1U.....ul...t....}%A.w.....).k+.=.S.'..'Z...xjc..].m.4.........z.n.2?D.5.+...3.,P..]h.....R..tHT\.VG)...G..S<...T...=....S.|jfU.G..z..h..H...[.x....%,......M...h...jH.t.'D.w".kE.@....Vt.....+.6G.../N..=....@8..K.V.s.kL..&C.Z.t.....EM7.)....Q+7.g .(...1.J..yo..c.ud.%...0:..........c.........e~<o...T,'25.'....a.....U..(.O.e:.8..u,|..E-./."..h_D...0..Ww....e~........7..>t.*%.}v.z[.yJi...uf[+i..S.WQ.t..p.....ZY......e.....&...W?K.\..)Is..".. .q......Rc....T......bi..d.2.uW.`.Y....d..G"...m.=...&...+....Us.....Q3]..K.n........)....&G..[)t....Y?.M.[._...8..........t..fA.w.6mS. ....\0.H\.Os......+K.?N.:...`g..{.Ed....%..t....d....L.u.Y@.S..E..*..dD..x[.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite.HhzO (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):98570
                                                                                          Entropy (8bit):0.6440326137048917
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:UdRe5gs3fOS1HC3i0ufmsrGoQbOMRZT6MlW48eV8snzarp:6ReOob1HC303r7Q6M3iP
                                                                                          MD5:9B0A8FEEC90383B965D0558EB2504F70
                                                                                          SHA1:3927D3DCE77FC74A7322BB6B9A7852AF2D512FE3
                                                                                          SHA-256:39290429B2111867CDAEB494964A9BEE2375C37F81A314A3F432431DEBBF34BD
                                                                                          SHA-512:659D559F93D799246FD94E0572D2AC49FF7F93D6FE2A6B30E85A4B7582270347D550BEBE051680F653A198EF4703150D14EC15FD9257BFC02D2ABD95710BD24C
                                                                                          Malicious:false
                                                                                          Preview:.&s.<'..g.P....G.b!.?.@:..>.;...T.w..z.....^.#.A,...H.d.H.t.Dt.....(...N.L.l.7X.i.Kx....^..R...q....,.&..j....p.t.h.3...:..iz..|....X....<.'aW....U......,.U....h......O...Wz..R[2......@.T.....jI....CH.. c.u.9....U.x.|..j#.t.@<......M&.......DO....&..).....>|.&..d..*..z.3.r.._...;...-..md.jr..x.P..9..u.Z..GT.~...t.r.a..Od<..r...........U....4....&\h.rm...y.....l_~..=...O.n.....G)Cw.f.n5orW..B{.&\Q.5...h....3..$...Mt....-......~.U...).#v7..B.......]^Xu64.I...#.N.Yd.Wp.vx..c@...... .Ld..|..QH..n"....~[....O...Z...l;..d.8..3..\....A......s.o.q..l.^0..dPc ..|.d@..B....AR.1'.....]qCA..>....wL...d3.T'2~$... .-... .w..g........I.*.4...+.F.....4........'.P...'O..3|....Hj....MD..G..&k.w..q m....(.....W.V63Bc..+D..]......q......o.u...^7p..E...h'.:V@-.zF.....i.\].....gh...j...dC{.n.h.H....G.%.U!.=......p.xA...p......i..?@p..lmz."^.`9_......~..n.Ju.\E..:.x..Cw...c.|F...X.<....VX*..v.............Xk....>U_.=..r.......l.....2.3y}.U.uw...]...O.

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.json.AhgP (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:SysEx File -
                                                                                          Category:dropped
                                                                                          Size (bytes):386
                                                                                          Entropy (8bit):7.4659375116536495
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:uo/1efMnsTa92dnjgijkLOICJVLmqb41clmn:ukRsG92dndjTLYclm
                                                                                          MD5:477A7D196E5A3B28FCDB0A6879D90AF6
                                                                                          SHA1:40E3DFC3621FAA8B2FD72C4B199172AE57CDEECD
                                                                                          SHA-256:8113B8B3228D6595C43B318C59B578C8B9D6DDBBED7DC73B3747AC8B57342925
                                                                                          SHA-512:B96E08D1A6043B04049354958C48FF48C5A230BAF2758042506EB54935B10477105CDBF0E5BA0F6A612E6245EA874232227D03CBA576B2805D03DBE3E3770A85
                                                                                          Malicious:false
                                                                                          Preview:.8..H....3}.`..4......c.^&.....Q..}...2.<.%$SD.0%...?n.A.........Ffn....F.9......l.-z.D..u.4.B...'.Q.>..pe":""}}}(..#.v..E?.<r2.".....whA..c.(.W...%.+.x...[2...H.b6Rq....o.{i4.7..`...9a.^z...jm..l......XH.7..I....p...H.........P.`..M...h..........v.3.f...Q\.....9 .Y..$.l...&.........jS.~e.....x.Ji..M/....)d.=.E.......[..O..|.\..A3./...I.#.m...../OP.m.......r0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\times.json.IOGx (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):313
                                                                                          Entropy (8bit):7.237825297409305
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:8pkJrX+CrsF3cCBCvJ2PHwroskQXJ+ReQay0670cV+OX4r4niNZFeTANB3jw/mn:AkJiC49XJQMskQ1y0a/X4r4nASkNWmn
                                                                                          MD5:D507D8B8CA0EF68CFB1DF49DE519FCA3
                                                                                          SHA1:5E68638B0C88A3B5793D73AE48A1BDA465925F19
                                                                                          SHA-256:E019792A03C9EF1FF049CEBFFA6453C5186021A54D3A512E4D6D634D931C9C91
                                                                                          SHA-512:0E9A4DFAEA64B43F886BC3DCB4595DEE14F1AD9B7EFCFB3B3E0323FC4CC6DC82B78D1772859DD2CBDB2693E9571DFFF0AB9D39F12F466FC80A2DCAF54A576E8C
                                                                                          Malicious:false
                                                                                          Preview:[.#.h.n.~..(....>...Jt..?.zz.?.stUse": null.}....f_.......R........c.Q.g]p>.....A.~..C..F.=.O....eS"^84?38..R.";...N.h/~.c....i.f........y..4.....x.^.....Up=..g.d...y.C2..q\=R.c......p..&{%....r.....".1.>=...Y..h..............?.d..2..n&............S....T.Y.xvC.'..^@.7.Tc0#.G.....##0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\installs.ini.pFei (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):341
                                                                                          Entropy (8bit):7.355796084490292
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:RsZ/5Nbewoi+xFAKVadHHD8sEsVkAcan108fwYKv0n8opYhGE0fM/e8n:Ru5swon/fE18xsJcO11zKv08kYhGFU/D
                                                                                          MD5:693657E56446CBBB270E7BE7F10474B4
                                                                                          SHA1:31206C21D16034D4149C3F9F721BE42C8679BEAD
                                                                                          SHA-256:E1605D603A87CBC4FDABA8B0641DDCA56B8A3BD2E92BE60CCC4EFEB35CD6BA8A
                                                                                          SHA-512:644A8792A05FD00812CFA405DD95E5BD1A1C3E4AA192032BCEFAF65EB4E86BB6847F382F83E162AEF4BFC431F883CB1D823D3F412C2E7793CE86A97796C29D47
                                                                                          Malicious:false
                                                                                          Preview:+..k.........A).}..A...J.E..L.fY..ES.ez.....w.=./..C..(..G.HZ"ocked=1....J^~.U.#..z..U.$....U......./ .>Wu..tby...x.Ig...".. D..J.ds.x.[..<..+..+h.G.....coB<....?.4K.>......&..l.i0.._..hy_........9.F.w..z!..e..}%W.U(F.n.r.%f.e4..+<X.Y.....Tw.fr.$.c.t......~...x.,.+.&std..."..vH........E...hX....>cYSI..-..IE...I.*.M...'.0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Mozilla\Firefox\profiles.ini.SlaX (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:Amiga Workbench
                                                                                          Category:dropped
                                                                                          Size (bytes):571
                                                                                          Entropy (8bit):7.631705946223264
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:P0dTest7eZjXxccEo9zC/L4aERa3+B3AybFk1NM7W33n:kTestaZTxEszM+ACMz33
                                                                                          MD5:FAFA6AA46BCCDABA84B1BD5F0426C58B
                                                                                          SHA1:3525372BBB1F8714D470C7D32FBD725AF0EC3780
                                                                                          SHA-256:91ED4459DCD84AB3D7BF0871746DC22E27A460816F0F5EDBCAEFE9EBC5EC4A39
                                                                                          SHA-512:F8907D35B6128185D3ED96DBE274DEF058BE691ECFCF416DBD73A93E4C016E7FB4775B0CEDB86549CD1E3869FA754B0287683AD25D2F116EB629CD1F8B6834E5
                                                                                          Malicious:false
                                                                                          Preview:...2X3Mx.C.>1X.:9....B./...|.'O.Z.F3..s.i.,.D?..2.x.5p.?.\%.!........;.V.~.AI./.6..[..3..F..r.k.....v...b|.s....J.....!.I.h.*A..J.......[.L...r.f.#.......!?}....mY.6....>/l.m4.....Y)uD.B..`Z....$.U...Q.E.)t@....1.]..7.....10....t....7.#~.0.o......]18#".M....kB.5.vC..77?.a.Q|.....u..m.....n.Y........K..2P..W..~....L..0.M..]Es..w.=$7Z...*7..y...7.Ks........jp...M>.{.y.Z.U^s8.9i.<.`.....n(...Fg.l.U..c.|qX1.=]M....g$.v.........x.....?.D*...sX..S#R..:7...&.9...s`.....*..xq.i[.GQ.m....[Js...o...(+.;.yGb....*..xb.x..~..Kt...jH..P..@k..0xABADCABA

                                                                                          C:\Documents and Settings\user\AppData\Roaming\Skype\RootTools\roottools.conf.jBJY (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):342
                                                                                          Entropy (8bit):7.374047966993869
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:5zrbiTguNE7RTehW8IOcj8AXxCcHj5MyGg0T6x5et9dXKHV+ivNQQJNRBGBZSN9n:xrbiTguNuRyhW8DygO/GgyOkXK1rJUBW
                                                                                          MD5:11E735A2780785090DCEF5CE66E7E27F
                                                                                          SHA1:5FFE47AF3F9C3600C99146A56BBAE68190CE7542
                                                                                          SHA-256:6050D7E21063A20EDDFAE5311DFF46CFB7BEA351BD4BD8CB8E732FB32F4EC26C
                                                                                          SHA-512:73C84C97590867C43CD79C6443ECC5908539B75D10C0304D10547088D510973583DE81719522C82E288E7DFE69EB81DAF6D223211DC276D5F479F21FCC5C2107
                                                                                          Malicious:false
                                                                                          Preview:0.k\u.4....e...iZT;W...2..3a.?..A7B@...9..a.@qx..R..../.r.....bc62b5dacb4....%Dm}<.W..m.9;..@.......44U.W....x..V....R.U....~5?.irw...d..^..?.~....s/.=.|q..^=... a`v.B...11....z.t+....B...wJ.....f!...T....t......*..z..._....Ts.)....?Ob...D"j.OW.]7.D..y..y.,.cv!......LQ.. {a.?....A..4...1.<P...CE........*..YX,..0xABADCABA

                                                                                          C:\Documents and Settings\user\Favorites\Amazon.url.FhNM (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):377
                                                                                          Entropy (8bit):7.439044396289365
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:ru4B3y7glfjHicGSbLGTzvtkUeX9e84CF6kHrP9uoCSXXEtM32rerMlvENn:rFY7gpjHicFb2BkUp84CF6c9zCSXUtpW
                                                                                          MD5:A08C215FC3B78DD41C6E7887C81C59C6
                                                                                          SHA1:378F97A442A9EBF801A0F0799447054DCC55FBC7
                                                                                          SHA-256:65C44023271058A9971D05CC52640FB615A13398D624A3DF195F6AE9EE0EF303
                                                                                          SHA-512:9EC68F19841CE9937149F4B9553C906511C37C94EA9B8020CB6C8E6C3E05F1FA5DEEA6812ECF2F46D4B4E472C7ACB34713DEEEDA2F198DAA8E74DAB40DC62301
                                                                                          Malicious:false
                                                                                          Preview:...>...N7.#.s.jj.4.........k:j...d>=...c:3Z..47d.H;4F3:...LZ.z...D..+...?r.........k{.x`Gw.amazon.com/....=Ax.G.k...~..oF-...S.s0..`F...B..{]"w...|..T..y@...'.....).E>.sjan...o...!\&...U...".(.m..V..T..B|.'..D...1...{...y*b........c.?..T^i.m'......)C...[&.\.^.....e.pE...8R....X.B/.....%..^.z.}..y.".&)..'(9....H..v...G...>S.=..c._.-..F....tP...N.0xABADCABA

                                                                                          C:\Documents and Settings\user\Favorites\Bing.url.tkcu (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):474
                                                                                          Entropy (8bit):7.5567404825469255
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:SsdMz43clmkgGdWV+0T+tnwokZD0LAi0Fhmn:SsKz43clwOWV+02FkKLAi0Fhm
                                                                                          MD5:F11F705F475413B40D6CDEAF5083137A
                                                                                          SHA1:1817D2615590B291BB2FB307C4F219543C5A2E95
                                                                                          SHA-256:39046BE785D0DC5DBDA4949D98DFB813195D3D1540ED836195ACF264F7CA206F
                                                                                          SHA-512:B8CA1689B6EB0AF0CECE791FFDC61F7467749DEE25483E75DBE7885BC97117908B0D8A3817929D75392AB7F7A93CFF3DFF31D23059F0A6B5E1B6C02CA900FB06
                                                                                          Malicious:false
                                                                                          Preview:......F.k.....;.8..n..i....`".....`...g5R...zE.&.b^...xV........K....3C:w...q........=LX!...Xe.?...D./G.4{..e.S..C{ ...W..f..x_..".O..~...2.V>.9....\.q.C.......W.M......y,....c..E...vx0mages\bing.ico....7%d..._.&m.wh.-.g.....kM.@..j.}.$.tf...H...6_.u..R...;.k.G.....n......E.rh;.aJ...T|L.K.6".F..d.LF.....b.....S.......<.{..8G1.....s...0(9.*..2.L.G.]..6Ng.hi.F7.m..4.2qH.).....V...q...S.G.h)....b.h$E..\..|..W.l6..A.t.,....f.,0...C...'Z.5.e....G.F?0xABADCABA

                                                                                          C:\Documents and Settings\user\Favorites\Facebook.url.HEJn (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):379
                                                                                          Entropy (8bit):7.38640974539363
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:OgIC/yumoCmVmeguBzDwn3AIlc+2Ett3ATc640Z7cPq9/iak2bioBHVcIuBcjONV:LI4moVVm6zDmD3AQYZ78q1iakloBHV9A
                                                                                          MD5:0659C1A21BFC666838F52A0E0057406A
                                                                                          SHA1:719D207282EAD2AEBBD18D79FD9A1180AE061C56
                                                                                          SHA-256:9D1DE1E0964DAD5160A90E70297D182A44BB1626524D45686A9E4D58F15E2616
                                                                                          SHA-512:35359F70E4CAFAAC16970C4E2DFE3D5157E821A9278B226F6D91DB96F6152A1BF6381F559EAAC314D94F436E83A489B709112422BD1C1878A4A06646F7416775
                                                                                          Malicious:false
                                                                                          Preview:.HQ...H.....iUpb....,Mq....,M.<.%.j{\z]EUP1..x...A.P..bn.6E<I.2a.......+..$.`#..N.l_...&.^f0b..Q..<6...h....H]..Q.kM.k.!.O5..V'..B...w.W...Y.sV.w.X4...5..Y....v{.......J.p....G.X..H.2....iY....b.6;.wz.r...2...v...]^?..(.Hlj...A.....kN.Z.+m.D.A..y.$P).\..r...5..^G.1D[..a.z.......e|#F..A..!6...$P.."u.C...%..7.`.f0.6."Z.=.,.}t._U3....283x.)."t,$.v0..Vl. .0xABADCABA

                                                                                          C:\Documents and Settings\user\Favorites\Google.url.GsDV (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):377
                                                                                          Entropy (8bit):7.3804240634774025
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:i5ES9eYrF/iPnguSbOvwKhsGeoIW9Nls0HO6IV/Jx4Gl/Yb3vTGrbYuHn:NiFK/guEODsmpR1IVz4GGb3afHn
                                                                                          MD5:0BCB2EE65401CCDE6A2AA2D680975469
                                                                                          SHA1:7C842BCEEB7219692FBCC8D0D3DCEA1889D8FF03
                                                                                          SHA-256:93A727556396EA2DE0225DE729C2939DEE5DB1E0C1957D00C77AD9D75221F0C1
                                                                                          SHA-512:BA2B2706F01E4B3A61CDA0439F801D4FCCE444BFA1627697807070B0923490A0C500F8C078585336F53EEFC2C77461FC3580B7B836BB9C63937A3FBB47F8CD96
                                                                                          Malicious:false
                                                                                          Preview:..0#.m.TX...G....\..#.ce..L..2.D.7X.~A..7(.".2..|.. ..'...k..}.XZ.Z....p.;..V.4....]......(.w.google.com/...i.....gD.'G.v..EYVgF....!U0..N..-...!...o....U(..e.s.Bi.a>.v.._.s.1.......,.,.'...)._.U...C#s...C\.....-....}../.&..Do.T.(E`..9{T4.M..g"n....o..@TX..D.E.4....v>.t..I&=.0f3...+@l..g...?..'..!..U..bx..!.O8.....~..qv.vk?N;.E3&../..........b0xABADCABA

                                                                                          C:\Documents and Settings\user\Favorites\Live.url.abQP (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):375
                                                                                          Entropy (8bit):7.390854812200369
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:stKvpHZvycaui8p6bFwCbH+9UKUtutckNeoP9cZNZvipXOd7/Ff+rTI2n:55KrCp6h5bHEmtutcFw9cZfS+dVCM2n
                                                                                          MD5:F0FEFE44A0EA992187EAAE565B4B8121
                                                                                          SHA1:8A7A6BDB95E28073B40D0ED3AB5E6182AF9D53BB
                                                                                          SHA-256:5B7F9DE38BE250EDF9A64E5C1581B0707D22C54D420F4217DA9BB9CC00063CC4
                                                                                          SHA-512:7A278620CE9FFAB75829968BE3091B20A52B2580585754EAE53A9A20EC0DD534DEFF8D3A804DCD6C8379D6E3BC7FD03DF26716247A2F3D1909C2886B08B0BD8A
                                                                                          Malicious:false
                                                                                          Preview:...5{jO.}..,3.1V8.....j.'.,.JC..N..H.E1..x...mm. ^.k.=....x&I..c.34...[..ui...!N.....H..Lw.live.com/...i..m@..=O...d..o.l......k..l...x.Y...".4.s|..i..~s....O#.^.zXo.lnX.!...%.$P......0..l.F@v.....0..o.&.]p.1..~._..<..'-.F.~..,.../...JE;.r..._..$...k..F..76..dI`.!].9..F..Lj.v..........M....2Z*._....MP:P...7.}.........7..1r 4.T..if......v..hv.s*0xABADCABA

                                                                                          C:\Documents and Settings\user\Favorites\NYTimes.url.WzTd (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):378
                                                                                          Entropy (8bit):7.435544705801139
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:Pn0s5eyKPNHGz9vcQTR1fWePbaNzeURXtDG9dNe3Q4uobqpZQCoQLYkBn:v0scyaNHGz9FtpWePmzeWtKle3QTjpKY
                                                                                          MD5:55B1644394115E0ACA570D42B9B263B6
                                                                                          SHA1:3BA0F2FD85DC6A2705ECFA495FF037693A427060
                                                                                          SHA-256:F30ABECF531BD57DB0C51D59C3991426421A703345357ADE8AE4C7AEF961CD30
                                                                                          SHA-512:54078BDF6C9DF3C75BED542800D22A499115D9C8DF3CB9A7F1FAB319B52C97E4476FBB77643449F6CD31DB88E83AE6B373AD8F3FA3416FD062C0AC10566CFAFA
                                                                                          Malicious:false
                                                                                          Preview:..*HZ.v. ...uc...O.?...........9d..h...A..B.g.u...k(+>8..!;6i~..R.3....c.v..+[iv.&S...F.7j}w.nytimes.com/...~A.....i.1...l.."!.9.L_..^.TT....b.h..V...o..`....\..d~N....P.M.F.QG.x.R@...!.+v.=w.@.4/...p]..&.p.7mL!~..o.8.=.TI*..{..@i..N..=j..+..~".=.p}H..E.....P...%~.:;..S|t...0`o....*..Y.&#[*...c.l...%.Yw...T..}.....Ti...f(....f/.4Lz.R<.}.......Tp.0xABADCABA

                                                                                          C:\Documents and Settings\user\Favorites\Reddit.url.QpNx (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):377
                                                                                          Entropy (8bit):7.425987556763628
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:8b1HIylMa3XCiwA+h6z27qx7KB9mbIcqDK2vMr2ady5IAG5qqKNXqYV6TtvbZ9x+:8pNM8XCrqz27E7K85aq2ady5IpqquXqS
                                                                                          MD5:C4A38FE4DB8EB16F5E93C07726B18C85
                                                                                          SHA1:6F5E082784C7BE66768B9A0C454AF3B81E28B49F
                                                                                          SHA-256:872486452D01A7E95EEEF7D503231189868AA2430B3FD74402121CD4D5E37BDE
                                                                                          SHA-512:762BDCD0FFF78C8AFD4D1DB24957F69334D803DB3E14ADA146D7C9A072C1CA829B7AFE4E08A574A939EF36FCE4EDF2DE8A40240513F8DA427CEB460732271BD2
                                                                                          Malicious:false
                                                                                          Preview:.a..eA0........7.$.b[)p..W...h....C.RV.Gv....m..C\......&i5H..7....-l..~....h.*X...v~...Q..&w.reddit.com/..,.v.6.'.e..E[..?.8...K.....0>.....?......\..v.Aa^.....].}@.x...._s.....[.5.*...@..#..+....;.....$..R..%\.X...k....#.>.+m^9.,M...o.`.t.V..Ei..9..A..q..h.{7.N.cu?/s.2..6.r.6e.....)W..;.....JS.yR... ..8......3..z.}..9.2..~|.4#.d...E..gz.PoTY..y-0xABADCABA

                                                                                          C:\Documents and Settings\user\Favorites\Twitter.url.XZCs (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):378
                                                                                          Entropy (8bit):7.441382817164948
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:51VsbgEodM6XMXgy5ubk8HVMKhG38+dmQ61oCFez9JqCMut09Kz01rSn:51VsXiqXgC86J1dmF1oCFezDqCM20M0I
                                                                                          MD5:622B87DF92C15264FE569AC663BB9725
                                                                                          SHA1:6ED97D116098CCD1514FF1085D3038F444C36921
                                                                                          SHA-256:4CB07D205E7EC6AFD330EBC395C90B47806867D0F12125E87A99BBB17AC00A8B
                                                                                          SHA-512:1AF17BC9488F93C9B26B54E049E98384CBE98513DA96F30E1B90F6D01F98929B965C7F0AC1072B49F3BF2749AC058E1C83183D00C565597DBA5C9826CCB5DEFF
                                                                                          Malicious:false
                                                                                          Preview:u.D.......S...h...=...H-...@.X.......xo.#.......;,..6T....O..B.).Ce.w-.}#......<.u...........\w.twitter.com/....5.Aj.Q{.JH.....~.y-.v^<Eg...h.<y.u....|..".G|+1.A\......i..c.I\a..a...a...OM..8...[......78..... 5..W..\d.w....`..}.....N...&.....[...@. k.iJ..\..._.;1pt6.eY&.t....M.O.bY\>{?.......*\]..)..XR.aPp..N6,.t{.0....RIP._.D;.x%.t.L@.)........).L.S9d.b^>..0xABADCABA

                                                                                          C:\Documents and Settings\user\Favorites\Wikipedia.url.TAjO (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):380
                                                                                          Entropy (8bit):7.3106416877785545
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:fOcFqmAUmjDgNW5UjNx0WEG1eL0h6UlNc4xIaBistDUIs9OM36zQQVbR12UZe9al:fOcFqbnj5UjN92pUMTctDzM3AQM6UZe4
                                                                                          MD5:D723A146AE321270BEF059DA72BDE9F0
                                                                                          SHA1:B2FFEE9434C4459A96328F6BC8250300D494D103
                                                                                          SHA-256:4C5BFEBD45B36934D3377C1E2C56088A2F620F6CDA5C9F8CF27536A961F225C3
                                                                                          SHA-512:63ACB7C42A2CB47E0FC2034CC77ECE64ACB3DE9494A03DF5176EE82F81EC3E5A2BFE4F83F29A75B8BDC577141B24F2450821384A99341A149521C19F1B8684EF
                                                                                          Malicious:false
                                                                                          Preview:.. .\.[...J<<...}0..a+.0.......i.-.......P.X.W..:B......4:...2A........w.[..K.cT5k.l...O..."~...0.-!..]+.of>...*....-...C..\#f.mc.p....+....~.7...<c..b.p9....DXo....=8,..d|>c.c.B. .5............#.p@.3`.(.(O`.Uyl..<..b..Oj.{E...}Pe..(..b....nA.4"`..$..:b..J......G.>.i.......i.1x#..703..l.d...@..#.R....P...m...(_.....*..$H......6.*...6....WR.Q...m...R..0xABADCABA

                                                                                          C:\Documents and Settings\user\Favorites\Youtube.url.nklS (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):378
                                                                                          Entropy (8bit):7.393685870131824
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:/t2ZEJzuj8c0AIWLInG/vWrb1s57IYZuld/cPVV6OQog9IGnC1QvzmSv5kav+xvn:18EJnc0+LQG/Eb1m7lZ6cVV6XoymSmS6
                                                                                          MD5:E01A3F522DBAC91718A7EFDDBB53282E
                                                                                          SHA1:1E43D3F15E02F6CA996BBE742D03CC04E3E9A867
                                                                                          SHA-256:F5487D88841A3ED407BCE4E238F32085B0484244CE09A7C9FB8E44FEB5D0EF84
                                                                                          SHA-512:B9117845F500D17BC247E84BB30EFB4C0FDE21F2D745FDA6D4D3177577DF5F402D49CF5623FF036771CE6C6DD28BDA827B569D6E13F92DC0D2275CAF5BDB94CD
                                                                                          Malicious:false
                                                                                          Preview:.....s<A.3.*x.. ....Qj...5....^T9F#|.V..k;........h.!0&._r.q/.]p)....i.?.......V...V.im."B!w.youtube.com/.....f\'.....[."w....:3......&,.....[.Z4..'./RY...e..`...oz].......9.k.6.k...8.....yA..i.. .8.......\.P]...s..>hV..!...U..s......J.V...5..J..x.*.@.6...fzXpv.b..^%*..g4....j.._C......5..._Z......kT....._...m@..*z.W...,.*.+h.4Y9.<.N..5w.>.8..`;.|.0xABADCABA

                                                                                          C:\Documents and Settings\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms.VTRX (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1125
                                                                                          Entropy (8bit):7.820840617777886
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:0GkqmpEzgfAb+kPjGGUg/ZF3TuL7Vnup0vaQaqamTeTO2ZCS:0tpEzmkh1/ZF+ZPaQaqamTSXAS
                                                                                          MD5:82056BCA217BAC1CBDE396AA023405E7
                                                                                          SHA1:33A5084E83291733198D7086BFDA6123816B62A8
                                                                                          SHA-256:A7B857FBADE509CC5C4A0042758477FDBCFE45B4185347C18B454E7019B63964
                                                                                          SHA-512:F364E7CCF16FF33E8D68D1D0BA6BA7AE1C8223D794197D96A79009C9A1971AEDE6B124D1AF7A2B70BC71E92DFB1BA15B8E6C7C519ECC2B3F7F276A3B090424FE
                                                                                          Malicious:false
                                                                                          Preview:....F....|.@.J.. \.#Y..+W.".].8...(..xv.HT.........$l9......On..h....v'.Q.A....?..e..-j...t.....R).Qd*P....`.....F.V...v=D..=.......P&..H...../..=.w._..0$.}`..yO......(......g.}.QCC.O........U..[.n.A.Lq7..<.K..'S....q=P;2...`...73..d.[.L.^...?i....)Z.......{.G..E0..ENz..D.....+..3l.g..*..d..Ye..Pi.KHyKq,3.).>.wx.V'JE....dX...o...;.<..uB........*l.|.z.....s.).JJ&..|...}.z......^Z.......62..B.....`..x....t.o.u...oD.......Q..=.-t.........12.TR.8.....!3d..H....,V....*KB0.G.Zt?.e>a0.=LM.F.'.w..VQ...Bn.,...........x,.&j3_.2...3s.."..9,...O.X......MR-...J$.q.....W..K.T.....K....+[..S........1-.J..e.-e*..[K..{.+...v..d.Z../...BD.....+$T3D8.M..D>...^f..7..0.p.R..aO..$^.Y...2..bV.v....').o...........)C.v>....3N.>]......yS.h.e.&ip...7...C8\.._,...*..}}b'[.+....... ...1....2..4.:nA8.=.s.g.O.u.",@.$H.x.i.o.'.Zescription>.N.)..z.|}q.....q...r{...0W..G.-.5vzz4..._w.A.A.q....0.MH.@.....1..L.m..q.1..".x..u.....C3q.....E.sa,..hM.rV.....f.......".%!.H/....Yy.n...

                                                                                          C:\Documents and Settings\user\ntuser.ini.Pgpf (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):286
                                                                                          Entropy (8bit):7.28947639619488
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:F1yL45wbX122TvWYWS2dV3RsYtDIOOEL7FIm8IGDQTHYJJviXLYn:FAkwhhTvWRdV6YtUOLFttGAY3Nn
                                                                                          MD5:0C3CBC3CB3FFAB875BA7A9916E6D22C3
                                                                                          SHA1:2DF491B845A546B221B02A6D9659BFAD1C7FB6EE
                                                                                          SHA-256:772F166A6B162F8FD42CB7E6E8009C0CEE9393CEF0A51485533867A15A9ABE1F
                                                                                          SHA-512:20B801369EA8BD0946634CEC12EA75C5544E0FB7ED5BEA62CE60BEF2DD98F97E04C99C1A291250E1E63BF5CADBD70ACC7D2108914926F0113F6C8B4BB7875E04
                                                                                          Malicious:false
                                                                                          Preview:....#....V.......'.N....a.-...&.\.......LA..".v.....r..<.Us.............Z.D.......[...,.R\....$j..^c..^M^.?...J.w..m...7..?zVy....9.J.B...J>&i&..9.c.........<-G.r.f..H.._MX.t+w.|...o]|\v.....>.q.....(....}.,j.J...)....K05....8.F..i ..G.7.. ..:.(*H.Xx.......s.3.0xABADCABA

                                                                                          C:\DumpStack.log.tmp.NidR

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):266
                                                                                          Entropy (8bit):7.145833552049191
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:Uehf2bHhSMIFupr1OThMr0TYr8NaVfo/4E1lSAWt94HY70nn:Uehcr1OThYiYr8w9o/et94HY70nn
                                                                                          MD5:1B3081FB92D659E311221902ABDB5543
                                                                                          SHA1:030E41C5B02C9EB50516E3C1171F3AE3ECC39BF6
                                                                                          SHA-256:434E84FE190FB6B5D92B560E8581DCBBF60961B1CA62F16E8B95FC911481681D
                                                                                          SHA-512:57ABE49CB8A3D9D753FA5F16BE8A9268EFB4EAE9B5EAA38E6F6BDB2328F58AF8A87A2C3896562A96E27F7ACBC497F5B222688CD49965F25B07110414B9D87278
                                                                                          Malicious:false
                                                                                          Preview:T..lK..>h.e.$i....[....yg.w........G~!...L3.;....k.J.x.......-......e.....Y.3..\O..:.........o...... ..j...yt.'u..n.w'..:...t....l......U!.y .g.S...t. ...@.^.+r...efm...A..\l..8>.6.o..V.. .#.W.......tN.a<R.g..Ce.....qM7E...........p...~Q...0xABADCABA

                                                                                          C:\PerfLogs\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Recovery\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\System Volume Information\tracking.log

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):20746
                                                                                          Entropy (8bit):2.5739970655644653
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:61tW6TWoZtmmjrZzwnUXbVmTSfJnCpCaPdC48XqCLECnDKUt8U5nN:CWKtmmvZ0nUr4SEpCaARnLEQJ5N
                                                                                          MD5:F4541C9D71ADC353889F4242D23D091B
                                                                                          SHA1:C55E91CDEB90CAB11DEAC4C6983B7B57BCEDCF6A
                                                                                          SHA-256:C908CFC70EB6DA2CAC33D18954DFDF304222CC8430F15E89FF21854C2A1E93A2
                                                                                          SHA-512:4C8315EADF7718201537C7E23C916AC8E9B71AE390F65C6CFB636BFAC8578C27DA74DEDD19ABB60B5A5B016AE5DC6113C08DBDA6F46507696084862CFDE0D6F1
                                                                                          Malicious:false
                                                                                          Preview:N.s.Q...i..o( .8JI...=..j.:4.W....%.O..O.(|......"..99..i..C....l~.~4..)./...oY.....8...IEd.K)Ka(...x..../hm?..De&...A..'Bj9u.&Z.7.Q..=.(.*.I.>.#z1."...}>..A.1..L.i.E?..#....&..x.&E3}Y....Ss.*.3O'.9...i...@...........ie..=.."...q..L.!.^.*..\^..7.6...\.\)im.{.\W..@.......).s.H.c.i..#I.jG_;..\..-.b.E.J.7z....?...`......J:.%.1...H..f.).d....I.i../#..k...J...]m.\..n.GA.p..c.}..rR...D.....-...nr.n.s\..,rl......0.O......(.m...4.<qf..k.j=.....A.\...AW......I.S..|}..g(L.b....jx...7.^BK..V.[...(.Z+#!..[..{....m+.!g....@....!..7@.`5....o..}.i.Q.G.d w.r....P.... .p@.;s.US...UZ.!"..k....4.I..rr..j....k$1.*..m+|,xer..E..GF2..n.W.%2.3..{.-%Z......9.B0.."NF.F....l..iO.%...M..0d..__R+z.JZ.`.v;z.....uR.?l.;.1)|.4..psa.*.f.....K.X`.A.....h..w...h..t...F;qq)G.Hi#I...{.....`.._.b0.....NnD...Zc......X .r.J..D...g.A%.W.......b.....K.*...X...r.....sR......_...Bs.UH..8..g..<..YY.7..+...irz......k..tN..m.....@...}0Qj.......p........*.......o."..z.h.(%.H.W..h.LL[0.

                                                                                          C:\System Volume Information\tracking.log.MdeW (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):20746
                                                                                          Entropy (8bit):2.5739970655644653
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:61tW6TWoZtmmjrZzwnUXbVmTSfJnCpCaPdC48XqCLECnDKUt8U5nN:CWKtmmvZ0nUr4SEpCaARnLEQJ5N
                                                                                          MD5:F4541C9D71ADC353889F4242D23D091B
                                                                                          SHA1:C55E91CDEB90CAB11DEAC4C6983B7B57BCEDCF6A
                                                                                          SHA-256:C908CFC70EB6DA2CAC33D18954DFDF304222CC8430F15E89FF21854C2A1E93A2
                                                                                          SHA-512:4C8315EADF7718201537C7E23C916AC8E9B71AE390F65C6CFB636BFAC8578C27DA74DEDD19ABB60B5A5B016AE5DC6113C08DBDA6F46507696084862CFDE0D6F1
                                                                                          Malicious:false
                                                                                          Preview:N.s.Q...i..o( .8JI...=..j.:4.W....%.O..O.(|......"..99..i..C....l~.~4..)./...oY.....8...IEd.K)Ka(...x..../hm?..De&...A..'Bj9u.&Z.7.Q..=.(.*.I.>.#z1."...}>..A.1..L.i.E?..#....&..x.&E3}Y....Ss.*.3O'.9...i...@...........ie..=.."...q..L.!.^.*..\^..7.6...\.\)im.{.\W..@.......).s.H.c.i..#I.jG_;..\..-.b.E.J.7z....?...`......J:.%.1...H..f.).d....I.i../#..k...J...]m.\..n.GA.p..c.}..rR...D.....-...nr.n.s\..,rl......0.O......(.m...4.<qf..k.j=.....A.\...AW......I.S..|}..g(L.b....jx...7.^BK..V.[...(.Z+#!..[..{....m+.!g....@....!..7@.`5....o..}.i.Q.G.d w.r....P.... .p@.;s.US...UZ.!"..k....4.I..rr..j....k$1.*..m+|,xer..E..GF2..n.W.%2.3..{.-%Z......9.B0.."NF.F....l..iO.%...M..0d..__R+z.JZ.`.v;z.....uR.?l.;.1)|.4..psa.*.f.....K.X`.A.....h..w...h..t...F;qq)G.Hi#I...{.....`.._.b0.....NnD...Zc......X .r.J..D...g.A%.W.......b.....K.*...X...r.....sR......_...Bs.UH..8..g..<..YY.7..+...irz......k..tN..m.....@...}0Qj.......p........*.......o."..z.h.(%.H.W..h.LL[0.

                                                                                          C:\Users\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Local\Microsoft\Windows\INetCookies\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Roaming\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Windows\CloudStore\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Windows\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Compressed (zipped) Folder.ZFSendToTarget.IsgM

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.152362901782037
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:OS8Gk9Lx0ob6QvISWgQwKRUNvun9MTNPDLngdeQFP98+6M1yhu0OKOJsn:O3GodvIl0TRPAe+6MElOKOJsn
                                                                                          MD5:2D30CBC8D61F9BD0AB85B77FE35E203E
                                                                                          SHA1:6A782254918B49466F7F0121FDAF6E1D26FF1663
                                                                                          SHA-256:ED0AA6A64576346392DCA65448D6FBE1C83AE44EAFAF40C73C87E8E3CD9E169A
                                                                                          SHA-512:E9D7944BF1155A803A322A679604139F27991A6B07CF0AE983323B129F286E3CDC2D709915C8B65927CE2E26138A7393174E7F31184C4AE02687FCD46842A825
                                                                                          Malicious:false
                                                                                          Preview:P..B-._.}x...kF...........J.X.%..OQ(...kloh.$...o....Y.@...#......S|..\..P)......Ha.+.y..#..U...mo.....Y.W...U.|...t..a..(iY....*..(../I..oQ..{.....3].6.\....v..WKfJH.};..Bs....u........$..+C.!.V..&....]....<.u...6}S.......r..K..:}1.....p...\H......^....3#..F..kN8.0xABADCABA

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink.avyg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.2268190262999665
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:t5OWUn92uINg3Vnng1Lz4+Og24QEvtz/6PpxPEIQWm7F2+y6eXmn:LU9+NUNglz41z4Xv5IQWmEJWn
                                                                                          MD5:34234846ED3F9E05DC98D6BD7D648797
                                                                                          SHA1:BB0104B211E1DAFE79126B801F2FB8C3677ECA74
                                                                                          SHA-256:6804C1694EDC802CF0E9C63075DA1B36547B31049E85B38D4872D706FB263925
                                                                                          SHA-512:B2C8B7EFB79D804A48F9318F16DCF017CCED20887DC3A6D638683EFC18BEA34735DD78E6629029502BFE964BF5968EC510779562EEE7737B589CBCEF4AC3D401
                                                                                          Malicious:false
                                                                                          Preview:..L.[..1....f..........?C #sQ.8.)..r.M..0.....a..R.e.b.S...)'.x...F(.`IB..........U..8$....<.%...w.0J.......?+g..>...-..:...b...F..YH....HP.M.[..<....#.?.......u.L.......N....S.y.d.9V.q.oAW...0...3x.........rh.R..)..G..p...9,:j.c...].t........O8j3......4W...6.-.n....O.6.0xABADCABA

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Mail Recipient.MAPIMail.RCHJ

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.182453894647969
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:SzglpERK7ST7qY548/YwutMrsLl6+pFA3px2fTfdUKNBG/VdkkSn:F017/i8/YwuSrsn6mLlxNcfrSn
                                                                                          MD5:A250DDDEB9A239B3EF8454D471DB24C5
                                                                                          SHA1:780FC1B68D58FD332755AF859671532C2481E9CF
                                                                                          SHA-256:3DAC7CD4E413E416C2F0A7E041921168131D75A6BA34A245221ADB4D40C6C448
                                                                                          SHA-512:93EA571F737B18B56DEF89DD4957A057E571D6234E13066BD9EBADC61A8ECEE9565E48B0D4FF49279870A6BF9E057948996BA62C585FDB3FB0798E29606F7CB3
                                                                                          Malicious:false
                                                                                          Preview:F...F..P9._...r...................6.yX..%.g...[..8..J..<Ft..z.. ....... .dI...3.Q.w..M..\F.....Wi.+..!R._..v<..z.......<+.<+..s........U..HW.R..=.....s.Xe.p.}............6FC_.$1.Y.k..Z...z....m .f..e.s.3..cnv.}.R...lJ.7..j...lE..:`...%...@.j|..k5.....MT.#.......pe..U....P.0xABADCABA

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):436
                                                                                          Entropy (8bit):7.499802209199181
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:kilNQVx4F2Oy0p5acxQQlft9NWljNj7GlNI3DJY1r9UCn:k2OVxVWp5BQGfEYlWzJ4rJ
                                                                                          MD5:FC3BD334DB8F1774E5682AA753B9268B
                                                                                          SHA1:80A33B92B77EF1DCC882B2B524A39221E8665914
                                                                                          SHA-256:11B243F97A4596D2C00BD1CDFC996BEA043F1111DCD0BF092C32D44D35B07677
                                                                                          SHA-512:46BCABF33B5F4D3BA75ADE6367F87163CCBB42203C64F0B411F69631DDEC92409ADF6BCA7B1C2DC4865265F2556AD13E61FD7D1D0C07D77131CD9990F6C23603
                                                                                          Malicious:false
                                                                                          Preview:9.7@......U8..yD.......P.:j..%h.ITc'x...M..0.%....RL.nZ..(8BK-.[.....K0[}%......:r.O....Q9...J....D..".y.y...I...n.W..9)F.[..q..OM.u(._..|.IO.\......8.1.1.....a6%ss..q.....^u.S{.Sbv.LV.|.5e.R.}K.....3..4.Xj.^....3...!{.....#........4.....\.f._P}..M%O%m....`*M...k.E.K.S...~.........z.Xe..qT(..P..w.Qnc..:.q...CC*.~.p.."4l.y.....Z..|.<.\5.....M'..'...O....8.....G...%.:V...(t0~...m.}$..\...&..Z0e.. .o..0xABADCABA

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1200
                                                                                          Entropy (8bit):7.847975241102988
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:oUa3pkeqoU1QZMJ+HYc+jfdBMHaRm30JokFzyajp0doxpp1Q:tIql1wMJEDOYHaRm30Jogzyajp0GDQ
                                                                                          MD5:1C8CF07E86D143D9C13AA00178802FC6
                                                                                          SHA1:89B2ADCC9196AD45E17C4938DB0B7C1C4EF7258E
                                                                                          SHA-256:F3508B91227670365D31DB520CAA50FC427CDC981F00859A73F655C22F4069A4
                                                                                          SHA-512:215D06963D904211064CCE992FF3F2CE2091CCB327F0FEEAF04F32A24D2192FA73C8AC258925E4A827D29BFB602F2254F5119FD51432BCB77BBD09E646C8E8EB
                                                                                          Malicious:false
                                                                                          Preview:.w.K...@{.c.5....'...........:.GB._...e.u..~|}...t.e.....qBA.m..4..*.1..*4i5U.}...ck.fT...0..V.'o......?.-.%........,....+..j...@"..."..2k5:..g.z.~>..+l=#...u..I....R..+U.(.S.x.TfIT>x].@x..W.HE.........L.-._....o..i.......!.}..V......m.%6..7y...*._.<...x ...#H....G...fkK.b.8B3...d.>63A*D....nO...2;~..5Gm...r.b.....(.,....2,7.A.....-.R.i,8...zi..G.g.Dp....M..D..{.V..0o.h....3..."ew...<......q...ZIY.s..+...<L.!....FcS.I`{.......e|.Q`. .z.4.Ul..l..kI..J.B.d....Q[zhW...9'..)..U.G.N\ 5.S...m.....$......V}..s...|...........~d......rV.f\..]U..N.6......>..1"..".6.q...YHt0'g.u:]..n..O9.3....f.w_.d.L.R.8.....R,...Y..WIH....Z..V_>...:...K.f...c.p..`...n..{,..r.....p...k..T@R.R'.v.!<.....'!0....%gb..Tw...$.W}-?.....-jD?GPp..U.C"=.e.....{8..=.>..00<.`G..u..}.j....j..2.X[......0.<.E.,...^..Sx.....P;....HC.......V...S].:a(....A...@Y.p.......9..c.#.l..k....g..#.J..7.'...q..7..6.i.2.....j..J..w..e=L.7h..t3.1........0..E=..._>..gc#y...C..-)K.p..5q..

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\Desktop\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\Documents\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\Downloads\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\Favorites\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\Links\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\Music\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\NTUSER.DAT

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):262410
                                                                                          Entropy (8bit):3.163575162812944
                                                                                          Encrypted:false
                                                                                          SSDEEP:1536:XZ2iBRd/kjJbhu5zkBijAXU6fMo0+SYKLWe:XXBRd/OozzANUo5P8We
                                                                                          MD5:0DE20C81C368BC4871975327DBC73E28
                                                                                          SHA1:C0EF7B1DC8CA518797386FE14D8B9C489A97D65D
                                                                                          SHA-256:B2BA58159B4B3500B4225A403239C9F676DB27066C05571DCB764DCAFBEEC3AF
                                                                                          SHA-512:51D6E72C78CBBC6A32E56F00B9F0C5C31387AE7576356450BE350086567171051C19CD22D46A2A50EE85B210F6BCE35228AEE4B678D4B6EC06453C9BF4E37C50
                                                                                          Malicious:false
                                                                                          Preview:...y_.lH..b..`.?s..k.a.......,.^.s.....~=*>..@..x...p..b...=.Mj.j..h...i..?P.R.....Z.Z......#.q6LP3.p..*.j...s..i....+NF.E$.P.a....re......6.;8w.*&...N.y.7w.v....C..`..z.$5.c.....{.:....e..0...4X5G..dy .x.x=......e....$.Y*...\..*N...W>"..JK%..*"...-..S..u...s....._U.%P5;....i.N..P.c......3.v.'...^.M....U.TI..2..?.\..rQ.g......\F...U..^..<[....?.....}...K"......S.I....=...W..>...'x.-.......E...M...X.6V@.,.|....IZ...$.. .|...3Xaf..M4...yv8<.d...".%...gc.....Cj../.V..O..[O{..wN:..j..T..s., .8J.G.V..'..>.s..jd..Y.6B..;2..n._a....8=..Oe..jhK.....S....k.SP.".=...Z..C...%...)^.E...J6....2F.L.w.*..6....-i....[o..P..>..&.(...:?.....L.....L|.$.....>.VZt~.Q..m(<.&n...q,.(Y.jB}....O.}7a.....]..G...<.U.n.g...f.....Z.....).?1|.yl_.G.....i...I\.-=..{...J.U..Z.....C....!...s.N..f.8.M..........~.2.E3.;S4.....H_.u..../.W.qz..%C..bn...I....0,....5....qx7....v..QB.....+..T....f.j.6o.m.E..~.xa B...-9.D..........8)...U......F.Y'....Kr..._......bR..a...0.....%....K`.f

                                                                                          C:\Users\Default\NTUSER.DAT.LOG1

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):65802
                                                                                          Entropy (8bit):3.4093987051611547
                                                                                          Encrypted:false
                                                                                          SSDEEP:768:UDlezmPDxLaXBEACX+luNutzJlNYMy3vigy:UDlexc+W8
                                                                                          MD5:6A9FE9FEB1AE6BEB08690C1E566FE616
                                                                                          SHA1:78C8B452F307711CE72342FD0CCBAC3F814EC2C5
                                                                                          SHA-256:CE3F9939D69AF974F55A5FF0BC0CDC977A7BBD09ADB517C910AEE2494BC4E36F
                                                                                          SHA-512:7F7CD095EBD861745F203B651F0F636121D84F1113EE669C0F5F3901A6DD58B64309FCA154DEB1A86DB627335A77579FF23C35C65C97A80C36F00E9AF9E6515F
                                                                                          Malicious:false
                                                                                          Preview:lo...J.y...KDd...Y.......u........k...^A`.,.4....7.&...J 0.T......O..r..R+..MM....}.W?...-1.K...zSl.[.x..P!...S......f..->....(...;rE..V=..h....i..}..7.....Y.a.3.R|.E.....b...Z...}...u.2.ba...=&6fs5;..LR\.h,.N...}t.....A....*./d....C..J].7...}.....t..[......~pC3.`{...h..7...|F.sV..`.F]x.l4.....Qg...|-.Z....sZA...%.W).m..:1.l\....26...[.C./U...i.L.]...!....@>7..?Xt....SI#3.W...|.T..KE...d..."..`.4!.T...40G.%`r.........6...........K.........!...1.e....@.G.;.N....r..e.._,.....kg...ie.=.]V...;..\Vjp.A..T..8."|&..U..1....[.......]a....r.'......J.T.xd..".f..?j...x..p^..f.w..~i.I.N#...q(.,r.......Z.....yx..<.."t....U.-A.......j4@..=..am.9.[. N..&.b.I...<.O../Jv/.....?.\..rW..b..-.\..0....5...l.<...-..1....`.Ir((...c.!..$...-..v.|U.s.Q}.g.`.7......eK...i0.Bf2....J.6.......0Z.'.M.....=..h...d....]sB..L<.A.f.L..qJ....&X.~....@.+..V.\.5$'..I..W..6.(.Q...81...]..F.v.z[g.Wex.&qJC/PE\...ER...)*#RD..9Z..^.~-'*......"......y.P.U...".*...R...M..i..u.$.$.^A....

                                                                                          C:\Users\Default\NTUSER.DAT.LOG2

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):20746
                                                                                          Entropy (8bit):4.755375452655067
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:2YSHz9L2BrSniNxePRhxtt2DWCz0389zcg3Xa7C:2Z9LmmniNI5hgz0M9zN9
                                                                                          MD5:4F5C48DC329CF6A5D10E00C31E63CDB0
                                                                                          SHA1:DB61D451F53B0D0DA3305729049708EDEE5B874C
                                                                                          SHA-256:2500557ADBABD0C9397A0446B86D2DF6131D933618506519FEC18BCAD78B7156
                                                                                          SHA-512:5779F1DDB8F21D44C6ED309244E6A0C1D73905749B769BCDBB0AE1AA29F2F16B9D9B37D7A079956FE2A96D0B1ED21A8DB1A376EC078302596CDF18DD5235DEB4
                                                                                          Malicious:false
                                                                                          Preview:...KffvQ[xh.Y.........aSD3b..B/=.......-aZ.i.&.+..........^]8G..}6......Qc.6.q..H........+.93.G.+.............B..ZU....%..M..|....VZ..:R_/5..ph...E...)d.A@..E..Z.przg.^.*..DK.$.c...m~|1g..e.%&.[_.?AS.@.)Q...q{......b.(!61v..k..:v..Ia...K...`..)..4.M.....$.Y.7..8.)............wh... t....h..>.~xvi...O._...T.a.0g.-[..S..D..x.....m(..h&A.&.(o..`|.f.y.'..b.l*.o.G3xK...S?.....'.Qf...sJ...P}4Y...z......V....`g.MN.k4)@..[+.:8z..I(..0!...g..;...4.>..., ...su.(VC...7.Y.s.W;.u...)..C.t..p....(c.!lO..nVD.s.Z../.{..........[l.[..Q...q.D..7j[F{,..;.kL.....;-.(m....^.....m.hM.1.x.p...........\>{.|..!.Z@?..q.!....0!..N.U..l.1_.b`._.....q.^.......6..'..s.;m.......L..F.F.....U&.....y...FO.0.k...... ...........<35..|...,..c.@\7A.?%..z.C.E.:K..s....32..j..~.*q[...........(...1H..>j..k.i*.......p.5kh...f#!...^...#[...,_...O.&2.'..l....>. .Y .{...c.+.B.-;1V.`6..;...D.Q.R*.~wg.)%.].bM.P.....Y{y...M...{.f.F.5.7j......mi.H.A.%=|.U0h.....M\.O....@Xj.='..}...TR...n%..

                                                                                          C:\Users\Default\NTUSER.DAT.LOG2.IQgb

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):266
                                                                                          Entropy (8bit):7.145311125404768
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:AT5S0Ky6iO0fRN/PGKiCwXYu6RUuyXQa2luC3a3mn:AT5DKxiFf7/PGKhbdhyXP2lNSmn
                                                                                          MD5:4A3FB2D875D45731EDF4CDE83F9590A8
                                                                                          SHA1:F3A2E68BDC82ED76E59AF36409C0B8254821CEDA
                                                                                          SHA-256:BC802BA24ADEFEEFD612B4633C99D74E87990C1246B9EB31CB23A0A095931218
                                                                                          SHA-512:811020AAB3E4DC8AA637AC21DD3A4D14F30406BC7E547E78BFFFC7BD4F7BDE7016AE5E38FA114BD8BFD3FBF6696D9681513BB27A32004A6A2A9EA9E35E91D8BB
                                                                                          Malicious:false
                                                                                          Preview:h.2.N......i.?.|.n8)'...L.......|...e*../...,_&.x.l.Z.U...6..y.5K..O..aF.A5m.>B.......8o..^.K....WO..-'....)..R....XN..E.>..).'.}.2...P..]H.".r.j...M(M..w...W.y.M.&..}.......1aO6?.{t..G....X....C..B..~4..5....K.F..>.m.......w..|....gl.....}.0xABADCABA

                                                                                          C:\Users\Default\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TM.blf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:SysEx File - ADA
                                                                                          Category:dropped
                                                                                          Size (bytes):65802
                                                                                          Entropy (8bit):1.0522830230091045
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:ntqaHiIc7DiPRgW7swf9L8cjrDRkseaWxRksc:nsaCoPRlxfxDrFDWXw
                                                                                          MD5:679CD4DB4CE8B69048DF351196173FC2
                                                                                          SHA1:E3E6D5CF7A777290FAF74835A8C9D544430D090D
                                                                                          SHA-256:B1FE92136174A205F59A7D65BF3DDD2A6ABDCB3E9009F7FF4D397FA19A6A5AE1
                                                                                          SHA-512:325B41C0464D841661D2FEB2ACFF42123A9D6CB93F9FA944E12781DDB71621771B0AC7B6C7C97B0D8617A4734728BA7A7228B59BC8FFF487EBE4FA424CD79FE4
                                                                                          Malicious:false
                                                                                          Preview:..#.g..PP2;.b..M.&...........X..k.c.x.Xv...>........r..S?.sC ...3......3P sg....Z../..EA..#<......0......F].1..W+m&.... (.....n........2b..o]]...!p:X"..]....OT.9O.hb...i...V...|...6|N..i.....b..Y......6{8;.&.{r....ZCn...f...^.5.#./&Y<......s.N.^#../zV.......e.!V...m.b.?|...$R...l.m.#..4O......J..YE.C....y:;.[2.bJ.......e*!...K=7B.'=.{b.S0uuu........6Z..7D.8nQn..l8.Aa..>.......r...0.8..8..@..u...?..Q^...I{.|..^.hE^.].Z^...x$.~...9......%.Aa..._w......@.....F..L.Y........"......I......OK.i..2.!.nf...b...*...]..e...#@x.71e.C...>.........~al.....j.....7....sC...]"`D J...N.........c....H....0V.7...tE.D...$..^.S...x_.W..Q..W .........}Z...."S....L..`.f...2.la.}.bo...!Q'.]C...i/...cN2..n.}..ieO.g....o".-.6(...Mw1.U.9....hG=.O.y.G...D.^3.e...L..S._.<.;.).C,.M....Ex.1..7..!y.@.4.Z..j(7.^~.>.EZ....TS....d.Z..Ui.g.uj.`.Y.r[.{..4.....^.~.V......!...3.J........9?.....u/....Z.i_......IP2..\0I...L...{....i2...sm.S0.C.f.@.t-.Q#...ZI..........*.C

                                                                                          C:\Users\Default\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):524554
                                                                                          Entropy (8bit):0.1348714842428908
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:mERQPai49oEJUbKTMtqCelbiskHwME40Mm3ku06rfvlaBcAaw:e4oEJUeTMtqdi7VOMokuH9aHj
                                                                                          MD5:07E41E7727E610A2FEC2EE2C7F7B4798
                                                                                          SHA1:9A48219D9FF4CB235849483F00CFAEB6B197F4A9
                                                                                          SHA-256:2F7C6BC4D6C0D39E15F40532B6A04338D10E89A1EDB8D0C81C8F2F66324ECF9C
                                                                                          SHA-512:FF62059079677C4F8F3BE59931C82F35C7BC52714B07B5B33A99D750E5844024E56F5B55A4AC91F11B54793A8ECBFAFCF423822AECC0250501FBFD22DB063A17
                                                                                          Malicious:false
                                                                                          Preview:.[.a`.K..1....pTVNK". ....a.....l.|{B..^.... .....=.N...l.........9G.......=...i...N..........M.].0.X.9.......uK.6;..O.cG....z .oc..........<Cn..QM..[YsPb..d}..<A)..O.2.C..6.jAy.........o...6.k..7.j|.._N.......{..J.aW...1SZ@.O.k.u.l.Rr}...KF....?5.k-....\...>.........g....K.q.!...K.<..m.......).....u7..P`g..=..........$..."...].../.$J.N;q......{A..D:h....'g&...%.2H.2......c8.h.........q....}Ugj.M...Oe..|..)...fc....%.0.BNX...5..}p..&.q(.=.G...........A........4.u.5.....y.1ZE.8..u.V.._|...........=2.Y-.g=....}+...M...4:.....M0]&.zf~...!.<=.5..E.T=UQ#.k..yH._g......#.N.{.p.5?..a....(....3......d.Gj.r}.TD..,|..=.....Pf..TB9V..6.(..;o..n....8Q..I...@.4.w..T@Az...G....|K.T.{C.k...u&....E......N..goO.U.=./...?.J...HY.O.9...4....wOB...Q...-..+.-..8...D..-|..........N..y.<5K.s.c..5.B.S.]...\HS<(....y....]I.D..8......:HJ.}."....{oZ.]l9..]..T._....Q....<k{.......x.R......#....T8.............0....-..j..q.mS..Q_.}Z.ci.............V.B.@(q.E..8.m.g.

                                                                                          C:\Users\Default\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.DRtS

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):266
                                                                                          Entropy (8bit):7.139538168437514
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:eJXishiTj9+fqZbVcXvSW57V2Rf6yINRsNw8dmn:IyshwkiZ5c/r2RCxr8dmn
                                                                                          MD5:3B35BFEF7BAB3F7519DC5E854A6A4509
                                                                                          SHA1:FBC4D1CD513FF029A87FB0090C845E6399F070F9
                                                                                          SHA-256:7090702FA77557EE5D8411D3866C427E8584AB87FF425A10DE15B3C154F4889B
                                                                                          SHA-512:9A6E949295CEAAA6EE3D3B9D4E54ECF10D3104A9C671D2987D0F5245E5C5A049EA64774FAA75003ECCAB229CF48FF442C0558D706CECB8B4A09D895E97964F4D
                                                                                          Malicious:false
                                                                                          Preview:..s.F...a...6..rB.....|.N......h.bY<sz.K.@8R...QJ.P@.h<n......6.X.`..5Z..L.!..1.7..w.e..f./.......L0q......>.X..-c.8D.tG.<.]...>.;../....q)..&R..ha/...UF-..t...WF.J.J.}|.}..gYl.n./.......t.....]V..&J....=._.alc*..D....tU"].s9C..c......01.0xABADCABA

                                                                                          C:\Users\Default\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):524554
                                                                                          Entropy (8bit):0.13528055512601456
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:zHYRY1PTlZd/PbAiYvafZt3CD9DsW57MnGkptBLTpJjCLq9w/:DYGbTe6ZtyprQnGUt4+9w/
                                                                                          MD5:DE8477432ADE352D2DD9B520F054C62C
                                                                                          SHA1:07B1AA93CFD407A84D040E564A0F5D32571C4981
                                                                                          SHA-256:3B173B2E944C59850B96CBE29539933E8FD8CF08144ACC6D247E7C6CF50EF6D0
                                                                                          SHA-512:3B2B905A65584ACCC550283BA95A8C4B6ED9F2EC8B99D3BB2AF88E13F74EB692CF349431C84498AE50DBD76F0BA8EDFBDA81720FCE863D2AD3CB11E8D6235721
                                                                                          Malicious:false
                                                                                          Preview:...t.A..Q..U..L]*Q9'....(C'..`.d-+-.[]..}...y..v.%.IV..t'P..3.a.>....`\r2,.).r;....h....4Fl...........q...~..9(+z.......Q`.|8d.._.H....+=C.N..N2......_...m..H/.O...3......g.....y.@3.U*YD.=m..E.G.8.....lwEp.....Z@..P...HZ...3..[)R*.>]4.f..H.......c..X%g.:....)..~....k....y...t.......d.o+.Q..h=`m........l..........!.S....d.2........q........;.....~....,....e;L$>*.5......Z.._.......8..-.Z.~....l...&.D!u..@"[c1.S<...^.).o.@......jJ..#.S.K...m.a...".w._........U.....a.cY.{.......,.B.}&.r..m..\}]...P.-...+......=N]o...6.....p..m...d..#.py.u<K*i.f...4...."r.3F7F.N2e..F.eesHEL.F.H.kH..!m.a..P..~dd..U...k[..2....=b...3.........6.........'.\......]6O.)....;.4.[6!.o.u,.w..4.*.*......X...X.r.-p..1......tZ........P.....!H =..."u....'....+.d,.;.q.?(5.v.D.......n{.pt..;E.........WY]P#B.Z:+....#.....X.EL..Q.."s..^.<.U..l.K..L'.9.3..N&..^.Jm.)....Y.....&.!..%+<.(k.. 8t.Tv.cV..........>t#.v5.Q....3..nZ'.5.....I}...L...A<..t.:..H.d...i....Hg..9....K./A

                                                                                          C:\Users\Default\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000002.regtrans-ms.jdFL

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):266
                                                                                          Entropy (8bit):7.2322262211896
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:UsFtcNJY5wi+tvG84VW9yawA9TLXA7tMm/Dkxhh4u2UnniK1n:ONJUwi+te84VWLwA9TLXA7tMqyxiAn
                                                                                          MD5:F44C195EC6F597A4E4BDE62156A998E2
                                                                                          SHA1:B3F757F2E48DB0078E26B78093B0C9B421648185
                                                                                          SHA-256:6D9577D4965657C2808A2AB336732B11768A3AE36CE362BE6324E7AE62041DBD
                                                                                          SHA-512:66FC4DF640E545E0D3FEC29E81E6DFC4ECDF89A1672896FF52E6A3BD603DC27F0910E256F62AE18B672A17463E0AE1DB09BB4DAA5F8E509C44B9B0C4B54518F2
                                                                                          Malicious:false
                                                                                          Preview:tV".......Q....VO.6.V..)T....u.H(72.e..._..Y..H......*.....O.R..m..5.f.'..In...nm.....-.~|......G...RYA.4,..8[x)hqq^...9...z...m........I9x?VN.>..].:.....$N.....6.7.2....&..NR.R=I..u...}.}..L.gZ.....[|_....Gg.y....C..=...BH\..2<HK......U0xABADCABA

                                                                                          C:\Users\Default\OneDrive\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\Pictures\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\Saved Games\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Default\Videos\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Public\AccountPictures\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Public\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Public\Desktop\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Public\Documents\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Public\Downloads\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Public\Libraries\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Public\Libraries\RecordedTV.library-ms

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1265
                                                                                          Entropy (8bit):7.82599268115329
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:U6VatMe0Lgkx7VnbNKOhm0DXAVxagn451QtEnLGQgUpAoUrU8oJwSN0FFbu+Ugtn:U6UU33bNKO3Dwzvn451QtsbgJor+BUg5
                                                                                          MD5:B1A39D31E9908838445B3B16D3D164B7
                                                                                          SHA1:2BAFF9BA55295A4D4D29A39298BE8ED59D99C273
                                                                                          SHA-256:B2D9DF95E1A7AA47EA743EBC2E9F924FBE592CCED5C97ECC4348A32DA9F5D79F
                                                                                          SHA-512:F3079BD75092C5B37FC01087213B8214900834CA50B14CBA5149006F978B2CE60B0C29CD37A6226FF57D9DCE6517EDAE903787EC9AB781BCB69E1E0427227B87
                                                                                          Malicious:false
                                                                                          Preview:.yx..."..."[Mo.&....i; )Q....+..Y.}.-...T........C..../....._.....=....Pp/W.![../..+.......h.8L..@.z_qY.Y5[.........v6...C...v..++<.Z.c...T....*..N.xW.z.e..A:.)H..=..N.B`w.oP....y......*......x....i..t...S$.......B....C..1"57......y...K$~.%.3.(|........x..&Z).M..O...C..vR.....cz....;.....j....Z.t*.l1.$.A.g.Z.9>....O..8.)a.E~../....x.d.H...._.}.....atp.....mCi&K....F...|..Ym....h...V....XM..:....o.'...0H..!....8a.......!..]-...g.y.i....J!..\nOR..U..`.O.n.da....PA...l.*+^......vP...b..8...+..Gz;...GTc.......N.$3...jD+...A.g..V......w..D=....X.r.....A...p.@..Y"|HkDO[.WO.v...sg.V.....e-9c. 9.dM..\UH?.S...mC..^?6..Y.=.C..4Z....v)....i.@K...Nb?..7...E.......n^..... .....)D..*6...0y7".!M...s...J..*.....\...ch...'.&.. 9.g.(y..l....!.V9............).bY.N..V<..H.{._C..W...7*+..j.b..(Q..9O.o@.P.cR,.U.<...jey....F.,8...1....k,{qM......^y..H1o2...Fo.....N..c.17=..xSk.2..K8...9u1.j.|G...k.Z.....G!|.o...K.....(.o..T@lr....h|...A../.w..+&@Hn..tion>...

                                                                                          C:\Users\Public\Music\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Public\Pictures\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\Public\Videos\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\.curlrc.NCFD

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.10865637745058
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:bi4nMOpM/YehrPiJbLXRzErXvmYOvjj1NxaoxNZNVtUsYK6lknHn:bi4DpMNhGtXRzES3bj0oxLPiv9+nHn
                                                                                          MD5:9173FDF3942A45A28E61C7993A91E007
                                                                                          SHA1:A456CCD8DF0482D49DAFACCC04C1747B6EE185EA
                                                                                          SHA-256:8339F27B67AB5FBFA930242802B933B4839919F5A85978B8F2A4D044C293154C
                                                                                          SHA-512:B347D53F28E18552F126ECA244B98647FA5CEE2480D2CCE34F20F8492B5B737BA1D379DEF052CB951B79DA55C83D1989731D8B9E2A4D44EBD61BFF3FA66D2E42
                                                                                          Malicious:false
                                                                                          Preview:x....5.s.`..c..................e~t......z.%o...H....!..O....ZK.'L....w............[X\...G=...x.....2........$..;IU.x..i.$A..s.............E..*..|..wH......0....P.: a.....P>.ja..-..H.`F...Tk.)V4W...5\<C..69.6K.....CC.D..&..x.1G../r;.xn.i.H...0..o.._.T/...F...:.e.../....0xABADCABA

                                                                                          C:\Users\user\.ms-ad\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\3D Objects\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\DNTException\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\DNTException\Low\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\ESE\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\ESE\container.dat.AMSZ

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.2106931022004295
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:u7gNlB+Fk9dfHYpxqLOs6kQnMYzlMhIGuA64wtn:0gNl4k9RypbpZChAtn
                                                                                          MD5:3101DBB023712FF11E5B371C71585581
                                                                                          SHA1:818B981851E0E2BB3D6008BF09CF36C284152B96
                                                                                          SHA-256:9F90FCF24A1BFFA315D776CD856AC529C42F182A31E7417C02655C34660D1AC7
                                                                                          SHA-512:0749E648FB61E1DEE8204578A44B3F56F98264A83CA2904CA58C8D40EE1D780C293F872B3E1152E0BBAA1C16FAA9F14127AB900F6F67AF0B56E666320C406AF2
                                                                                          Malicious:false
                                                                                          Preview:4IF..d..o{...............!p....[.......0..o..."..4..>.@.|.....2......6.^..4.......{V.c.x6;.!..q...U=.Q9.~P...L..W.s.?.}sP...q=........f......P._N....GH..V...J...hGE>s...b_7...]8.n..:h.Qt.DG...T.i.,.Y.!.Z...$kP.0Z.%.^.-,h.K.KpU..:..qL2u.....w.l..n...E.Y....N.....|..D^..0xABADCABA

                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Low\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE\Low\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Local\Temp\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\.curlrc.hZXK

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.162405891686351
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:g3ZTXvhGUCyjnodOn+FTqXSn2qRpKPi4E4GYXBRSZrIvN/2n:UZTX+X/FTvn2qGPC0BRSNIvN/2n
                                                                                          MD5:2FDFDBCECD67A8FCD4B04CEF0D85D490
                                                                                          SHA1:C621EB4DAA17B199DE1D0AFC4A9EC6B0A797F993
                                                                                          SHA-256:ACC9F8A011D38714B73F85009B8B0644CCD46979BB2631E1B4C3D509C9FA89AF
                                                                                          SHA-512:3F3C798157BEE8A7F586F3C6ACA6F06DA243EAD4C52AE1FAB470CA719A22A300BC1799AFC6A7454C03E7DE6FDD7B321B62CD9A567DB82FAA20FA815F1C5D40DB
                                                                                          Malicious:false
                                                                                          Preview:..fWv..:..4o..............[.5.....aX@......A...J..-.x.w...7:.M..a.#...y.[..}..=.4...7....!...Z........zb._.x#H....V.......x..O4.d.Uf...........6.f.....n?.:.H=.".....!y,.O... ...j..H.q.+....m.a.LgcH.....P.r. m...*.._4a...C..z.....`......b.?.....c...6..@.83.....g0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):288
                                                                                          Entropy (8bit):7.243375154202293
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:sM2VbcK8gk4D61m+HWUeZ9kZtFw7d/l0deUPbJo8zMcidkExn:ecYt61FG9kzFwBllQ5zdI3n
                                                                                          MD5:D37CDEC53B7DC6A0AA3B98787542839E
                                                                                          SHA1:4FC9119696B5FE5122C0C42C138CF9E573423DF7
                                                                                          SHA-256:3251CC45ACA12F6D2D1A02435546FB116061CAB87DF88CBA70C9C4DF346F02A6
                                                                                          SHA-512:195AA4C4EEA6F46B205F315F128F21BA3C1407A427FD49E64954B807307DE9B83065DB8E174B6EC77E550422C9678B3E510BD22B379A5299E372B1393FEB2403
                                                                                          Malicious:false
                                                                                          Preview:x\.^-{.j...C.K.>>].>>..K-...E.....5.G.G..@e.......V.7.....2...:.-}.Q....n.W.&..>%D....e.`.o..P/ek..SVUm<..R'...nv...34...../.s9.O&...M[Qx.....U...^2k.5~V|.C+d...R.t....-..E.t..k.......-.6hq[..k...F.....R.A&..;j?..E.......^\...-.....Py.L....+.{j.|J.d.v9......:za...0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):290
                                                                                          Entropy (8bit):7.244265707253575
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:QlrBHKLI5sGMuw4Soo6296JSheikTbugWdNzVIIWhqmn:QlBHdRM5N6VjyNBWVn
                                                                                          MD5:A4280DD4ACF72E5466207CB13A759933
                                                                                          SHA1:0860F1B090AB940CC63DC95FED03432FB2CF9CCE
                                                                                          SHA-256:93A41B1A23F94FE4F3329AF11E9922BBF65A867D7DB1553E6A8F7A7C1C7E93AF
                                                                                          SHA-512:C8E260385CE9601F71C397F45ACF11CEC1FC15A9FF37ED7282C90874C7779901CF2632884C3BF3B26E5BFA3AEB70E4CC5A2DB782801EBBE4ECCAE760E350F0A0
                                                                                          Malicious:false
                                                                                          Preview:m.1...|h...h_..<<>>].>>.vIZej)"..<.\8..e..^)j.....c..f..O.4wZ.<...h.cy...t*.EI. T.T..P/o~? ....!..l.Ed)...X..{..o....\.T.C.;\.M.@.}.7...:X..i..8...9Q.Xp..Fl...y.P.....1...5.......n"V....?..Q..k..t..h.>.S..K.......;....Z.Juy.Irq...Hj<......u...d.....!.$+.8fe.+ci.....0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):67070
                                                                                          Entropy (8bit):6.569253511866881
                                                                                          Encrypted:false
                                                                                          SSDEEP:768:4xHLf1WMFHmw8XJZZZe/E4XdNSirWriXYWZZMZ/dYS8VLm+kig+GPG6rD2kSI:O7kumw8Zd5rYZGZutbzf0xn
                                                                                          MD5:8CAB86DC77D8A57B73C4C8E5CF3C0EEC
                                                                                          SHA1:E037514586BE029DC06EDF42941BFF6E9FA08723
                                                                                          SHA-256:E157BDB13992DFB40B26406A035C6A58611634307F3AC0CFC287C39B6B718A75
                                                                                          SHA-512:B1FA4DD2BF4919CD1CAAAB7D6F9814122D398200DDC2BF8EEF8FE7696FB7C3FFB513BC617C1FBAB00E1DF128529F6F6A368544C7746FBE1365DEAC16C9043421
                                                                                          Malicious:false
                                                                                          Preview:..Q.{/H....x.|P%Q..|....o..o.6...$........{..G.Y?`TP...Gt.vh0M.....r.......>...>.ul...h..O.z[?.).Lz....5.....S......za...#....n0...5.....y..'+q...$.P.2.c.(.w..4./U..}....Q....}.<.>.@.P./...-X.W........Z.b1..^.V...%.dg..<......g.d.y...V.A....a........3.....R.{.KY<!^.c..&f....D.^S.V.......}.V..."R."m......h....~..A...n. ...`.N.......=.>.p...,4_..H...hLb.z.....~...L4+;.U.s...............ab..2...ZJ...C...v...."....0..T....MM.O"...A.....s{.;.....&h/r....s@..BB*..f....5....E...R....-).v...3v!U.a.bY..y..A.='...N.8L).$.WQ.E...%r...........U9.G..!.....[....K........+..._0.....].5.............(.Z..{.........J..9>..6u.H'-.p..D.$...J.)....c>6.."^...hwF}#$....o..........v....S.J..{U.UR.....K(3.*... Mx.K......_.ZG..NM..A<./1..L..%%..:Z.......1.{_|<..}.Q..VjN]2y^<|h...i-..y.E.9..Q.......T........E=.#.N..C..V.<(-.i....k...cH...^.70..b|>.......#...1.........}9......N.g.0..NE....N.K.=..w.Ny.....)..%..4.X.....4.....W?..........e.s...

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1003
                                                                                          Entropy (8bit):7.7966571700737175
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:BwxJdco/bX5p7qLhCDHvjLs0w/Lfw4TaCDGPJ3loLFLtYSH8:Gj5QFCDH7Ls0Sfw4CPvkLBc
                                                                                          MD5:4094193587448ACA27D1708347EAA606
                                                                                          SHA1:8118DCD42CAC82E40CE81C6FA58493B4C7A4AA75
                                                                                          SHA-256:14948FAF133580BB9F31D77D6DB68C74E4DDD336A32720B8BC97B18CFBAC796B
                                                                                          SHA-512:FBE6EEBD50ADE3CADC92362E0AC0BAC575BAB3A4C23D17719D5B0EF89F15B4C65457DA54441B1E3735E7C5442430488645A70E066E6111531496E54023121E33
                                                                                          Malicious:false
                                                                                          Preview:.a1=X...p..NG....[...KT_t..@Z...d..Bz(c .O.P.]....u=...X.Y...-.M..c.K......'..s.%(.A.g.t...3..=c..ee....HsO..x.j...= ....`..C_.d..G.IV.mxW..K..q.....r...k....~."..Y+...26...v.h....F|TS1E.qT....yS..i,.j..p.....]{eY...b....b.#..V5./.}#,\.(e....PY..R......M...D)w~..Ir..U..b..?.>IbBS.2.3~.......-p...t..pZ+..& .>1[..p..5..q...<d.._.=j......z.fnc...6[....X.H..zj..^....Po.]....47.ed3R...K..,O...8..V......#...Y......-.fj.p..[...DF..^<...%.1..`.G=..2.,..|....K...c6.......}.MP.y#G..L<..~.....p...i.`..O.Sy.=.1h..i..T..WZ...s.S../Ak..$.v5.n..zV#..3mG:H$...w.....z.d.0...V.5i7....%7\.~!p.....x...........(..zQ..`..5..@V.$..h.W..f.B.9.j....%p.{|U...R... ...R...,".j}c*4}..X.E>ku../.}.....z........z..a.I:9...R.......e..........]vt...a..u...].Sf.{.y.p.DJX./.H.o..Q.Sx..#..r.x..g*.U)Qlw..|.r.*.D..w$....4G.Mp..,H+Ly.Z=:.....~.t..f.*..Y...D..\.n./8,...U....c6.U..I..<"f..a.A\......9...,|..x...%R6.......r.-.A.t......i..e@..^.D...........c(.@.4z..Lp..;..-..WJ:...0xABADC

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):10506
                                                                                          Entropy (8bit):4.266534901682183
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:xgMMWqoFBp8f3cwlqwZgK35/d7TMycaAYmqajK:MiBo35UKgUK+mdK
                                                                                          MD5:06E33A6AAC27C85C86AC2FC5B10C0FD7
                                                                                          SHA1:AB2AABBF996DEFEE2055DEDA6367D4CB929A24CA
                                                                                          SHA-256:FCBCE2DF401AEEB95B0AE7454722812BD8B72DEBF58D67B9775CC2A83443E45A
                                                                                          SHA-512:BD251142D2196FE469D8C0D9FA967FA3018E5853808DB5A8ACF34A679F58DBDB85FD438ABE1691C3308432585ED4C8963BF8E0F3DFD3EFA6293C959E19F9696B
                                                                                          Malicious:false
                                                                                          Preview:'Yi..T.+1u......R........a|.oB.#C.'..y+u.?;=H...I3..\.hX....@B..(.CYqy..Z...._.b.....%^=.-..%.n..Q.U3-,..hB....>!.[ 6.....;Ub..,......;>j.. .<.B.I#.[..(...VP.Y.Z..j.fk.V....J.._..6...I..(dR}.......= Pq...gd...dyv.q..L`..J....*YB^...... ..ZP.V..G....2..v.t.}..7.047I...9..|...w.=f?...u\kuq.SC.....p...C....k.-..*.HF{..H.pD..6U%.3.w.[0.scI..i^7.v..5......Sy.._..^x.6...1=.1.M.9.'.hW..R.u..S.s..PN..\r..U....8..)..v3...r..{O.........@...F.,A...."....%.b.Kr.[!.....Xj*...j^.....s.qen..".:.Y.. ...A.NH.../.N.T....J..9U......[!.9.*....>...s..%P.2....H....t...:<\DoW.{k.i....(x..*6'..:..kH7u..!..Wid.0.z.n..;..zO.....M....W..*..w>.{.4.....H....F..hz./..N..W.S.~....m].......K.z..=..c..S.o..........{n.A[.:p..".0....(..,...lm.s..qm..{F...O8"...7.{..X..'[o...F...@.fN}.p.0.f...N......Ii.'.q9.$9.3.h..&....h_..r...B..`.._.q.mm..0..mtyX....s`p.)`_.+t..:....w.....^.j.Sc./....p..zi..+..!......pPB....rd..^6.hr..T...}.Nj.\Q.A...i.1.4....6.Z+...oL<...a..x..._`>WY..u.%..

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):24418
                                                                                          Entropy (8bit):2.3621088960230616
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:IjUt8XROOWAW6I9hU6gRTQi1Q+aGCFWEfp1vmR5tUpukg7Q+MWj:IjUt8BvkZ+QyQ+07puD7sWj
                                                                                          MD5:BD076E6DED64654B84948DD86807470E
                                                                                          SHA1:101D139846B79703F4FF117C83C6EC91C264E64A
                                                                                          SHA-256:83B64914A859DF8A85475246804BBE02F0094D2FB8A31105E6F225B294477242
                                                                                          SHA-512:EDD50AF1EA4CDB1A35416BA794B3B305EE05F1B6B670D5F355E273F251CFBA654FDC789154767969B158BF1007229B581AE3784AD790970D8BADC8466ADE6E16
                                                                                          Malicious:false
                                                                                          Preview:..pg..X..75....[V..I..u;x..)I.H..I..>..T*$..n3.RB.b.l.$......28...-l.yr...Lk..<.U..T\..s>.".D.h../|Q.....I.&..X2..ys,y.4....j.>...d.r....as.%.tc....O..Q4....K...............;......p.h.\.5....7..E.Y..1d..D.VQZ$......7K..Ie.<.U.y.....g.._.../.T.B.....;>.%j...3X...@...*.K(..E.8..d....$.C.....f..=..C..V.D0...W.7.}...w...zem.e.O..;.hx.....\./..'Qi..W.....=x.jl.T.m..E..%.bh...).o|.....z\.y...]..e..>.5.!..g..Q.yj.M:..f..&....xy..4.`..f6...... ..t..2..P.M..)Oo...m.t(..2u......f..v.Fwb=......s....V......#.eZV.]f...J.1Z.p....+K......q.J..I>y...LM.".JB.A[.x1.W..4.....[.s...:`..y.^u..b.M.OJ..5.so..o<@..b'.~.84.?+fI."n..i.:.l>...Y.6...ty..7.b..."l..;r.~>.......<. C.".........=..<E...{':...l...~.y...n.{.f,.p.V *.Q.u.b...F.w.;6..gx.......Y.y..._6J.....7.p..`.*..m.....(@'.v.>b.0.<........eZ.m....n.u...7N........iN;.F....Y.u..f......Q.....6.-....<..2..G....^v...$50..#q.AL....q]..G......h.8..%..e.....b.../...W..<#.(W3..{8.[9.;V..h|8..&].)..kVk$.Q.u.6-.

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storek

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):530
                                                                                          Entropy (8bit):7.593673192385571
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:gLqVKd/1PVavaVR3RpFi8AwWXsMJp+EtVUefUU0Sn:gWAlNVkaVR3nFi5X13WIV
                                                                                          MD5:372CFFC33DE9EF304A0E0454AC2A5A27
                                                                                          SHA1:F01DD6943FAAF4C205D1B22C5CBC2B30E7019533
                                                                                          SHA-256:EA342226CA8CCC14258E1660B28874F004FF72967F8E2B567E6EAB98659EB07D
                                                                                          SHA-512:C48C7B6C3839D3BFC9A0B8C0F322A800EF16A4A4D44CE040E1603832B216A7EF2E291492EB23CC8D96C374447AE2ECCDFEA6EA8E4C39DF2A0C3404018336830D
                                                                                          Malicious:false
                                                                                          Preview:O.vb..xpgk.y..."..`+"..Ll..G....[....+"8>'.A.YOd...Z*.S%W.r........p...#3.r.....]..l...........G.^..e...0...<.../.+..A].X..._B8c-...9..>?l. ....r.[.... W.sf.q.-....!..^.d=........j.......!.0%.K@PF.2.2&We..'t......0....i...,....R....wE...U.`.>:.^z.&.g;w^......j...( "..vZ..(.|O?(9..Hh..o./....Ij.E...=w.../7.m.)..).P'B...b.H.N.>._.%g..F.G...W.....%.6*%.Q....Tf.&......@....Z.y.#F....|......8.C..]+.`+2.]Q..Zj..~c..Y.*.9....3G!..^...~/.+L5.&D....6..~..(.Q/A..KFTz..X~'=.d.[k...................<0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):14722
                                                                                          Entropy (8bit):5.998454865117248
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:WcqAmp7Ni/Pb0lZ6mgtdHOelGdWaolvsTxEg:op7AwejJGxwGxB
                                                                                          MD5:99337845AFA51540A9EED695EF1A3C80
                                                                                          SHA1:4CCAB9AF636D739A1B77ED69FFC72CEB90475730
                                                                                          SHA-256:37114FAF80F2F293BAE9AFE004FBBDCC5B03FCC81FEAAB92A5BF1C345BFFD7CD
                                                                                          SHA-512:90761299B5D66401EDBC590A7703D787DEAD484BA1164150FD2BD15C8AA0DB88924A3AE398D14580EAAA2A78EF8001B62AD1A3E6E04D8CF63D2BBEC4E73786D9
                                                                                          Malicious:false
                                                                                          Preview:I....c/=.Y.x".S..Q.R............9ml..pD.AT@U...W5.......KJ..i.Z.f.<....]vR....M+..3.X..~^.%.....i:K.....c+...|.R........^..27n..I.*C.U9.g....6G[..!...!5......d...C.H,.u..2S.....PSa|].s.P.h..b....P......#...x.g......P.!...<.8.....^.B....0@=..%_:...*..f....]'..i..Y....q....}1.I3.i!...z.h.!.=C.DM..@._f......P...^D}|t.Ay.j..t.....<...@...".....EY..e.^........D..G..z.,...i.[W./+..`.h....E..lqgp.N..c..clj?....M..Gt..4.R.>....^..yS.MO..4.5./......J...+].......c..)>.,.V.'7.K..G....blL..A....{.b.._O.WEI.M..7=...'.....%......B.do..t.|l......fi..a.L....z.......M.....g.....[.m..F.l......PM>xs...3.._jdj........... ..n.Q....R.4....5....|pk.z......la........\;...BB.Jn.N.%.......x.j.......n....RH..}.c.......$c.w6dZ ...v............W.....X.:....Z8...".b.|..).hU..yD.n).~b.?.z.Z6......#e.B...b.w......s..a....6{U.,MFd&..L.A....8"#_V.Q._...9.f^.5...oJ..."..u....-9U.U...].1X_....").R]..;...v.""<$.W. ..=..I]...g..T.Y.....9h.t:....cs}.FN....!.!..&..".H..c

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):302
                                                                                          Entropy (8bit):7.206612542281084
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:v1lREwHaHzz5uY1xRGWEl2JKDLU+r/dClz8AgVOMNCYn:td6Tz5rtGdbUKk2AgVjCYn
                                                                                          MD5:8EB7320B850A0C347D5D918A86FC09D6
                                                                                          SHA1:C77AA67099C309DD954AF00F4B86D8382DBA1382
                                                                                          SHA-256:2EC8BB21329F6A251083DDDFFACAAC4A77912CDC85A6AAD59418439E452FEA09
                                                                                          SHA-512:F25055026FC60EFCD371BCDF7774801AB07DAC371846F5E58911A06AA31895497C8C16EB031F58229808A891A4C6A4FF0C4C41E23498FDDF6AEF7AE093253DD3
                                                                                          Malicious:false
                                                                                          Preview:..h....7R.+.e..Y.=.Y.b-2?.+.20........U1u.....Q2 u..........v.@A.W..e"$..:..&.s2.!.M...tG.i4.!.1..")....%Z....>>..j/:.(\.rsy=.=W.=.8....{...*.E...1.c.}...|.o.jN.4.R.m..F.x.f.3.%9.v...@'..c.=..i......"}4^.j.....=.E.+.......Z....6.....<.u5.e...e.[....( .L...}.......(.,.Fp.a.......0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):320
                                                                                          Entropy (8bit):7.339172382298218
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:e37tRGzlwEt/JctnUJDnxjL4/UkVHWdxUCV4jx8+tn6jCbTkIaSN7n:erz4wMJctnUJDxI/U9dxdp2nQCJaSNn
                                                                                          MD5:AA6C87D29E16C6031F8B613C7930BEF1
                                                                                          SHA1:685B2E2C0B275FD3A62AC425EC3FF1F35A3807FC
                                                                                          SHA-256:369BD13672BDC987FAAF8C4C36E487AC782ADB2A828BE50DDADDE71CFF2A8353
                                                                                          SHA-512:C19D49157E712C49340D4F5D77AFDD8A573758DA7CA3C82E60FD5C50B3E4AD3F6CB2F07CA5F731279ABFDB5BEF06304EC43824E41A4A8CA206F53BF8FDEE6019
                                                                                          Malicious:false
                                                                                          Preview:G....M[.t....+...n...m~.Q...\&0..O?...a...9.b........&z.GHp......*).o...7......r..6x...*9.y..6..n....-.g../..5]..h....p...4S..R/7K.\2..9;....0......q..q..g...yW/+.-..fP.B.Ii.3.|....0D)....3...v.2-...k.b.y..g....T}.......+....Y"!"..wW..Z/............P.].W._f..}..e........C.k..?.<ly.....X..7T..N0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Adobe\CRLogs\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Flash Player\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Headlights\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Linguistics\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Adobe\LogTransport2\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Adobe\RTTransfer\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Sonar\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\AddIns\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Credentials\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Crypto\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Crypto\Keys\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_9e146be9-c76a-4720-bcdb-53011b87bd06

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1226
                                                                                          Entropy (8bit):7.8329824259237135
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:jg24qaAOjmhwLE8E9AbMSw3+1zBQaOznl6bOVzTWE3MlEj0T/:k24qD7hE49AoSVCaOTQSV+E3vIT/
                                                                                          MD5:4FDED9CCD793AE764DD5DD1286DD9F53
                                                                                          SHA1:11EECE90ACB39555B2FA45F02091B2F7DC81C79E
                                                                                          SHA-256:FF16A0F5F685D8901CB217AF8AB2A9773723C7917734818782FEB9BFCE1E1840
                                                                                          SHA-512:1700D677C17A7AD18071AF793AE73AFC157293CC97C82765CD4C6C405A89069C3D0D7C68FB4D47963747711A1820BA5A8AC10CB3C7F85667D2915962A19B4DA9
                                                                                          Malicious:false
                                                                                          Preview:....N...%.h.Teh.8].mb:N...A1v...'.....V2..xC5..$.}'. ...h..F....".....\.0ug./..t...D.#2.22..'.g...z...2VY..v.{9.._e%.L...#..@.....!V.:....M=..E..yicY...-(..`._..X\k..Zpy...sa..V..I2....."..JX....S..b.9.A.......2..|g>..6fA{..!.........'3(c....X..(..I.o.S>.h.............V$2...rw.rW..#........Qa......t.d.....!.a..l..&.\c<YN...3@..[T..K.N...E.8.A.....5Y.H..EX("u,..*..=?...[.?.s..s..J...E0..~%.`.Z...KP._.{2.t8....1.7.$B.......dP.....V...I......{........g..Vr.. .c...iVy...F..e.A.Ar):..)..B..7......y.+4.......%..*.j.l.*.s ..I..8...c.c.{F]<K3[....g..%g.I+tj.l...Gj....x.zh.:pc..I..*.?..~...?./@....c...J.n.Y....[....Twx;...r..W.....@.".dG.f%...xA.d..uxW...l.K.n/..4..k.yS.....U6....jx.|......Y.='.@....~.Q....n.aP!!^.g.6._.F.....e.j.j.+..Bv...n.........b.......S.qT'.......a.D>com..I5..d..9....R.1..m.........KT...$...6.7.2....!C.h..r.._..z.N.......2.q'..VU......j.4Px.....RI.......?.M.......HN.F.9.....r...@...R+..V.uO..H...r.......,...k..reP..Fr.O...L...

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Excel\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Excel\XLSTART\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\UserData\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Pbk\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\rasphone.pbk.yiJP

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.223099278604143
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:aw6PTZXTTdWTkj/yKoi13wYfBRDDPrwzrbjNpRsWC3sALgqQlSVNIpQUtmn:aw4jja6rfBlIzHjN/1Ig0OAn
                                                                                          MD5:EE3A2AF95B046A7F00348BCEFBA9BD09
                                                                                          SHA1:51A75FA51B9DFA5575F1B6EEA31873513A2F6148
                                                                                          SHA-256:0DC4F0E4515335C59FACD52F37E61DCB94F0C072DC60207562BA188B9087CF47
                                                                                          SHA-512:90E1D35E6BFA1B77D5F07FEF0C0282ECF9D3AE123DC7103C9C6BFC00B970A35C6E2C4AAEBD22BB6F30410EAA70A00D1C75A7399EA9A8FB36F4E00832FA5DD97A
                                                                                          Malicious:false
                                                                                          Preview:...Y.9...<.].............u@=.6fN..#-S(D...|..2.P..C5.[..>.../7....R.Om...G..I.T.'B.>...k.5'R....f4.q..iT}.U..0Yyr..W....^4......w.....,.t...S.."....~n.._..&..(.g.{.r./....x..5-8.L.H.!.KX..JJq@...h2......qa...*G...._...R...;......u...O.....v..c.6../.%m..=.?..tp^..=..~.yR.0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Network\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Protect\CREDHIST

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):290
                                                                                          Entropy (8bit):7.185368067731313
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:ZEJeWOcpxZYNCCTcuA9qJ4/EwdJcqUV3xGeMUiA1khf17Jcpz/3Zn:qQJcpbYNBP4/ltUjGeMUi4ot0/Zn
                                                                                          MD5:80A0BF6E4ED02B62D357E5268F623487
                                                                                          SHA1:B151CCB43338A0F5D53AE50A65BE4BAE96BDDBBC
                                                                                          SHA-256:B5C991F259B8410CB48EFDBB71BE449F6FB28EA6B0C8C85663EBEBFD874F835A
                                                                                          SHA-512:46A7DF831DDB171313B11888EE69BCF5976D0C01BE4A608264389560CAB0BA9290F681D1982E90FDA3D6D5147D4E449903F3C5A888F3CEFA9C11BAAB41723168
                                                                                          Malicious:false
                                                                                          Preview:..Z.....9.;.l;.G..q.....G...?......L..eC|.[2...}.".;T2..$=.O.w..r?M.`......Tl..@......yn.0"...;#.$}..p}...,.....6...i.....X._...............4..8.YYW.y......6{r.0L.....&..;YZ....p.H.....t{/Q.9.....s.||.(J..Z..L..Dl".Z....x...{E....Q.B8.W......(..r|y...g.^|EB'....5R.7-.F,Z_..0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Protect\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1002\3f1b70ec-2d1d-4c93-9a1c-a7a36da68c8b

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):734
                                                                                          Entropy (8bit):7.7405221939628515
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:BSwD9E9YyxI2fdeSBuyJ/8Y35I0pmc2Be6NNqajbkWv4CX4RBNuQzziBpbVF6sgh:BSw69BK4fuymYpjz2vNwKkM4CIRBk+sI
                                                                                          MD5:E7E0CF2118319D6A5CA56578202E5550
                                                                                          SHA1:3BB99D6B7B1CA486A513B9D72C9405D781D7EBC8
                                                                                          SHA-256:0874C1E822CFCF9AC29BC9483EDA675D8AC34B3E1FFD5C3B79241FAAD53A5A4D
                                                                                          SHA-512:D27ACB2D95BADD1FED0D9962CDF4C0D31AF1891D6D66C1AF41F30B782CF8F17A79C2F5927CB05AD6BAABAF617C2A314AC1F07EEE8FC9B2519785AFCA6E6A4F77
                                                                                          Malicious:false
                                                                                          Preview:.'.OC..'..h...>. ..)}..*....L.W}...`bW..}T.....:.........=....x..V..nC......Q.5.....>....}:.#....<.8.....>.E..*.8.7..,[..&.....9z.Goo...:(M.$$.K.X.... cR.Y.13.{9.......*..R.....R....).M.&p.#w..._>m.........o..._.AAT....CK...*.X.de.W..6.L....)nJ....>/...4..j.U..17#`...*..4..v.f......p.(..o.........p:...?....u..?....:.....\..r7yy.M.....@d...j'..)(KW..^...t..q.[.........a..(...{..'..G.T.....h......=(..M._...m.(...t...[.M......f.Yv......0...q.0.3N\q)......O..aK.;.FI.p.....]....:o..W.o.0S....D.b.Z.qe..e..P..........&.........".Z.Ba"..R.-E}k.yF....H7.,_..F)...&..lk.@.L.>.7.k2.R.n..?.Y..._!Q.4.V[pe.}...`.h.$..=.+.Oq.?.N?oC.".#..F....:.......+s..^..fE...Z.i... 8.......z.......,.%...0..h.0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1002\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2246122658-3693405117-2476756634-1002\Preferred

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):290
                                                                                          Entropy (8bit):7.3507962348038545
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:qhjuy97FwKYs0FixIuuzBYhwG+aHL+0/xKsgFvtLTudxuXRsOhHn:Sqy9Fwbpklhw3cKsgFZvRLHn
                                                                                          MD5:5F066AA43995F9D58F6CE7CE8D271EE5
                                                                                          SHA1:44D125783AD6BCB6010E0E62974F5BE93732F3C7
                                                                                          SHA-256:AF13FBCCBF497721099D0147CDB3BBC3B6ADA355799F80E68A76F0DED7713D1A
                                                                                          SHA-512:9BC0C5FDD64FF3DEA7AA530266648D4AB64BDF17BB22BA13A31455ABE6017B62424FCA60F0D376662C2D4B6D488053200693A6541CD04F2C5D1F7F98147ED675
                                                                                          Malicious:false
                                                                                          Preview:.5...G..eN....e...._.<..%....r..Hrf,.....w..x..5 )_..G.'4W.f3.h..Y{.=.j.3-.y..X.....V.....<..Q.K.E~.#q.....P..7f...V..a..6p....{z../...|.A........4.U...f.9......*....o.J/..m1.aX....O..........|..z...{x......`.5.+_U..-...n......\0F..#u....6b..u.6[pc..:...Q}..I@o.........0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Speech\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Spelling\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Spelling\en-GB\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\AppContainerUserCertRead.yqEl

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.108225908207189
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:KfQ6QIMEoyUT1ps+eovfIU5Tv/yCxmOSiH+gYJyeT9qsLK3mkSn:KfQ6Hloys1OovAMb5hybBbK3wn
                                                                                          MD5:B1B2BA3D5D92B014D73728832E6DCE2A
                                                                                          SHA1:698218AC4D34573BDDE54138A0009D109951EC0C
                                                                                          SHA-256:3FE7EC8762A204AACAA8C9E3174C4B2BFCB6F525038ADBC94670E2B8204F7F6F
                                                                                          SHA-512:56DEB07D67D98B31A927C369913FCC14479768451FC0AD9F585E94C92C768E0C1DBC440E81DE1A127C3E6343480F0527F76A10DC2399D4245BE9B9B782FCC7A1
                                                                                          Malicious:false
                                                                                          Preview:......p.)._s.A...........,P.o.i..$M...W.7.FI<...[..*C.1..._+de<.7/.... ..AkE.......m.....,....\`..qUf....|#.-~!.g......D8._.!..j..'&...o....3D.A.B.....&0..0................a..2!..k".g*.h......8sI{1s.N|...d7{]J.WR....C6.DE.T\Jh&1WT.J..W..,......{2x....A.......J...H....0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):282
                                                                                          Entropy (8bit):7.264256715743548
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:02yLErZINYH266K5mjcxspYN96v56JLkWgBKyOESAYL49ns7Yn:FywrZINfM4jcmtv0wWmOESAYL49SYn
                                                                                          MD5:EDABB94C21AAE7BC5B4FFB1C162FDF4C
                                                                                          SHA1:9A45431F859F30912FD4658021801EE365A3E10F
                                                                                          SHA-256:3D9843025C080B355603CC322663CF1235D6BF77FFCC7F31E0F28F1C8F496C66
                                                                                          SHA-512:4D869231FE3EBCD1A948BA6AB7A29183CE7F99CB8D8821CE7A5697EE36FEFDD4CD41E9F792F6FE8FE2E2211A59B73C9C2CE169C017CE9C8C23255C5BCFBA4148
                                                                                          Malicious:false
                                                                                          Preview:a.......7..9...y...L..Z#._...y..|Q..k..."jgj...G..k..x:..Ip...@-oe9C...9..pT..G.^...;..-o...@.av2Y.[..D].E...m#o.....&....`..h.6.X.N..xp-/*)...J...4^...%.-....`uYP..G.NU....C.'x..{... ......F..Vr&.I.....V..m.8..`?b....D.yj3.Q?o..}..O!k...i.j.]d*_`.@~.y....0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\UProof\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Vault\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\AccountPictures\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\CloudStore\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):1284
                                                                                          Entropy (8bit):7.862939237833893
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Ek8WzeSYPGR0VIvDdUDwQEoUgj8YHY0PmNHE2uUSDUEEaeQjp87toKn9p:/weRIIvDdUDMYHYomeFiapVa/
                                                                                          MD5:41A6306E9645B38BE575CCA7EC997809
                                                                                          SHA1:4806643128E65FE597C83A607328963D3E06D4FC
                                                                                          SHA-256:F6DBB31AB2683FC1FEF4F7CCF315252DFEF0698738253BCC7BE1678B809E8414
                                                                                          SHA-512:FBCEE853A15248E5B7B6D442CDEE307BC6CE75961548F4097673EE660FFC6D2D2A1098776C350A8F4A9C57CA88C50F2FD74CAD0E94FBFEA560C1064957BCEC14
                                                                                          Malicious:false
                                                                                          Preview:...<......_.c......;.S..p...6.(..jH/L....q.0q..r^..2..'..(....26.l......,z..cA.X~..D.I.sp.0).u..`O......M.....l0...G..a(..9......M%6..n.h;i.H.n4c...Zn......5....ZMl.^..............G.;..LR.k&...{....P?w....8../..GC.......s.^wF..Y3...l....<...z.^j.+.h ...K.so...j..+.....+......HAO".QW.-......%.Gd.0Xy.`.R.........c2.Ct'a..K..6........h....S;.#f.>.!.....p..x.ng.....m.W..$C.....$......?.vw.NA.0. .o!Z..=/.....W..b.T......F'-.f8.[F......{Z...f....s..B./.o.........`......".a/p..)7....muzF......V(.B.......FwM...DQ-.:.h.&...._c.b...u....1S=.=..[.R..."k.-"....H....K.,.D$...2..+.K.U....*......4......%.$..u..j..J.MO4......w...`..\..7..#...O 2/.;.!.z.................._.E.24...R....(.98.Q..U>...I.k.u5.4.._..-O..z\.l..9.[.t....7!..S@....k..U.?..r5]..*.C@.z.f.....d9.....f.%.=JZ.0$;k-.1......3.....8..r...{.?V..".V.....%...g_..N.."1..Z..5.%}.o..g.S.8..#..{.a..r.p%.A.g_.c.Qaj..2o,Q..utk...............i.%!].z~..q0X.S(..Y....T.@..H..O.m.I..u...S.

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):2356
                                                                                          Entropy (8bit):7.9209498569244365
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:kTvCzLlB7O6ovVOIgYwdoSyjAMqHiGN4NEqQT:4viLqhxgYwdipOima6T
                                                                                          MD5:9EC72A1CCE4F0812A74309D81B5D0839
                                                                                          SHA1:B1F1BDA5ED93814EE2687EB0076DA54904A730C2
                                                                                          SHA-256:9CA39425474F92E956895C9D4981A39388382DEC1FB97B962B487B420A85D4E1
                                                                                          SHA-512:F15B73DE21A3A27FD8CC823AA860037641D7DA3D0B24B2AD7D30ABBDF1E82C9CFB17FC9A804150DD0795E1E01B815321F967D45AD1818097F2C879B3E80C5DCE
                                                                                          Malicious:false
                                                                                          Preview:K.gf.J............<.@...,......F....Y.6.:..wa.Iz]Q4.....+.x.."..e...@.Ew. .u1.j.T.FE.J.42..{....y.:.w=.n.x..C.B.w.WVK!..._(,..M(:V..\.c.Yc~H.....i~.z.(........W.V..C(X..]..<3..Ne....).uM..VLW.....;..v....>.V.*...t0...66....=Gp.Z...?Q....Q.%..(..../.."g=..t[..%.b.....F......s.....r.[/.?W....,h. Xf.\...b...n....P..n.0.j.7.TB.,'..+..5.E.}`:.A*...a&.NF..}.3..l....KF........]..j.0.6B*l.$N..../8..,...../.w..1.....&.+.k.......N:n.S<R..@.....F-@7x...f.*......wM.'5..0.*$...D.{...........*.8c.....L...............x!a..q-....$.m....-.]{K.(W/....+....n..,.@.-.........j.[....1M......B..Q..!.#<.s....\..uq..'..}[..6......v.y;.;..H&......\V......7.......#.......}..V....#.....z...[.!..h.g....;...R~.P.Y.Ci..J.....Z.5.6.S....."fD.Hz^d0r......R...Js)....L.%|Dn1.......q...0....*.;`:R..B......*.....2F...s}...`.p16.....?..V.`.....>..xz....f5i.L.....96+HB..;.....=z...|DG..Mw..a.y...n.P....f.:..?.,...S<..B_..;T..C3.T.......^&....(h-.u...ld.S..

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):2313
                                                                                          Entropy (8bit):7.908687742920132
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:t/epKnsowDCc92pOWiYFTtteeRWZ9Ns0VgV7LEf8hZyLCoVx1PhrsYYQjxb0g:YLowDC8WOKTqfrVgxRZy7x15eAb0g
                                                                                          MD5:FA4249F8B50C38623C5A4C2A0F51608A
                                                                                          SHA1:43C3A9987C51981AB124BE0939E18EF44199A954
                                                                                          SHA-256:AC65D4107530CFD5C941F29F0332AB35013C1DC4DFC46EAF8042EC1339A91B22
                                                                                          SHA-512:BCA7BC9C6870E71CA4D962F19A8DCAB93F73889B3B4E31DB9ABE624120FE5A33627478FD057DA906C37FB72C8DCBC3EF874FDC4A5FB34EB5ADDB078DB005457F
                                                                                          Malicious:false
                                                                                          Preview:[.#.x.2+../.:.._......+....].9........j...ckr..y|Sf..x..'G.L....,..i.O%.s.U..........Q~"...~._..n..8c...6.G.V..d..u...%.1.[....~......T..3.CK......)AT.>.E...f..8&....H..M.....O..,.G..+..n..0..+...........a...o@....{...%.....d..f....s6OZ1.>:>f.'.z..y.v.O.+....lAQ._J..p.X..hcp...O,B_......\.P..`..>.t....K..V....s.tTK5.H.'R./=+....h............:1A..!...u...s../.JT.r........MX..A.....%!F......d<$}hVj|.v..(.\..8....f.P.a:..;Q.HD^.K....[."$x...A.P.....6hA...:....'E....c..J..G.>.QI.b!....#Z`H.R.#..h.?..O.j<...c..K.~._d./.X]~O......2..{wD....x.6[..P..+..6.+<4EL.4V.0...em...iBb.)e.Ii.A.....}...s=.c....r....}.......xb1..X*E...@d.?....w.N...e......g.n;+Z..xB%^.|_^.?.. ......^...o....orq)*8....ot.. =..+B......TI ........%A.E..y.......s...e..m..TW.*.O......A..Vr.]t.:z..l..@j.{3\.B3~....b..5..]I.....}...|.|Wo..0.?./.^?..>.n.n2r[.......A.\.y."1..h.l..i5N..s.....c.;....&.&.BF.E..%..8CD.~.9..H.n.^z...6.uW}.c.G...N?.,.......P..(..'....[...~-pd./.

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):2330
                                                                                          Entropy (8bit):7.9299833955222665
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:6KfexlWhe+8cWuISSbOPQIqf1cFjCyaoTd+1puai1oxMT6LkAcpH:6KfJhK+j01cFe5ERT6oAch
                                                                                          MD5:15093F8E36A2E8BAF02C425E5CA5F7A9
                                                                                          SHA1:13A9ED73661E467EF69E82DC3107D4BD1229DFBA
                                                                                          SHA-256:BF3D35FC4D4EFAB29BFC2EB234D469D6DDCD1D1EB5CB43D6513471FC86AF8E8C
                                                                                          SHA-512:FA48C37765E512B3C2487F4B9145EEAD02D9F812CC60383F7B9C793094311A33C3250980A9092094A116D93A758E177AFC2965906CE2D9EFE137CDF57D11B589
                                                                                          Malicious:false
                                                                                          Preview:......H.o.d...........+....%...?...JJV.....83.......j..E...6S..RE.Z..[.a.E}.O...\.VA._.0..... ....~./..M.^..G%n.=.h.;....wE.@.!.....l.3....i..9.j.....-..`+..h.m....T.N..v'..bl.....*..>8....z.....oC..u.j..(....v.g....T..^..S..F%.!8...C...h2#.......s.....+.^U.D...'..p\..%TI_.r..b6y..w.K.c......."K.V...?..7.C.P|d.Z...\q./.~.#.U.w.h..0...I..~... ..N...m.2.0...^.l...B...U..q.kG.....3.*...x.K..%.....R<..[(.....8C6.;B.^LLIk..)!3.....UD.....).:.,...l.=..\h.[..J. ...n.............Q.b`..!.....[~x...'fT8.1......J...N....~.e.X......8.j....?.Q...|.gF^y.RT,...P.`..h..T.^..H..`...ZD....>D...k..O......E^..`. g...t..e.`8..&.N..YD.C.Y.......am.Y.)..j..l.{.CX..(YtEv[...y54.w4.G2.?"............|`...{.o.d.AN1...o......Z........}.Y....?...z.....|.P.}.'...+.9G.q...^-.L..xlsj..PL...U<.|...G.@<R.9|..w..<M..q...f..K.2......Dm...G.}...*.......sH9..m...~..rN)E..B.7.a......{...t.jw.L.....|(../..yiLz..V...'......e...z..{.....M5...c..uM-5.f............jSo..[3..L.6...

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1290
                                                                                          Entropy (8bit):7.866670952493789
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:WOc72vIorAsqKxviTh19JFK7/oCXbLtstAX/N95e89L8q+b0t+:H1xrAsqKAQQGsts3e+Lt+bI+
                                                                                          MD5:99B76C49CA56B082B1CE544B25F6E110
                                                                                          SHA1:0AE0CC75E6232891546A59A75D547F4CBDAB67FE
                                                                                          SHA-256:6430C49232744F86EA71ACA41FEDCD392C4879EE257855F6DCDE45A319016129
                                                                                          SHA-512:7F050E187F9870DBDB53B1B22967C679F2C169FCE2E07D7D3D6DB2E0D161FF906438696B6430419587C48F693E4AF5D06DC147E64AC55ED37D3212F551BEE887
                                                                                          Malicious:false
                                                                                          Preview:...)H...U..b.e.7.........M..Z<..v..<t...b..)..X.6..?(...M......uuz[.0..K.Li.I.3..i=...n..j[....U.......4....T/....(.T,..QI..Q..&VO...".1.....q.o\....Xt9......K..}....!.3..._...bq.r|......w....v....l.._.-c.(.i<.HU.P9...`..O..r-&.....Z...H...<.c....4.+..+....9...Q:...!........D"..."K.o.....y.j-#i.i.._.y..p.a....U......Yp.5.t.cgaa+.h"......>ML.g.k]...w.',Kg9........U~(i?.n~d!.vn3...'...b.#....f..|...C...4...7(m..wsM.$o..).........%_..R.., ..\...{......N..<44..,q .-]WY/?..i.kh./.j.....Y....a.$./#....[.!.g.....p..M..TPK.>j...`.......)....La.........jS0.+......L.(;.'._..>.9..0|.w....s&.d..\s.!....w7.s......................~......N...2Cdp..TP.....d..#.h.e...:..u-.c.....d2..... ..q.F.bzL4......].6>.0..@Z.....*.B.68.,.~v3.4F.<.."..$B.v..eF..#c...1.h.w27.n.i.........1........W..&....u)\....p~.A>..?1.$.S.v3H..........p.a'.`....U:...X.|.A..j.>............S.^.......V@..$.......(.o+jA.....#_X..3R....,.E....@.C.@ ..F.Y.9.H.]~xx../o...*#....`...

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):2341
                                                                                          Entropy (8bit):7.927858543602471
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:kSy+2bwA06VZvdGwojsOSP+wbT7ei5y2D05ApVlTIgu2g7:ko2bamwjsOSmwPdAgMwvDc
                                                                                          MD5:8314ABBE0CF34FD42FA3353698959E9F
                                                                                          SHA1:FA420A935D8F8981A96C00C0F42DBA3EA9D4837B
                                                                                          SHA-256:3A261C1781D65CB241D58FAC786B728DDC1AA48BEDFDE7C9EDC97C9D14F0023D
                                                                                          SHA-512:3B4CFEDF8FCC81C0A09FB229DAC483F7BABE60B318BAA647871F382ED656C59CC8616A79CBB198FFA20BE1442A1C03426C713BCEB6596133BE63936764F59BCB
                                                                                          Malicious:false
                                                                                          Preview:.._.<.....0.48..z...i..^fw...~<.m/].......b..:.R.c..:..ciib>.).W.#...>o<.6.C4.t.g.%.....$.U"%@.u."..W....7..k...#?.7~E........2.X6..c..o,&#zzl...K[.*.S..2...J....n_....<B^7U.*..cP.....SM?b....8.!8m).U.?.......Z...W.[..`..Ha...T.e5d....`....u...a.sc>B......O.K"..g/T........&.........hb.5.F.2.'.A<......G...5./.J.Jh..@....,.=1Y..!...H^..\.m..@....&....^.-....Uo...E.D... ^....&.W...pt.f..q.*.....G..G.....(..gA.1.I.5-Y.....TF.V...M..../...cz..;.Rnm.1.x.......#H..G{..canS.....rLa.@.8l.%x.#`N...y{.p..1.....K............5s.`..fC...0O.v.(...v.].`..v..,.O..}..M~)__.#W..s..AA.....&hK?.N.......A5.C..s.}..;..<...#&..c.......m.$....{..... ...Ca.(..p..S?.8.H......=...H.{.0....7.C.:..A>:....Y ....sJ.Z.......o.|..m.H.^w.8...s.m....7xp.=...X..F"9.A...>3..<T.O..c..2.~w...n\..N..GE.0\....s.Y....|J.~.....^.H|..n..W..q+2R.,.||..aG....J..>.D..q`.Gm......>.j.....D4....L.v..Cj\.qTS.98;......H.]..L........R2;id."(...~.2...{.j./[.3.....R...x..a...^.|.d:Ji...!'.w

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Network Shortcuts\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent Items\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1802
                                                                                          Entropy (8bit):7.877372032087085
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:7TddeloeaX/lwyfsxhhsUFvVB6pTwqEiqk/:7T3elod9wyfUnvVs6qRv
                                                                                          MD5:FE9D7BFC11EE0CAD2FFBB67CF50E387E
                                                                                          SHA1:EC05BF87D7C2690EC4CB46A8A4616DF949FCA18A
                                                                                          SHA-256:17CF37E4D5707A32D8F37C06F97315EFF2E7BEBE2C650EECBA26611BA1C16E85
                                                                                          SHA-512:6279F142EA21276ADB366E46C57E01DD46F1C0D2DEC1AACF35A4542A3CB1449D6185E271F8694C486599538E5E4F39805BB78042FE48DC5E2840958083366BE8
                                                                                          Malicious:false
                                                                                          Preview:'...@...g.4..=.B.....:EX#RJ...L/g'..g....|6-.nN...dV.]5.X..l.$m5...w..0...p3.Y..FU.6.H...Y.yo.H......p..R.U.O.U..*N&I....... .z{....T@.?......l1...H....D.}.!.2.."..Q.......-.j8..2j..#!0H...QQp7.[{..7.X...T.EV.H}_......<..7n.a.CeQ..Bo....`T,#l...N.%]..Xz`3....Y.X....M9XI...[-0.......)..$...D(GR...B.VN..J5..!.......c.W.i.v=?$.:.4RR....X..I ...Y..P...k....@...t&....D.;.......M..F'r;.....++4...PN).0.R...}..r...Z...&..*p..d..K.&...%.I...BE..S.4Uz=.|...*]..v.L..c.o..T.l...,.....L...AV.....A...~`........s.I.j./.|..V4p..".....bE.l....F.......I.........>J@.1......x....tz.|.`C...?.nH-.q`RT.....X... ...............la.LJ.`u..I.w.$.N...p.&...T.7.j..w..L....S.....gC.......;.#.K*m..@.sa....\..e..~..S..@.... ..'..J..?-.7n.>=#...`.T.........Gm....I_.;......%..ak.UNS..2....2.1Yu..9..tV3.h.^..G/HJ..#._2l..;.K..;...Z...YME..U7.\#..d..)R..5.sG..........:.GQB(..L.....?........sn@......I.%..*...,....[..}8...@w.,A.:9[..&..\J..vH.U.u.%.X.V{..f.H3......8.q;.-BB\C.

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):5898
                                                                                          Entropy (8bit):7.420045826065581
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:8DwiojIfqbBdD359AX+j8B70a/HhC6r7+wZLtmAdRT6KuQYMA:8sDjIf2hCw8B7DI6rHmAd7uQYR
                                                                                          MD5:431D0994743A71E10E67CA4FE10D7470
                                                                                          SHA1:B03B9104531F9CB7D067B81B4B2F7D7D337D052A
                                                                                          SHA-256:BAB5DA0DCCFB2372589245F19999DB13359567E35A51DEC9F8736EE61DCC4AA4
                                                                                          SHA-512:D732B1E102E8ABCA91E857AEE7EF799A0FB8BCB9F988A866068DFB7651229329A173A0EAD30F1AA9EBE52145E08944DB513B3E533C48DC960E58BA6EBBDB8DE4
                                                                                          Malicious:false
                                                                                          Preview:].......l.H....[.J.Jof5..'.6b.....>[.Y"[A.q....e......r......^..r.u\.CF....R.2Z..rl..t.?.:...5..,...4...|..A.....U.SW.X......F....`.^.c..:..o..l.z... .D..."....W6..........4E.5.c!....9.Jf2.qgS..._.35.FN.....%.W....M..CU..!..r.Q~.......By$.......J`cA..US...r......h.G...@.....<..).....S.n.{.....>...g.+....M..a..^:..>.......M....x..J.g....&iU..^S....R^%.)Z...t5j!..4.j..D...tU....7.(..8.D....:..F~<8J.^"..6..c.r. .'>.b..;Q..c$..7.,....j...E*A..R..G...1..I.in..CSpD..>.2.~7...Bq.P.x0..ww...^j..`.@..n....c...kx..x9...F.!4.Z.;.sB.x.1<.p.*=xe*M...XB...x.j..j.E....#...(.I.s...`(.\.2m`..b....U..].......~.;...F....G....................).. ....B.f...P.R..q...-*...h.U..-........U...|....t.9A...Y.-...)........C.,..8..A2L\{..h....bd]O.........z-&..)c...@.......w..R..`....`P..".c....(}.;>........~..U..:....d.x.9.]..#.I.l.0.M5j.....*..3.s..W../.7\.$..q..S...o..i7....g.d8J..w....I>.h...*.V..uO.0.N40".X..w/.....kS..5...#q...3.!... ...;I..np.D....Q.0Z?..

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DRBXYKCKXO.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.82887627205558
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:CK8NfrREL/kM6T1+7IReA3qxdjEBd9WEX6AuNVMNhD5ct5ABao7IoGnwV:CBfiYbRReA3MhEBdTqOhD5ct5Q7Ic
                                                                                          MD5:3834CD35D81B75CC71B8F92F7ADFE90B
                                                                                          SHA1:A502A02341D92647B3B6E9DA8128219183E170B5
                                                                                          SHA-256:17FB2D4CA3E3BE14AE84AF7889EC5AF6B7EAEABD9FE1009C85751E8BB76E9A5A
                                                                                          SHA-512:9CB8A6869A2114A6579A5D2ED11C41B3752C7FE4FEF69391F9B08FF831CC8734E13694DC6D7D374FBAD1A78A48158D334BE51BD8CC5EEC993FFC886BD8C28E7F
                                                                                          Malicious:false
                                                                                          Preview:...`........?....WV.E..D...>....HD'.=W........!.Q..u...7..6?...XKR6...F'....Ovl.t.m.R..h.N\.....<..\6...n...`..4*?....c@?.z..H1.0.z....AF....2".3.Br.Q...PLR7|./....*.`.7..................E.....V..05.9..p. ..a,_]Ck..'...]..(w.m.2.....?.u.1.x...WVl..d.}..........{..a..&Gqg......&.G....`.UT....M...Q.).[..?#.#J.N*y.A.....ze.8.B.c(y..I..a...<o...-..l....ph.;.....5e.$....IZ|..m*`.\O..b...A.....Q...}...O..4..O..}....u.jL..0`.....gT$.N...%..N.4.T...c"...r.W;...y.0.............i....L...R...e..._..=Q..(0...`V..C..Si`..F.|...b...=.m...@..`....O....t.1Xd z<#..F"Uo).W.Sq*..)a3...h%./.k].....e....PJ...5.@..ej\}..&X5..(..W.+.E..N...f.w.'..;..=.6\...I...]G..+;..#.....%..I.6..I.1J../x.a...HD!.aB.F.:.(.........d...\.........N....[.|..Md3$.....64.......}..(.kDf.x..N..FaB.P,...@.T.s...s....^@...y.._!....O..SP...w.]...\....^QC.!E.....wk./..g(.....+. .5C.{A......Th......y..v.2.jcb.gu.JE....w..{.R.?..!F.}..W._@C.......,.....3...........Dp...E.p....m.9..

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DTBZGIOOSO.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.860084739428974
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:7p1M7ZISgorv4ZjYyPZ5qSelI08c7mTCMFMKqx0GagUnZU5ICpOaOVrUCG+H:7p1M7ZXrQZjsQuKDLm5tpOaOVHG2
                                                                                          MD5:7AF85CD7BB4BB62997E2BFF72915B873
                                                                                          SHA1:4311B2265D1B78BF72CD08EEFA2439EF5569C59E
                                                                                          SHA-256:3668518D9CB231A9877B7760B84D882F31522A29438E17DB1E92DB31D21DD07B
                                                                                          SHA-512:F2C111A76DC9C8D598D835153BD73CBAE433A2BBD0B1F7CB9698ED14AEF091CB99EACD6E7FA219F3215FE0874AF333ED702D8D92CB7CC60CF011069099D1B6B4
                                                                                          Malicious:false
                                                                                          Preview:..../.y.w.2`P.N....q....MG.*\..6.d...fU....cY...&.|........../.....(?..4...R|N]G&!.. C..W.2s....e.s*...d....Ch.5Q....W....G{P..K...)B.EH..w6.T..wl.-GO2..2.;B..8....R..R... ^k.#qv...+<.:....kY...R.v.hf....W....Be2...X0N.u......z....@...%x...&.K.z.5._l.i..O....T_....O.>..3....-.Ze...#Mo.F.*.GD.S..a[.....J..iu..0.#..Z..+J"y.....].+...).sR.q={p>.A..(Sj.TQ. ...I.>4.4.x@'|...j...~s.)!z.k.1...{...P...i.Z...S.8'.....E.<.....x....W3.......h..!.-A..0M.R..+4.Y.0..;e....x....g.d]N).(..V....R|T. ..rF....l.7n...J.(6.....k..>...9.Ry'Y@.i...,..zq..=)..e..(..j....._.....n&oR.l5&E6.m&f..g8I..SN......}..l...o..O.y.....yz.W..~...[.Cm...6..v............)........;f.....t......+.}@..r..W.d7o..q.u.U..-.S.t=.;..j....&./.....,.63t.8...y}.8.\..=(Bd...} ?.........>m.w|.5.}.e.6....0.W..H...C.N...1.:e.-.l.<....9..h...+(:...hD.9.L..O..k../.v.#)'g.. ~./..x.."QY..k..NM..XA./.b...9.U.w....E..$a.R....f{A.6...6,........+..W.,.V9.1..`.#j...S..../..m.F......f.V.l...o..

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DVWHKMNFNN.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8532484025650175
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:hRr7BIJY1mRm4omCf7QX+65IPwj+cgB0MoICk:9IJY1Bmsp65dyBHRCk
                                                                                          MD5:652CAF7AF172D22BB5BEA65221DFAC0F
                                                                                          SHA1:E93BCA3DE6BFE9A0F5C21DC4977E8B580DC33BD5
                                                                                          SHA-256:10B248523209EFF757C5ECF167BDCBDD4A1479DB518417EBB18190E54F5314AE
                                                                                          SHA-512:2A36BD267410554E9EB40C99F2128A0B731F548E21723D3A78AC9C5C28204CC79177095F6D0A0892705082BBF861DE23F30D365306548F67D817CC14DC6B71E1
                                                                                          Malicious:false
                                                                                          Preview:J7$.p......%`..w.7/..j.....r...a..A..VG..e@.e4.a..|{*...f_.k..'L...)M.a..bg....Ms.X*mM....p>}.{..)l.. ....~G.V......[.!..x.(.j]Za..?..u..XB.u<..Xz']jD.....e.$.;..q..V.2+b..R..].!..t....[W.&Crt.gPw@*.Q.d..{..V..HwW:"...P.......p..u.....\}..i.{.....<.=.......F.../Mo...d.:.J. ...)n....G~.....3......f..;...i..qC%...0g....g!.n.....-.BN.q.}._-~..?..E.s......V.{.....rQ..5TCf...e.(..lK..>.....$.n.\T..Z..&i..x..N..T..a..]?+..0.....H...a..YJ...g.....!...;.}..e....[.(L.I.K...z.,......q....tv..\..i..v^B..T2.(........../..._...S.x.d.........4=..c....`.....IJ]...Q.8.M.4}..o..........i......]%.......(F.PS....8..y..W...!B2....s.....p...m.~.V7....lR=GoR.4A.C.hT.C"..!....w}.........]..W..1b#.Oa.]....g.f.YU.l.j.._&@!..5!-(lg.....Rm..o......w{.yn.b.d..E1....M..........D.KjR.7i./z..iu....M....N....$.y..s....qw.)D...V.t..p.<..Z...X~.....dO..X].x..,.....:..#..#.&.2...k.D(K.gR..F....t?..;.$..\.'.....o..Cj.%.......d.h.N...:.p.Y..a.x..........?.%U...1.7.7.KX

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HYGZTMOBZN.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.860557894174856
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:9kjoC8TOT4z8hqwDJKmzTXx5ZAvVz2KD3JScXiQQ05QU4RVByr/3PIijrk5NQiv:9cz86T4XqKyrx5mNz2KAcyF05G4rYi3+
                                                                                          MD5:4F52BF3CE19CD4C7AE2B67DB88AFB3C8
                                                                                          SHA1:ED36C0F6CF4D6A17E93481056AFA897AFD933C99
                                                                                          SHA-256:860F9D261A92D34EA3ADB7C507D063C0C72ADFC69542C9BE0D26B232CDC196A0
                                                                                          SHA-512:CD2CC0FBB1FD5A70BA03DFE36CD73EF1EB68B4F353D1E8FD774944A78E67DA22C4BA239AF75A1157363570C840B0A61C4C0C415427B067C2ACF3475E4E90CACC
                                                                                          Malicious:false
                                                                                          Preview:.................a....\. #...:.vD....+...]...=P)......T.8.M..|^~...@i...V|.....@ ._..-m.2wy.*(...4.'.rg....v=.VL|..#.QTb..=........sm.......O.rB6v.%.[S.C...'..cB..........M..%.<'6A/u._.."F.6j~x..U..].n.x.....=.h..<.0B..\.U.....L...J...}.....I..."...E.....`[.,.."o.....7.}.)qv..[4...A.y.m?zgd.F....}.I[z/...g..7*3:K6b.oW..jQ...P#.;.IPU61.^..euGD"<...!s;....!.......Re....e..$..T,.....[vFh.o ..j.....@.C1..k........M..4...W.........2.>V.....x-..,.-~.Z..l"....2{...,..-~...~.x=.....\.Tak.GP@...zt.r1P.....sh2.>5I8.Y./.X....4q...5Z.GH.Z+...p.?.....=.I..d..lX..I..=Knu..m..|..]q...N.]...-.tk.R".u\).....LP6.WY.w,...P*...f'....f7..Z1.M.n.b.M/..s>....H#..Z...3...&..c'8.S.^...r.a.po.jh..8e...y.q...HGn4..(....m^s.Oy.f.1........S%....p..s>..X&.C.6v...j..o7c>..3.n....e..B.G.........y..?.&D.z.S..D..i.S..l...Y.K.TQJ..}..... ...<d..U&8O.Y........... S..4.@.>..z.|.aF.1<....lB.[rS..ZS..#...*...>.'.v.kie..j.a.q...l.}..K1yC.r!@.......- ..`Zu..W..T.U$F

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HYGZTMOBZN.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.884707719032619
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:RQqCbOLQ5PNMd1m+qWcCDYvMUlwkKN9oYl4c:ejOU7MDm+rPUmN93ic
                                                                                          MD5:5F1AC1B9CE93604800B5E54090F5E62B
                                                                                          SHA1:FBC18258ADE9EC7D8918E825C79C1AB1D828736A
                                                                                          SHA-256:57DC8178543F5823E4E4B0CB65DA1522D87E672E4E15467B731C962308B156C2
                                                                                          SHA-512:8D74AC2D0D7EAE6544ACCC4C3A10607CB98393B98383ABB01B0688430A67DA6246F14C30C621AF4EEC828EEA85685B027726952F6673F2B2E3A5B2ADD7B527EC
                                                                                          Malicious:false
                                                                                          Preview:.).P..L.....>...^q0GB.ow.....;...f.K....})..._|F...`...>1|H'........Z.nV....2.*..].....~E....=.g....}n..*..|!%...s.U.i.H..J$......V5.`,...$..5.W ...(%..Rj,2.a..m(..S.\.p.;Ok.vmQ.D=.......=.H.L4.#85>_ya..~..H.m.9......'.i..\.....0. .h6>;..v..2..fTWcZdAB?N._P..H\.\..j.!`*Z5.y#....cm.....xs.EM.I..5..X.Q?.j...`.f..=..j.}.g_..{.o.N....f.......^.}.D..F..iY..........W.f0.b..\}.....]..)..Q..%.....cL..v*XV|,.i...S1.....#.+.#k.@\...#...\#....F...S .J.....?...A.....(.+...R...;.. ._$.e<"i.LR...-...<.AW.#.= .B<........4....W\*.RB...7.J.K..h.....cD...l...-T4....`a......V.....]..>u.T'.3I.L..l..x.YPhAtTD:...T..q%...........46G....et .9...v..."..Y.*G..=.....(N.[t..Pjc.v...p]....X....o.u.........X.l.R@,......F...).{..$k..m.U.....M.......z...3.LU..A..">'.[....SZ...U~wu.N!.....e..) .....6RA...qn..F....Uq...........m@.:8-...|.Unj.....g...w.....I....WU.......$.P[...Ga%bc........G.....G..wk....=....-....K....vS.....hxK.`.o!.U6.X.~x..T_...r...J}......f.n.i

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JDDHMPCDUJ.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.833694798003071
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:/hM7btt1U9FYrsRpuERRnBMLDP1FTzk56d/9eKJmvZLtkYXzcZClT2:/hM75DUYsR9Pnivd/MpkYo892
                                                                                          MD5:DB8D246A6CDF37425975DBD41882FDB4
                                                                                          SHA1:6B2B69254C24FAA3495B9BB1A5A11FBFFC63B54F
                                                                                          SHA-256:E944F1DA0C4C06979AAF8037CFFF8F6F519A8BE51AA0FA6889BCF4F8F709036D
                                                                                          SHA-512:C1D87CB4FF55DD9B75F76965F09987DE227629C7CD4CF8AA5CD04EA0C9B717B0FED0F1EDECB79F1D907B058BF928FF6B91A9885AE10A1F0F99D7331829D4845B
                                                                                          Malicious:false
                                                                                          Preview:<...H.Uh..&..P.....cxa..r....u.......7.0<.u%!d(q....h...x..L.n_fL...@<.....Qe.]...?}[f...~lc..9...x.J.#.......]......_..Bj.../...u.^...ci#j.....ute_2...MA..e...h.<.........x..W...[....M.6....L. .%.'.#....>..~.".l.7.....O.:..*...f?....&.9.<.B......J..7....v..!..=....>bnA.L...l........Z%IC.fq....O...6-...>......`... .Q.U....~...^lcU+.Z.D..). 5>.~...>..C$...L*.)......$..P.B...........nLr../....U.L..J......-.x.c..LIKW...6.?..g...p.....y.y....J..5B."..ZrC....a.M+lZ.L0..".%..A.-.....9.?.}....d..'.*...5|s..m.....0..6......r7....1..5m........[v%...3.T`7l..q..D..;`....n.....19=....z.l..<'.M{...G....?...s..!.W.N....%.}.M...,...$.F@{&......t+k..t.&u4.....}u..m,.b-P.j.L.[%...x.......C[..^.f...q.f...[.FE..}..........1........w-.f.)^r".[.:.1h.J#..r......q...;D<R!...s'.<..2.Kz....$.E./...~b..w-..Kwj..v..g.d)s..f.....L...@.D...5CEu.l..X...U.f.<..;...-..uEf.6.....5..J.-..M......n<.....w...;N[.G.n.......7V.......h..O/......<H.-..E\......W......T<......

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JDDHMPCDUJ.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.857068183262382
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:JOtP1zAmJpVS8inUTIgROYeMuwqpGZT37JQGPkeHXlt4tHa6c:Adsmg8UGIkOYbj6ArhPkeH9
                                                                                          MD5:09C87B489C786385DA3EA7AE8CC4E4A1
                                                                                          SHA1:3E7CEA0088345F6AB9757A6C468008ADDB288573
                                                                                          SHA-256:AE44F8D3E1922FF1C071470BA6DB0E42D039D0361FA4EC614A90D673D94D07C2
                                                                                          SHA-512:6F35CC3E052DBF50DE21B540C942083396D55B671D32950569E91A66E0DCBEA9110385C945BF90F874F8752F589AE2C08728BAB521A38CA651D6C0A714EE055F
                                                                                          Malicious:false
                                                                                          Preview:.-.:......'...Uj[..[~..-....Z.d..~.......Hm..T...w5r.E.._..S}...7..+.......@N..Lp.......(....7..cu.*...q....3.......e^4..}.;g.....e....}.=.h.8.N..i.......V..G...w_'.]..Ug.X.Z..X.....^Y#%]..uN1oYS.+.o..<.\...e.G.T...^.}.vY......U.;M.E.......n......F........~.n...q.rh.;...s....H4IP.p!.........Q..y..@.%.>S...c.....!E.K..G.nBt.{ .83W_.ab,....."J.yA[.7.M.SFO-.`.O.8/..&....o...:0..}.z..M.....(..l.0.!...l....x...]...<..D....0e......Ax.+t."'..A.D....;......tt..Y.,..,..W...[./.|....u...cGW.!9.K...=..>/r.J...Xy.q.Cl/a......(oz..J}mk.}N....H......R....ko...........i...m......>.:.SV.k.......O.(...4..o}..Lq..Rx!...XqH..\.......HU.s.I......mtG.-H.....l?....0..k...hD......))p.J..9'..nQ..w..0.....C...Pa...0...1G}..7..X.3t........?y&Crd...O....._..m.Ts......;..p;u.....f6f...5....b...Y.O.~..f..)......CN..!xa.x=H5..1..Eu/..7..,..p.v/..xLu.<..Gi..{........AE......_..9.I........pq...|!>qkiK..S...@.>.X.m..}.JZ..w.k8-~...6..,. .O...l.30./..

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JDDHMPCDUJ.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.839934532975688
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:r2fEQfu2/qMMe+2ivNws9nKqygWanlrgoesBY8IOwM88N:sEQW2/ZMeLONd9K5al0oeg+p8N
                                                                                          MD5:4771B67E1156EA4B9F5219457FAEA8EF
                                                                                          SHA1:54214F014778B788204E0BFCF0C1D1C51D0629E6
                                                                                          SHA-256:7C9C39F939D0915FD4F0BA21E92C6D40E4DE3AD2A66728C21E562B93ED9039B9
                                                                                          SHA-512:16BFD1B8C350446FE54DE61859385F56BD04FC7E8A44EADB584849323CBF3A6AE07B6110889AC2AB2B8190DFAED32DEA2E760A22CCC88FC4356C07CD71319D81
                                                                                          Malicious:false
                                                                                          Preview:[.....g..TW.K..\.A.T1..9ZK0.q.f.!@..Ax.2N.d..../T.....g6.9........l.........hW....E%...@..r..1"......F.2..n!+u...nfQ.b..W...}HZ....~.W....u..t...zmvr...HJ=.,5._..R...DrG"7%AQ4.O"h.P...._U..Gh.....k4>.I.Ohp:...P.=g........r.p......WY...o.V'..R.x..>.U.....a..C..\?.../..f.........y.?..GMz.H. .&....=sc.T..tr..,..[...&Zr...[..nC.).f.V.\..SG..?.....6F.~.I...Z.....qRI.[n P.L..X..3I.LH.hb..."...{.f..1...B....'J....%...Y.c..SD..<.....2...,.e.9.B..//....u...,.%B........g...y+.....d.&.gci.!.X.....}..S.....2Eg..bu.a.#..%2...P..h .|.K!(...M...d...b...x..&#u......w......=$.<..I...".:..I.K......7)*.g...w.4........\m...=.0..m...#a...5'{../.....A...mz... Zcs <y.#IL..$u.M....<. .L..*.Q..H.p.P.t.V..Wnl.D..Ts..d."....I..@uui6.=..$...rw..7.=.<..?.F.<.......H..ZE.P....8g..X..'qr%R..&.\.....M..&8..j.`.z.c,|.p...&...6...O%..s ...@s.....`..U.-...nw..$.f...z..?..2........aQvw;g...x..8l.&..\..x..........C|D...q.|....b2.&_.(.OP........*...[.T...S...:..(.l....J.y..

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JQADJOBBUH.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8340152539330274
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:zhGSSIlO/E0SZJtD82QbdjkkADkjbFiKXTpF122O5B6WQwd+qYj:zFiE0SbtoADwFDr1q5BxQo6j
                                                                                          MD5:BD1F96D414C0E17038E4FC9B4EA4769F
                                                                                          SHA1:3A9C0E866531C1D93780CAAABEE1607B45CD2760
                                                                                          SHA-256:3F3E633E4BB7DB35DAD86C1A760C5923C22A643FCF16C06F9603FF3DB2335B07
                                                                                          SHA-512:59437235F116FA2B45285B351800102BF02B6B5F380BC384F3C085BE4B14F3807203B850CBD6AEE35DF0C17F515ECCABC493AC887E2994DC1D9DE18DCBA6CC63
                                                                                          Malicious:false
                                                                                          Preview:[Z.xa.T.)+f.m...'J...L.^.......;......<.L...p.iL.Jf... ..{K....#.. ..3...AEO....}.Ws=4UF;..(j...z...6..%.}J......^..c...s.CI......{.y!.).._.H..fu.Y...9.#P..+....\..(..A....V..p<).}....v....(.|........O.N..|..us.[.x.m....ck...@.....l.J........_..yQ..xH.....5..j...+-....JJhI.(z${33...f..(..../.!Y0...bNOl.j....."..]..S.(.^...o..T..7.L\.....a..3X..R.j.{.O.U...M..........d*.\..5gU..oO\7.3s...V.[...XO..G.....T..m;.....)....z.B...W.K._.lU../".1q.(..^SQX..+..%.s9......x..v../....a..D.\..(.O.bW.*^.2}.Hv..i....u...|..*}V.Y..=.A(..H.|M...H*^B .:\Czz.d.....u...<.p...EYY.O..n.$.4"f..n|..r...T}lv...9...V../....`.....<.x....Wk.p......4..7...DR.u'G.".\0I=.!O..*b.6 .T.u...tp...b..k>..4.Bj.Kl5K.{.......u....U.....:..*Y.j}..g...'x|........../QUT.+..D...*Ah.3,..X.;...@...<...Y...N.,W.TZ..:...7..WK.#o....=R)..9 7`............quX......r.[vs..V.k......8.1h3.^....,n...+..k.D.mT.}/..V!...;..I...y....&"a.......,..\....`......H.q........m.J8...;..#.7g8..c..O.Q.B$$m;..d

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.823447691476666
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:b/tRxT3OZUPkXXzjGPRvlYuztHfAqhwbx/NXRd10G/yYGx95eOQJxzxOCRrB:b/TBO6kXXmPRvlYRbx/NXRb7/YlSxtOw
                                                                                          MD5:F3D604A6A422491A4827E77FCB27539E
                                                                                          SHA1:E369DB0C2B71881D808D66953241C1525E6BE2FE
                                                                                          SHA-256:3D828EDE21B7565B7812FF33DE79A4AF345C5728131176E6F73977CD2B1245F9
                                                                                          SHA-512:7930F74945F3FE9704F6D3AB0B8F2BDD1F93F4DFCE1C9E50DB8C6775AED732EADA7F79B2AE2EB852E107C2E05590D9070FE6FD4FDB0828746949CB08E1DB638B
                                                                                          Malicious:false
                                                                                          Preview:...]:#..cgf.]..D.l.G..:B...g.p.......s.RJx.k..z.....>$......x..Mu.X``.L..H.`...O.w2..&0...y3Y.#.B.........}..;=...n..e{xuK.....VU.D.E;.c..9..;.o....xb..j.X.3J0..2.......Z?.#g..X...E......I..~...!}.....;..@.xv..` .....Z..^...nJ....^.n....T."w.....%...Z..uf..lB....M.."I....m. 1.R".Nn.Ka.ed......l.N.Zw-.....3d...gJZ+.*$NH.......?..fv..f:..a.i#=*G...u..;......,.#.K"C..FH.d.Ad....OjJK.o..}4]...... g.vH1..../ZY.N....hpG>..$e..O.).C.......a.....?^.+.e..."[.L.$v..UR]..S.J.=.."F7..xy...N..a.m.C]{....[|,,.. .4...X.D.a..(.D.OZ..pq....LUE.nB..3...M.l.Q.S.n.....2z...O.Q....c.........uQC.J]k.|.....y......WG...3.@...X...w]T..M...m,pE..G..a..#....By.......0.Rz...Y....{t.....^.....BJ..da..|.......B...I.1y<=...Ky..a8...xU......F.6"...u3.E........1s...&....xj.@0~....0Z...I...).6b.fqKEv....%..&K....L..8z.t8~...n5^...$..K........*P2.....0.q..t..e...oP...|...0..t........0...Wt.'..2...,p...@..,G.._.C$.H..;X.....gn".p.....J.TZ..K...I........E#.L.G1'...-|.Eg..

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.829010840458703
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:6cKTSIub3b8niWfMrPawvlVSpBjAS+s9CkLjbTI+Gkxbu3I:bKurr8ilLawdmFfFAau3I
                                                                                          MD5:7598E02CF5AB59D401D66852523F5430
                                                                                          SHA1:A11085F3AF13848143196EE8E152D11049718373
                                                                                          SHA-256:9A5B8EBEAEC012A1A9DA7A85DE0ADEF8A3626C2AF175898FBC9A2D140F86DAA7
                                                                                          SHA-512:ADD2DB41C6B5BC19EFE2E377B75266F5CA1C075F4539137ED933071C0A02434B15C1DA4F01D85F5137ADE63BFDF887F408CE75B6EA33E2CFB1EBDE7736FAF14B
                                                                                          Malicious:false
                                                                                          Preview:.~..-..>......u...).(7..W6.w.....U...RJ.......".w.nS...$_0.g.0Y...0...s.....g......y.....n.....^.tM..H/..L..S...`:."..9s.(Bj.../........`.......K.........3e.f;..^._.P.su5A..R.a..O2x]R.V.@.....Jy).....Vt.........N...8:...c..{.fL.c..,2...".?..T;. .....Q.r..r].N..<....o...M.u.....1.....$rwy..>N g<.D..lc..............+..:st...^..f......)"^.v...........h......X.T(.s...)Aae..F.....v......F%N...y..1.......Y..o!..A..]...%..... .$.t./..|.{O..u.<..<N.......2RY...E$...#...Q!..<q..sa.lO....W.......N(:,.n<.._...........]jb..e..V}. 2+.Cwv.P7Q......(...!E7..`.B.....z...I4. .......X.1.ff,.L..../.... u...o..l...*cH....T..f.j.......m V...NZ.])`...E9.t....q.v.M.r.D)kG.....Z.cFB'.}..(|...<..9.6|Z.....;.^...#....#.JK....6...4.[k...V>..'&..|u.2..#gM%..sy...7._..._O......ix...hB...!\...G..T..Q..I..}..=....9i.......4.6.n..H.7.|...T.t...C..^...'7....$..0..b..~y.d2mX.......N[...y.......Z..........!>..........C|M...0@.....v......;X.2..$RM...'g.kx~

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8604409386213
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:oWU/8oZrF/IuN0XSoLCpYZOwSn0UJ/GM3qW+BmV6KShNRQVvHB7pyBfO47wLlA:VU/XZrF/IuuRepyO9nP/V3q7K6KiQVpE
                                                                                          MD5:2BF30BD99E36F32EAFABD98DD66FAE73
                                                                                          SHA1:342C5D46F7A2DC9E1E836B8DA69085C57C420345
                                                                                          SHA-256:2CAAADA06AA7071C0906124AAA30DB350968F26D74433CE08D22DBAE47B4B399
                                                                                          SHA-512:DC58B3940409125BE6AC67EC0F56511EF5E05D412850656B97A919F882B9AAA135AF68EF45C4EFEB4D8AB401BF6AFE5327FE8A61F5D3BA9F581FF43BA74982EA
                                                                                          Malicious:false
                                                                                          Preview:..O.WM+'8}3...tN_.....Oy.L...F..s....C..`..PVU..........Jx...."....v.F.zZ........K9....G]..nU.#......?..7... .*M.|..`.ue......ABc'0.T.Aq......A....&N.g.........X..6.a-9!k...B.lZ8.9./...?.o.,...~.N.HO.....d\.)n.'.......[..%......C.r/..78<.`....F.$.#..i..u.Z.R.e.W...."...6G.D..W..._.^+v.\.a./ff...U.....<j~G)U.u..\:=Z..f[}#Og..V..^,.RJB..).vWbP.....u.7.).a..K..0.xE.&.i...Dwdy..........z.~...`.tx.\*h...V...g..py"......tf.Rp...(..D.PE..U4.?.\j.JI...C."..'.y...k.sT...+.....I..`.........'g.1HQ?..s.Z:<...50m.?.~.o..1.@..=.z...{..g..}.A.^..{Y..H1L|oZ.R..o..G.K..;y.M...LPvA....i....l...#.o...i.u..i....n.....m.*s<.E_.d.B..r%.]H.^|.#2O.....y..Y.q.m.%..CF..*.5..%.uD{.n3C.;....`..........)LJ&...(....d.Lh..O..G.....B..O!ll..@.LTV.~t...`,tz.X."..~......G.z..O...x........R9.v..@...Tp.....R..p..Y=..pC?7..d.j.0.0...~)...f..1A.$.&...~....^C..........I...|..+..u........]3<,./ui.W.~s..wzI....?.*.......o.^.fg^...<.A.....?...Q.Y..T..?$..N:...p.0..W.?.Me#.L.f.Q

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LHEPQPGEWF.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.848975188471548
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:6xyVaubHkk+EWljT/dnCrlcY6BTiz3jKeou6zfk/ukD9PUh1F8m:oy9rj2jT/dnCrqY6BOz3gWuC8jF8m
                                                                                          MD5:857BED115AE382B086A67C946CAD09DD
                                                                                          SHA1:0CBFDD1B3280E60FBA94A65FD73D8A9BD221F014
                                                                                          SHA-256:4694E16DB949D9C8E0264E85F8D0B3365EB7C5FDEBA81E9AE3D2F125EF27A63C
                                                                                          SHA-512:C2852578371B634904838E46CC1AD014A40662E1016ECC105B1F77FA3A9B11AD3CB9BAAC5E8804D0F28682E86C64A7DFA3BEAEFE42C3F732E453ABFDAFD2CBB9
                                                                                          Malicious:false
                                                                                          Preview:). ...Y.....D.......i..C.G......L......V..D..E..7k..EN,Y.L..3."s.92Q...d....df..y...J...H.....m......;._.{.......l...j`*..............'Z.4...P.{}e...k.3.b......M.h.W....b...V.E...Y.. w..v.m..SCQ.>.Gd..#l.o.!..!Sw.S....ef.0...dt.Ux.}m.-.:........G6..cT\1.....5.........Y2.Y....W7L.V.kQ....gP(.Ji..T)C..Fu...:\<)....[.Cx.t .u.............^...4$..{S..=a.K;....T..c~..+...........?^.KD2^..o..8.....Z.....|6..|....SH/.N~...u...jP.}{^M.D....D......}E.IS......VY5.!1......JD...~..".,......%..e'......u.......Y...J..F.4b.Y..^c...L.F+.s.m.....1/...S8@...%Hj..S.X..r.4.+eCr.._.o.8...^. .ucw..9.C7P.&...{Y.......T.1...q...v.ZN........AJd...'......ME.....US.V....=....'c8.......y..9h.......4../..f$V.W<.Rc.1.5.;D`.......N....+.....}.....PC...o.N.H.p../..5.WDe...L...{..#k.....N.K...I..h..1F.Z.x8....I.F.^gQ.d.._yO....L.".(5.C.~.Y..u.Y.[.........O.+#...fw..w..W........Vh..vox.F.S...#..Z._|.v.Y\h...}5F[[....6rs.>...q.l>..tS.[.'.p.....M..<..(.x..q.....`.g..@.....k.

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LTKMYBSEYZ.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.867331743541078
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:99LZnKoHvo8SkCFanAUXBIiLnsz+w7LRWdWDU1CkkIkxr/pIDu8j:9nnKoQpkCYnfRIEw7LkWD+CFIk5pIy8j
                                                                                          MD5:F89AF91A0421DFC5A2D667B94FF5273D
                                                                                          SHA1:1908652A0B86C6F822BE9C6E440D24E0FDEFADE3
                                                                                          SHA-256:616BEE7DDF8FF59EE630906BCE62E0B2E6391E21F82DF2739A98CDC3ACEA6ACD
                                                                                          SHA-512:295C68D09CD29BAAB8B8E012ABC9C17AE2830FAE008F6A9A835184A8409D191736D843CB75A7BC5A1ED64D560572B2445C7F42B88C0D9AB5312C5AA18532A618
                                                                                          Malicious:false
                                                                                          Preview:.Q..E....B.4....6.o..r.fp.....`z...}..%(n.>8.[.O:9.{~+..U.........%..,q...>V......)_.....c.V...R...y&B..+rNR....}.p|Qg.^pqeA........j...t*....Z...m.....).p.o..=......7g..4.ll...P.{#..}.q../U.n....-..Y<.p.E~.{=...=.MR...p .Ig...J.b.>..F%r<.~m........j"..b.._...4.]qf..9.S...v..u_..c .....XBhn,.~=...m.7.!..*..d/..\l...M.+s)T.a.!.....b...Q.m^...2.*.D....#....f.-......<:...'...t.z3<....^*.BA6..n....y...<*: nA.O/...$.,.V.......0..vF]5.v............I.....<:.8....=.~m7s..Rwet.vI.- ...v.o...}.-.y*.!?.Z..|..,.jD....=.JE0..#.....ib......2s.6).$.@.N...z.9...,..|LKS&...}......a.E..tWV.^y...R.I..W.Pt...`[j......g..R0F.R...6....J...JYPX`[c...D..?..|p.I....6.....f.2..{a.!..)1..`........nK.......>.7.i......g .uU..a....j2GP.>..&... .L..a.....3r..>..C|:#C.i..Z-...t.....C8XA.?5:.\vH.. ..TX.\.%C....8....t...]S.q.%.g.....\..z.;vjV.......S)....X....".Zn...KD...\...c.'.%8[.2..2R..qt|.l.....Q.I.&....=.`R.......3G....6uLB.i.7...{.iu3....2...........5.

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LTKMYBSEYZ.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.83904048577976
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:kpb4XlsAapN49RCimzVtjgPrxpZFn4JGz/2X7rad1ygcswIiDePlFQPcDH9u:kizapN42z5tjgT1q6u7fb9MI
                                                                                          MD5:F594EE29D83958D1BD843CFC8815B7D8
                                                                                          SHA1:867499D76D1779132AF9FDD340790EDF47CE7093
                                                                                          SHA-256:FF14DA9A53D660D1C975BB5916AB33AD04CE6C55C6EF01C9300999022AEEA531
                                                                                          SHA-512:1601AD62602A9DDCDAE0F7EF5DD6CB0FEF484A58C6B4994DA422523505B3841B536E68CC4AB1AE46037E2B95F3C727A354E0FB9552F301C6966AFB92DE0A79E2
                                                                                          Malicious:false
                                                                                          Preview:........i!R...6...6/V....C..A.(...;e_....E?.....f..og*...(.......d.0/dw...X.P\.2...,..J~J...h.p.Y.'&..D.M..$.X!...>=.....=.jG..........<<;{.....X.......x.&...2..A.G.;.`.G.C&n.....-.......}...?..A6....o...Q...|IA...Mq.:....j...o.e.2=.~.?.#g....Q..z!.CO...u=...4H.,..F........b.'..e`.~n=..~.C....4DqB..a....._r...0.T. .%J.`8..?....:).o..../..`s...SK.M..^.... m..T...[.3....c.....><.L.x.....w..z.Z.9C>%Ld..Y.2.&..6(.p..Gm.j8....Yz/.'T.~.6....[, ..VN.F.......I.%Z..+.\.&....fc.z...Xs.?...........l..G.......<$..*...[..?fP.w".m.h..U|8... ..w..N.....C68....t...{..m...".&..V..(........,...Jr'*......9.(].5...1.=.lQ..R&...s.b.,.n<.$...^.h.xW.lU2E..\.................5.6..>.M8\..)va1...!....^~....'s.2...H..$.e.....,$..TqB4....R..$..[...G.a3\.......Jk);2..IFV....,}@...q.e.Ym.C.O.g#.R5...'......h.(G3........-......v4.+.5.@..Xo...%..*J......'.....c$....`A...U....5{(.n/...dFg.Uz78.o.,.l..F2OG..'wV.SV..`z...Yj...-..5..80....F....BM._.<#.....E.X........z

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWTVCDUMOB.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.853013270085759
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:U0vJzSRS8AHENo7/TgAHCfwcxaJnLvvGJK4BOmFaUTEjcq+1ru7lCkS:UaJeM8A+olHivxa5LH9AB8suw
                                                                                          MD5:E8656FD1E743B0BF44C195787B69E150
                                                                                          SHA1:B83B6C76F4614CF988BE9DDFA3FC0B8F12E25AF1
                                                                                          SHA-256:516D95EA3A1324DE5ED267041B59C96EB8B372B3BE94CE9394668FBC3B9818D3
                                                                                          SHA-512:13D19EC6BBE6717FC8F039F3FC2B29191E71267E44B95725B4C1FE7E3855116C33B4C071A8452498E7350D48DF26A072051F1BBD04516E69B0D9CD618CD41E6A
                                                                                          Malicious:false
                                                                                          Preview:a..d....,z.?*..K..=........D...KL4....?..,.9O|...2...~.r..7....i0....z..2._."UO8g....k.'..#..Wq...D..........!........../.Dcu.."t....p8r%k.......z0+,....<..g.....|B..\F...W..;Q.7.L[..O..O#..&...#eX*LW.x.....r.....Vd.a..N*......C...S.."[.@.6.1.r..&.p...1.t..~.."..../.[....=..y....._....#$._|.....m..(.'`m~.yl..s.v.Ac.{g.k.....-X...........6.!.X.|..c.....2.....V}b...:.;=m.....N..|'W..y........4..U. ..'.~.!..i]@....c_.%..j...G..*.d.,h.c......t.(...B.e.d...].*.$...".y...~z.[..9.D%..MQ/.F. ....'(......<aF,.......}.z..2!...v...;..Iz.......$.LI.$.......M..j.Y.w3....{...-..?A2>....c..n...k"K].g....dp...h..?2.c...8..mo..p...F.I......y^@B.!J4.5.8)..Zj..h...wnp.lG.D..}...@a..T.....O.....%.#\...^........ec7...I......../."..Uz#..K....18oM..}B...<..${.m0o.LEt.e.!....1d;.E_{...D..d2..."y.W..D-,..*L.......&.A..X...Z.>..KX...4J<...-.T5*......1...\...B..^9e..._MyF.O.\...ZV.N...\t....C)... .F..K..M...%.I..-_.......R?........:.G.j.....z...{.Cu..ae......V,

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ONBQCLYSPU.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.838285068645039
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:maJqg45WEDHZT5fsDEznxk08URjJZNPR50P/80+vgYFJtFQMLKwDA6:tqRDHRq08qVR5ap+vgEtDLLf
                                                                                          MD5:3156C09830C51E5A4ECADBD94576BCAC
                                                                                          SHA1:87E633C1426119D8C6E0C2195EFBAEC683EF40F8
                                                                                          SHA-256:48A80858CF414ADA02B1F16F0E1FB1410D97339CBA3F3CD41024044E94CCF851
                                                                                          SHA-512:170E6A4BAF28036AA47D9757AFBCDBEB74CBFAF2570F06C088F76632DF3544AF789803F816A74829009C994DEB0DD03A7D2EBE1CBD038BE54F93A5794AB6767D
                                                                                          Malicious:false
                                                                                          Preview:...."..D.....7...M...-...`..BV`.!...-.6O.<.....L......j.....I.+._.j.c.7.i.bF4q,...."?..I........p.....#...u9!...^..8l.6.2'c.@r..#../..F`i.i{... ..K.i.}.c.{D......Q<w...!....iY.u.....i,o..{*..l.4...8$].jL.T:.....u|Mw..`...._.\......>..e.A...m.$M..b.p........;.L...8E.......IY&h^..b..>.^...../.,......B...%..r.>......:.........i....|..^.M...k.Z...Zt......Du.G/>ab..`....c.Nhl..q....H%MHM...*....Q.y.:N.\.....0../.w...Q...K..+.I0.c[...BLz..L....q......m.L'.xt..B.........a...\'.].Bo....Ogl..p..0/VPG..Y....J1D.U..$........~[.J.(.-a......|p.B6e.s7L.7 ..E..t\i`V....?B.g..NK8`...dnG...$..f..Y._..HBU.[..!h..o.#....:c..c...+.PU.......i\F..O.er..l7T.......~..'..-}Q=..P..aO...z..0.... \...46w.....&..PS.m1...(.c.....$cuO(...d.....]%..J.).......Z6..&.......|.=.B.AW..M.q..De.S$N......O......Z..`.t.....BQ&a.*..?.....?^...U.x...1.d..}cQ8...r.......w..@)....._.*...g......o..W..f....o.2g.*.*AE......KD.Y.1...t.....]y....{.M.h.1....!8...R..' ..M2.Dz..W..

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ONBQCLYSPU.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.872320345795445
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:VhKheVkLL4oNe7pW/7q5/o4KuXNMDV/9T6pY6NTXxXAUIEsEclQ1AF8yU+OSx:V7+LKpxpODVVT65jxAVEsEcII8yM0
                                                                                          MD5:D3EF698E45D7B477973292805F8B3EA3
                                                                                          SHA1:CB379A225BBFCED9C755CB400503C7864F320E29
                                                                                          SHA-256:8FD8FDE96383F367ECE55C925FBC5C5A3E7065DA177FAE65E192ECA364C98368
                                                                                          SHA-512:2022C476677FDA07144CC775269C4189B90DDC2FD0334AF8AC3679AEDBD2C9D29CA3CE73334E02DBBF39C9597F142D038DBD1D3C28643519D6879C4635AC55A1
                                                                                          Malicious:false
                                                                                          Preview:lTtF/.i.g.....Q.p.V%.@E..)..2_..;~:2u~.......I..... ...ZX.!..R....t.c..$Y....@.".7K......=C=..d........]k.......Y....#wk.2..(..K....../.&6/.w.z...Q.!..).:.....$j..r.{..(.5.<%.v.p....<.X...v|]..)..C.B...Q....K........./.......x..C..b:Oc...v....4_o.9....o..%....u.L.NL.t.\...7..bM....t..z,..]..... ..T.!.}._. +..'.G....P.pQE1D.).........n....5.^......X......Q...t.a.8...+y.A.H.h...'m...J.....G..(.}..l./....\yGK..h...6..?.MW%.....UI...CrJ...n.)O...:.h..u.#..S.L.Z..a..\,H[+.....Z.....f.b....;.....r....Oi.-..d..;Z.h..(....J.....6z@"..c..bw.wbW)]S.e..m.......3.=..m...<.`.0;....M.....f..f.!..{l.BYx?CWJn#.1..ycl.,..5........}S!.X...`8.7.^.^.bt..u.......{C>..Z.....yz3t.9.......f56.vK.`u........N.,.S^....DS.R{.r...V/........Fi;.i:8Kom0y....K..)...X....N.Lv!..CL...W.3...f.U........#RqU.......!n.X..X+.y.u..'..Bp4b...[.A. %.\.9.1k.D..v&...nM..6...].x....&.d\."...J....[..e..A...~..xY..h.b4.....,.Z..h.%lT..V..40.....9w.U....2..!...S.&$M"#......

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PALRGUCVEH.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.83839402616436
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:GET9Rtqc1VloIVc9FbRcDXyw7ueiJbLRUywLw1xuk/s6Ju1YSUck:7eck27ywCPJbP7uau1Yyk
                                                                                          MD5:B9F8089A068AA6C4302B1A764BF08428
                                                                                          SHA1:1E7D1B8644AB6D493B64B691C3FC86A56534D700
                                                                                          SHA-256:89A0474008F8534BA128C34A4E80000CCFA4A00A546FC86FD97A698B194EBE94
                                                                                          SHA-512:EE5A2A3AE0ADB9A754FEC03848425474F079527883A3E7A47023976096C774D2F6FEEB2FF20AC63518294ABCE03CEEC0C1AB4F5B0E6D17C56A29EE97549C20D5
                                                                                          Malicious:false
                                                                                          Preview:...{WziZ..-X.......s.......T`2qz.+.J.....05.7i..%.,...S....S....P.)..a..e...[1.f.....#.....ce.......DIO..v..<...e.._..f.L-.O...h..$".1=..8ucU.....:*......u.....SS..q.... ?..Ii.<.k..i.1....K..p........'^...C`...........V......IF..f.0..Jz..'.*..QES.l......5qB7+.p....#...6$..x.Eq.....p.0...g+...m[..v..*..t.#1w.......c)\...D.M.6@....Z..\.*..'V...g..1.Y.7.........5.+..|.n"4..f.2./..WA......H%.-xH(...c,S....T......w.."...."..3|...[I.|C.].&Ov.i.1:.Y...........j....e.?.....$.........9....t..Z....E....jC9.5.........@.wi..e.dJU.N..C.`...n..w....&o...)GP^.K.....@.H..d.=.........U.mI...<Zo..M..*.V.dx..cc.F..........q.,...w5.I..F.~..R..<O....\..O....G^}..SXFzN.V..X......m.OK.....r......{.Yb.......P*......y.qn..MqL...K...u.7j{...LN <.......Y....8...7.4.~z.V..q.!9..D../...no.f...2S...IM.f...@w..a9...:.p.u...c......g...6tU46..N..0..:..4Y}...n..K....T`.......X.u.pI-`.N).....|Xd.].TN.......yx.m=..V......"K..u..Y.2^..a....\Ak.b.Y.7...

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\RAYHIWGKDI.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.847976231753901
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:bdKVZnMu5D5cH3F55UzWTt1jJ84sSZOdG1/Uc5rLmOEHGFqUaqSAe:bdKVzq3F55hBJ8XqOdG1/TmOVaAe
                                                                                          MD5:49BAA4629FFC306901B7E6D419FC70EB
                                                                                          SHA1:313E1F0BE8691639C1634FF701BC1D7991F357E5
                                                                                          SHA-256:CD523F42F1C5455F1ABDC6000C8BEF4F7CFB3E7C9CA99DFB1A99113DC56819A8
                                                                                          SHA-512:D8AC46047F4E76EC2309292C4D0021D4F17A35F521B2F609F48A47A25D0820B77C0ADBD596065C03421206AE1A5DEDB1B616496268B954DF3592C3C5205B2129
                                                                                          Malicious:false
                                                                                          Preview:1.R5.).,\.k._.7\..K.s..IA...m....N..P.^..J..P..$I.=..._.v^...E....02.N...Cd......$.,..~g.......$Sb...++P.3s.|.G^.{.....M.s.Y]...9D.....$..u.l<.D..W.,.V)ro>.Y.._.....?...t.|.9.*p/3BP......]@."Ao....y....!@..1.).V.|.L.R.L.#....m...Z`A./{..v...4.L.n.l0.TX..."*..?......:.f.U....rYP4.S........f%..^w.9....j.....L.....F...?.............^..hx..^..F.J.q.a.H ....j wd9.b.V6.h#..}..P_...c..+M#Q...4I.......P.....^.).:..=.)I3....^O.R..w.....z...UJS)W<..Zu..o.a......L.JN(..6....BU`...vyy..[.&........+.....BzC..k...O...S..=z.*h.......6....^.j..uZ[h....c.YX4....!VF...C(....-...Mz..."...........oBI..._X....;.32g.K.....|uU|Y...nu..=........f.......l.\....V.x.L^A8:...4...n.........8+.+......?..t...e..^.8..!mtYxt|_...~.....~...;..x..Oy.._/.7...^.H...\..'......bz..?DR...R..-.G...x....LND..=...1..q.p..u.00 ....s6...5....*.g,H..w...k:.....j.$.P.s.i...L#..8.k..]].W..C)fl!.Uj..KE....T.M..Q>.Ok.@........er|.23f...c.lF....R......- ..1.~?r.I..NB......J....%)."y...

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\RAYHIWGKDI.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.838472837310803
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:QcC2E/hJbY4l+HPuvLJU9mv9XybzQAfq0b9NRTiCCYVxSq5cfw9uonWNtaQ1ZJ8U:Y//bY4kHPuomvsXH9iRqefw9hWTHs1VQ
                                                                                          MD5:C3203DB5C17EF51989EBFEAC2AC5553E
                                                                                          SHA1:8609415726EE54B7C4FA404A0BA02D1B8E49CBC2
                                                                                          SHA-256:FAC67146F3786B2141BD154F67A769013F8A2ABB7EFE4E91035FD31506D35896
                                                                                          SHA-512:D81CEDA30580B60ABB74A3F27B2AD2058D46AFE101CA02EAAE750B6AEAD8FB3F392497BDA7CCE6DB495C84F1E525BFCF7208C74D64C9571B0EC45BCADE553969
                                                                                          Malicious:false
                                                                                          Preview:..(.N.....P...p....Z.18.p......L..#Qb.6..S......w..]..;I..E....&...-..L......pi...p..j O.e!.........w.O..n..#.Rh..N..O...:...p.<....;<........q.B..mVY$.,...."....9.W.z}.>t:..Y<.}W..OdAF.......daJ0Ja....dN..D.bo..*s8.a+.N...........<E..0.y....R.T=..!..XV...w[.'.....8..B...J.5..^......s\.$....T.*..]X...V.a.w.8...Gr`.V;.4...0#.2../^.,.".D....q..p.h.[.o.FV.^.m.. .m.....Z...]M..=|..0.`r..x..|..j....7.Z..!.'.......v...u&..[......Tc.L+..&.E6.RP.bo......Z..k1^D.......V....`~.;&...;...:..eP...+.OZ.dz....X....^...H....V-...Jg\..~n.!.|.J...M....:.i".\r.K..D..K?I.NU...t.r}.,..b.m.>.i..UF.(1....x...r.....h.F.H;q&...;/Kq..WKw..Dh...?.....3...b..Z..U5...-.Q.7...=.KG!.i..s..Y..tPe4.t.....w..4...k...sradI.`!4...fEx.jl..$.Q.SU&...I.}A........Ah*...ohk...'rA..>).."`.....i.B.m.g.6...W[..hH....j}..? .D.p.).<.c..[.^.y^GQ~7...3&..).U.i.r.3....i.qC.RY.S..xbkXN...$o"."6.Q.#.g...+'..zq.I ./........E.O.B.h......o.-..S+-n....}b..E:.%.q...-Y...j...j6.>

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\RAYHIWGKDI.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.867222399283193
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:srwbJnRSq3uJYmT5avnfRXm3hAhaCvE2mq8/CLw9EQfntdyHGme5XcKmrJxTKCzB:6wzNe6DRXmRCmq84AEiMwKV9MUvfLx
                                                                                          MD5:786A9B992BDB77C87B09DCB61F11BCE2
                                                                                          SHA1:8E0BA82946EEDEBC95B109C265CD2DF23431602E
                                                                                          SHA-256:D22F41B3374DD53266D558AB15DBB81F4B8F2C79CFFCE4EC5BC47A71C178941E
                                                                                          SHA-512:D322166C7B83DE0659842C6243A14079DB5327325C01BE3C118AD7AA22A0BD6EEEB2DD063DAD81E825E620F257BF4FA14ABB3C1669A9F47840E3850F08032727
                                                                                          Malicious:false
                                                                                          Preview:IhW?....I........r.i.ct.4.0.kz.`....5..(/.&7n*-.....$....t+.~O.....>..F\sM}..4.r..Cy.2A.O.........a..?.T...2s...G<..fA)1\.u~[.0.P.@.hn..*._._....'....I!.~5.:...i)a3M..r:.zFE..K.SsZ. ...{.6 .\.R`f....D..Vj.d).`.{...4.c.TWo..lq.E@......:.P...........@.....A./_.B.`.....y....t~......V8..};..9;.x.%....0..v..p.p..D.(..7.I..^..w.D.....-P}..O..$M[..1}.....a.............OQ..K.....$.T&......]}..Z~.DP..P.8|.K<..7...$..........(...a.._29vp1'.....G.>.{..l.-.9....:...7..9....Q@+...bg..!..pT.Pa*."qM.J((.Rn?yx..."w/s........?..%........DJ<."...^O.&.KW..Rk.H.....L?hr....\C.!u...(.@..".z..+0....d....<y..;.....1..(5.+.....0..:@e.FH......./.O...@...D.....k....*...f.....mx}....:LJ6....8...M..... ..!..|6Q..a.6..............n..k...:.l(..,.7...^F.._.<.^w......|.l.g...U!....G..".M.G.....z.j.|....4.=|...{4.>.......U...A;.&O.>..=.M...u^..C.n...*.......bd.D...3...>t...#.......~.T.O....k.8..o'..:...e.].c>vG.f......\6.I.2U..1.w..].......%Wn._.(Z^.

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.84242992934652
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:L3Nk2P+MPpZHEG5KTnr5b/KO03v7QVV3/Hoq8cSq+a8UVS3OowU:L3tP+MhREfh5CkV1Iq8cSqlVSoU
                                                                                          MD5:2614E5BDF81F174F5C6FF4D3927E02FF
                                                                                          SHA1:0C17F1752E88A82519060FE357527305595D9515
                                                                                          SHA-256:F7195003A934CEF2D5723ECD7009D4E63383B17705C0BFEAC131F7E32670F14A
                                                                                          SHA-512:D0147DB180279272B458D0762694FAFB350244BD9140278E3A1976AAD100303E0A438FD3B7E75E4EE4FC778AA07D08351CD4AD9E29143EE88DB9A23EBC7759FD
                                                                                          Malicious:false
                                                                                          Preview:p=.M .e........V5...#-.`.j.]......,2'(,I.[.y...aV4.r....q..{i./..n.pKF.G.F...}p.4.t.-....q.S@1..'kKd......._\..w...q.........y.A.m...T......I.....k..&@v..;dY{....M..ai.RZ..e...>...N....j...L87...%)...&...E.u.Z..S...-/.<2{v.VZ.H..T.....Ec.....%..,...3......R,Y.....!V...*m.}/...he?..Z......S......B.+.....S.:2..W...G.b.^........V~J..9...!k...MG.O+n.d.9eD..Y".1...-3.#.t..Gv..........g..t&(/...F...y7b.V!...h....b.)q4.4d.,...~..b}3..+.%.bP..["r...=.m.......z..0J:r...>.(G..:.......'..1.U.#Q.c.I..g.HWwA..Q..R.!....>.=...k..0....4k..!o).,]'....IzBo^........-...w<........k.7rg.`...&....[?....|.........9.^<....f;.I..5........e...............Y.}..r/..x.Q...UE....v.%.b.0...s4..U....8.f.Y@-..6@.&..l..-.`...lh..o+{..nML...IC....E.n$...]......_..$...EDn..2..s.&......E.p.9..XW.-<...8q[.!.......;.:...7......n?...g.../B1}0..aSpa{d..H......7C.^A.9p^..0CBB/.S..!V}.dL!P.W...?...:.....j{.Io..%..k.j"+E....+@.!.e'952.O....,eZ..p.kv.5C...]......S..k....O.....A.d.

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SFPUSAFIOL.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.865495299984599
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:cORlKI2XcvJzrH3sMDKKIAeQ4PQfXa/XqS3wZ3tI9n4UuuVOwxqcc:/RFvlrXNDsJ1I6XJwk9ZOwHc
                                                                                          MD5:EBD1DA680F61BDDF39E6F655F2B954FD
                                                                                          SHA1:9F17C4C7A0267840C5992B5F515E7CD059E5EB6B
                                                                                          SHA-256:CAE0FDF026B2147024D1F1501DEE45FCE1C7C71CC0366D5A87CC264D7F4F747F
                                                                                          SHA-512:3F7CBB529651ABCE5CE3B5C98F04FBD7EAE5FE08FE77FEAF8A223FF714ED9065D18AC6D20513DB6B9D2B8A370C25D360B1C027E710A785D22137BF34A910082B
                                                                                          Malicious:false
                                                                                          Preview:....T\...T..+....7..O?.WX....A..m.:............wm....oH...\....8j....!......7*4..y..........W......*.Me...6+..^2.c.Y.....@.".@~#...#...........-...+d.>@..^.V$...I..h. g.k.......>.!!..)..C.2......+...f.5:..<...!ww..YD..A.R..H1.Ldce|1..oq[q.......2Oi......#.e....s.&g.B6`].._j.......a4X..i.#..Q....q`3..y9Z...1.=.:.u.j;..2^SkJ...:._..Y#.E.....b.V!.T.1..4...............fj.Q-.*Wf....#<P.Q..L..,...s.........../..j..p .I...._....W....fo.:...f.I...I|C^>@....8.....9'.v.....e.R.^_.[Z....w.5.E1.....U!..3.......$8...'.....gP<E;....K.C..a..n.p...b.mU.-...:&.30..Q_A....9....3...y@...!..7h.Ug..R..sf.....u.....X.S.............l}.Mp....#.....W.2-.dm.k.e"..........CFN.Y.G.B.]....Ik..t.....(0.5P.a.4D..~AO..N....UY.bh...P..1e=.yA3#..r..?.Z...\..)....RIw6...0....U...9.K...Y.....}../...U.__/.M ..k....9.9Lsa.@....u>..&.dI..2.>w.T1...|RW.G..".(.)a.A......,.jm5c.[8c.X..1U..P......mE....9..J..y..LWf.I...ic'o.!J..V.+...9..|....L.e...."Iq.s'.&,D..1.....G... .}...

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SUAVTZKNFL.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.846758391584427
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:UfEb3pwbOpVcDrF5pU6Bdwvu+xEX9at8safwbPMjOezGSqDOvZ2f3IAE6yYm:UfE7pwbOwDr3YvzEX9aSsa2PfOh2/IAy
                                                                                          MD5:AAC209B899B3623628B581D890023FD6
                                                                                          SHA1:A95C70DE552CECBD0BBCC87D2A534454F075865E
                                                                                          SHA-256:E97ACF9855FB188C6E17BA056072B525235677D096C7FECF2EB7891D784E2128
                                                                                          SHA-512:9D30793C531E436942E01CDC47C52267399D182F27CEB9CF891E634A02EDD6E9FB6A49A6645DF3F5CE322272659908F44156C87605C9183C14B7C931310013AB
                                                                                          Malicious:false
                                                                                          Preview:..h.../...|.h\."..h9v.o.{.-..n.}..b........`..w...d|@...Y....x.]..U.E..b;D.^.oU..].mV.%..<.....N.6w)a.$|.<6U/`.t.q...em..~...'.`y#.M....r*.zX..*...*R..D.xT(H..c.hC.d"...B.Nc...;c... ......Yl..N.I...nl.\=.c...9D..k.\~o.[=*iI!N~.......k.V*V.L;.8....|.^.k)..V...jE/...run...ac....S.-P..+.}.qi....{r`4/.-.D...EA;..xp,'..X.@.*9....Y...Y .\./.."S.d.+...$.6..Ki.d.I...>.?.'z.Dy.2..._[..L.YK..s...T.e.)SZ..`...H.....r......7......V.._...YE.Y......@..!...~..6...t...(.k.B.c....f....ni.rs. ...7.m.b|.V.",..p...l^........ wGL.{...&!F.n.@.....m..u... -p.E....c<....,.....r-...._....w..D.X...]...~S.*P...C.J.*.&..o.i.P..:.........I.(r...Z..['...q.h.?....Q...\./n{..y...4DZp{...1...;....M.^...S.X.."...J..kr.....'.%Z..h..<..e..F.G....!..P..Im9....d.Jm.>.Bg X.b.:.R.;.r!.B.....l...G......6@.7;...W......SB..`...R..zT.....C.....P.c.R..o-.O...-.u.[..$.........^.O.../...br.V~Q$o..v..m..K....1!.am2.#d...!.>...E.....}F.mv,.4l...j*~..6}.3C...1.....cO...h...z....yZ.TM...

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SUAVTZKNFL.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.863131941256326
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:/TDvxiTwradeMIoND+JuUfNLCG4OM7Ju+u2IwCJNij6zCwVhKMb2gag4HoWYJ:/yUVoR+JuUxTMtNIwCX2ohKgFageo5J
                                                                                          MD5:17DBD402A72EA2ABA8AB00CC5E8BF89D
                                                                                          SHA1:EA0229CD242F4C40B1AEDBF3BE3236623C020EA0
                                                                                          SHA-256:CB534B9573D50EB2EFD1E57541A80708526084132E40FCAF7C28537B33738DD9
                                                                                          SHA-512:30749DBDAB570B806A0E24A69FE5928AE5B747A20BA88CA46D18D2BC548B8612F76027B653503F656F100FC5AC992420D3CAF3C5528EF7C8ADD39E407B503C41
                                                                                          Malicious:false
                                                                                          Preview:._d.*d#..AOt=....0.E$..HG?.i.:........$tl=....:!!P..C}.V#.Q.P. L..[....c|m.rKV..ZBg..#...Mi..M...GG*.......@,K.i.r.M^....8..e.....t........d.v.. 1W..h..h.....ph.......<.#T......`.C..Qa.......Jw....s.S!..&TR,..Zb.x.5$4...a9P'.9.....e.r.)..k<..b%...|..IyH.+..Z..Nz..2..a..... 6...E#pW.(q.....t.s...p.)...]M+...T..g.....\.V.W.A...s.7.....:.-....g.<c~....z2a.G.c...l-....$..0..j..P.3.q..%_...F8.....().a...9..<8B...._5eE..o.p......^...T..[E.h(3....]..(....B?.."i9.r....b.b..n...E..@D..$.I.5..B..........'?{.....7.e;......LVb.\..%2.6.:^_...r....gxi......$......d.%U....VT4....+..b9......>..!.@..V....1...s..Ss..R.l..,..&..>...Cq........,.._....E.......JF....Q't.|[../......=_;$..4..d,xQA..6m.|.z........Wg..w...D;.(.!.w....'..ev..>+.q|....k|............f.F....!4.m.2..'..T......>[U.J._...hv.o..H....x*.oy.t......=.'.r.......A.j..Y#.2WN/y.|.s$.`SD.u.....js..s7.. ...W._.K.:.ve8.o..].....eC>_.7^..:..;..w...~.px.930{\.....Gr...kKW;...vFc.5..

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UBVUNTSCZJ.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.859765160924359
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:6rr9vdvAIcQHB0kYKVzxSCXBOGiq82i0P+cM0dMa23DgyOkynPGiMvSi:6rr9v9bakZRxS9Pq8P0PdM0dMa+sG1
                                                                                          MD5:F97E6247C9B10DC3E3D18C7AD24EAFBB
                                                                                          SHA1:776D6441CD820AA7ABABC94BE2FFC0C734938C67
                                                                                          SHA-256:56BBCB91DB7E289E15D6954682A842E77E14895E697F12E2F0BB32A56BAF5289
                                                                                          SHA-512:EDD95F5BC932655C03235DB49D76BC76423E3172053D1CD601F1ABC6B781813AAF7EB7C61BF4841E5EC3A56A03318A6F83E6BDBD4BCB068E3A4C84B36D1462BF
                                                                                          Malicious:false
                                                                                          Preview:5...`./SW7;Z&....."m...7........#PA&..6{.'.....0._%......Q3z...`..s.V.M=^.X..........3~...x.Z^.p.]...PA.CI.a.s.f1.u#.......}.M....W....Co.0...}q=C.up..2..}.>e.!......v3.d../..C.ql..3Qqb^..""2.&....bA.#t.C..Q=]..C.O4.O.Z.|AU@..} :.Tf....x..%..yM."..L.1]g...bK.....@..\@.^.../^.[`......F....Y.~....5....^.$Y.C..hV..M.e.6..V......_.m.ayA...-e(N..(:..\.....F.~....0...q+E`~.]..CX[.=...7.KBt..N..J.J.........pH....X.D.blhe..t..\a7........zVL.G[4..C.xU...H.2..D......QU.q..Cy..?.y.FF......&..3.C.. .h.k.w...f.i.8...+.I8o.'(.%...{..n...JH.....^G......t...zE. .;.S.P.9\.a....J2T.....g.i......=m...8...=9.....K@..........m..8..[F..=q..H.N..............ft.x..L..4........>...z7....`8...R.o.E+y...%S....N.....hY....t.q|....#....Z}.g..L.....0......M..3..S........g..s5k.V.L....n....=+.dH{...P.Sp.T..5...[.]..LnM......Yjb/.<..@.....Y8..f.2.....d.._P.r.J.?v....;R.}I.FW..w.?.c..."..kb........1.......R[.M?X(..q<.N......y.`DE.8......Y..]..9...k(.V.T{.._......A.

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UMMBDNEQBN.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.853935944558873
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:9L17Lvd7o6bvyLbf0zUFf6n8P+xwA9y3bbCGimbFKF0HFI42JEAMQ/YXl:9L17S6bvyLL04Ff6s2yLbCVmhKF0HCMf
                                                                                          MD5:9C23BAEE8B28089219DFCA5B1C9736A6
                                                                                          SHA1:78D3EEA683AF33B5007EB24FD76981249056E112
                                                                                          SHA-256:5F34B3F0260F79D6560563D67757E0BF0AB9A1CAB8E5DD975CBC46C676C944ED
                                                                                          SHA-512:341DF6725D79A8398B65FEC84B60C868196430A3C8C70BE852312062D86AE5C1C0ECD0970E5C2A380CEE78E9E5691CF6D4FCACC1A04D06366366B418E6FED42B
                                                                                          Malicious:false
                                                                                          Preview:O..y.....G.C.....gT.(...d.@.pM...5.v.$#4............k!]....%.6.m.... ....F/.1.V...YH}X'.^.gx..O...Z|8...(...;m....D...Z...3.)..XJi.Z..q./.~..R.a....i)..i..j...\.q.r4.;...f...C.xlD....<T......1bjo.fMZ9?...l.....|*...*.4....ov..e.....M..XsR`...<.....Z.2.e......(P..%........H.!8.<q......EL[..'Q.9.R....0CO.<.0....#..I.....I.W.T.>.L....:"/x..i.}..Z)...uN3!G:...V.,..%.=i..uC(....)....4......K..3....|;..;.3....S.-r...^...[~..g>....j.........}S.PyAR_.6..m...G...z...p.1/18]...'/.......T.....\..q..M..I}.cr......#...EO........% .....=.......K..'._.9..t.Z._vy.H...../.Q..Dc..z.^J<.N.y.hl.b.pgF....*.3..jYt.......1..T....?o..W.../|=.H...OeB@.f..{.@.kU=QQ..b.,..7...xF."..h.&.......W...k..~...~6....[.`..X'..]...d.q.I].....eBQ.t,V. A@.44wsK5{..v:.`.O...;.q...nP.a-.....U|i.......Qc...'....!U&].L...C.BH.....k-.c.#.=SD.B.....*.../cp......p..}8...q.<.A.....L.. ...D..g....mX...YX.8.'..x...u[b,|.,.mL".U..r...*(.$....zYX..K. Rj...].p%..C..z...;;.......:..joC..[}

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VLZDGUKUTZ.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.864341169774288
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:KV7pWjfzSPwqoUlEH1hzwFb8Lr9e3d54shFcD3j6XDdkwGrH9DK3C6Fo2u2vhPle:KnWLksx2b8LZe3f4t3mct6Fo2u0hPo
                                                                                          MD5:DC7FD3528E37DB716EBF6B42FD816BC4
                                                                                          SHA1:823DBB9DE6A13AA52C741690CAFBDE08E4FAE568
                                                                                          SHA-256:5DC45F764CACA1909F970093F03F8675E1AC03C77387FD6D7F2C277A1F7D8263
                                                                                          SHA-512:3C65653A168C4B1268F58BB30C38CD18F4FD20EA8A0471411C504904301A89E800D83C1A96A4AAE4BD1CB14B7F22F5E3353B116C58935A62A3A3045C2168452E
                                                                                          Malicious:false
                                                                                          Preview:.K.K....!.....A..|...........K...}..Xk`.38.......&Y`..b.J*...=f.&=Ek.<@....^.D..xa.,...h...5...y=.....-..w.P.Bo...*..#%....64...+.N......K.....*d..>..;.j..i......;..5K.L.6...r....#n....e..vW.<.o:.5*A....1..z......#.f.%......aa.B.{.E_x;".%...x.....;..,....d..z...W.rg....v4..>.ISl.vS.....u.Dhf..Wu...g~.q\...C...3f....1T.5.T...:...D...C...=....M...3Z.#..X.l...{...@....^...u..#H..Q1..*.....`...s......98J.;......w..9<3\..M].}.<z.do5.....#.{...:.._....C2K!?.y.\..:...g....W.M..-...Y.7.!N.E.tR.7i....,5..[T&.R.........xC;..V].;..xgZ.QnA.D.u.?...$.X.y...!.&a.Z.E ........v*..y.....@......y-..YY&.B...P.|.......Fj........v.e.i..~.K.l..L.WN..m.^>D...(..Z..:=.z8......B&....x.I.....3......#...38....."<0..U.s{`;#.h^.9.{....k..l.4W`U....*....V..P@..{.N..e..T"<qI..B.G.UHZ.....H.}.d.O.H....].k..8..lt.(Vf..X...$<B-..L.E^.>..(..V..@7.A....L.y8..IA....r.ls...<._.....I._..Me....K..`..|.N.....~...$'..D'i.v.......V..1..../.Y..p0..\x".n..P......z..*.d'..3.C....

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VLZDGUKUTZ.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.844185495347405
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:pOeBf4f24sHK6GEdkKxFc3raUZndNBlsYxn1drkCbiIP/61J+Y393H:gs4f249z0/y3rzdNBlVnzHDY0Y3ZH
                                                                                          MD5:7C7F055E8887B92101C88CF8F35DBBDA
                                                                                          SHA1:9C4A4FA461108527D1F58A0FF059B542BCD97E93
                                                                                          SHA-256:D0D9747C7C8A27AF74AD933AF3E2009A090FC9D753B3C5260A66E869B5D1E09F
                                                                                          SHA-512:64783678B4BB889534087DB39766A8481D81E4E17B6E33CDD77C1950418F817145D2BC5B783CD62C3E9A1467CAFF8340C3B4EF0156276914640FF5F9D5B2CB77
                                                                                          Malicious:false
                                                                                          Preview:........ru.f...3x\.=.e.2..5...Y.OT.omh.....T..t.k.T.yce..t.$.......8c......j.~.r........L..{..y.,.}....gV.:...4..+.yR2.[.L....U..\x...P.U`.<......&...$.Y..y.&x...*>..U.%.I.3...!.l....[.)N.Zw./..(.s..<.....K...g.D..y.T..U..-.Jw.d.}CR...P.r5K..E.~.WV..}.....p.uI1..y.G...J..L*......U..2.Hx~*{.[...*j...is....&*E@....=..vc.zu.#`QI........T9._...+.P.)...'.6..E..v..S.wP.'n:.r.<....B.,...R...]..o...........@.RZ5.++.O...D>........qA/~8.B..jBC....>.<...[.z.x.-....D..(..d..X.$..=..<...k|<....g..U.g.8....#<..$........%.g.u...[..%....m81k...,..<sE..( ....<.9..%.4zY/...q.?2>......&!....o.....j.::z1......'..C'..urH...K>.!A..Hs....x.#ed..3..,]Z.....@.V8..8.Z.....{.Ab..........;..s.AgMjZ:........Y.M;....E..x`...c^.."..!..!k.`A.M....'./q.-qmd..w..B>.n..v(.\....H....YK.T...k..U].X.....>.E...bc......a..Y..T..#.......=...P..I#.....K._...Ak.[..&.g.l.....~.0.^..(*.#...:A...<;@.Lc.`.m-M0....5Hm.%.K..'<N....6..d.....%.....?..V..I4A#t..2.V.&EK4.R..n......

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\XZXHAVGRAG.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.824626529053078
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:87QU3X52I+HyRSRxhtbdZQIBXXogD95U+wFBcW0jEzaxV6TNf7jYGe:uQlVASjPQPgDzOGJxVOWGe
                                                                                          MD5:CECBA2913A9E637CEC4117F3D5F7E756
                                                                                          SHA1:2B1C2F2EB69B9649AB40BC6C4634779110E3F32A
                                                                                          SHA-256:805AF5C0EE8CC1BB0D26B3A8A1D94FCFB8B46BD002561509C27A08B26CCA1BBF
                                                                                          SHA-512:4129323A96133E507D436CA68B62B59E2B66623D54173D384ACCA410CE4FDF84A04270B71BE11F362FA2AD0BA89708599AD58269E03710232F0DE9AC9722814B
                                                                                          Malicious:false
                                                                                          Preview:.e..........E...'.".OI."....Yh"(W...I....3...T.&.._...\.O...H.j!......X....3...8....D.IJ./.z...../.B....!K9.XU......9.Q....Ae..-..%...Y\?......H.y....:+..)..P../@L-..3 .....#...W.6;.......R.9k5....[.F.JPd..T...Q..`{..6..g...f?d..(...)..Ly..^8.T/2J;...b.......~......%. ...%...:.w.w...b.........1......q...Q.JJ.. ..eZ.<.......!.(..Pb.k..e..y...p...o...*m.@\y.a...P.n."z.N....(.j7<".DM%.D.~..H..i...a.9E...{..Ym*4...9-.nO.ME7.T0|.2#_N1..V...).\....,..-..4.E..d.a2veT..}...F...@...[.w.(.}c..g.P+...P...../{.(..r.6*..FtH.......EW#......:F.V..?a.4...Ww.......~;.W.......(..AD9...~2v.?Bo.Z.....c8.rS.>..y`....K.3..g;P..R.t...#.O.&.J.4[.....].P%\...q"4x.4L.J/... B.(..6..nMJv....@...iR.S..I..9........#O.../.....X5..8~..SZ.X.....O...7Q.U-..l.T.......`.4....C~.!d.Qv. .o*.G*.i...l.}.<........tx....I.j..S.R....>.AB! .D.l...dA.f.bs..f'.X.T.......I.....M..!g!.E.,.....KX#..Z.;E].....YP.le....J.mZ..SD..\........T.h}.2M.{R..Z...........j.:\..{J.Q.;s.by.AU..y......

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\XZXHAVGRAG.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.84712652817568
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:MSFoo4JGkgF1JN6L55VcjTE4KsrAx5xXrvPQik3KiY2v8AEvHEhMOSR:NO7Gku68SZxDXrQf3JlzIEhMOc
                                                                                          MD5:3B0D9D4700B27874C9687894D2CA3994
                                                                                          SHA1:B6142C25BED79EDA34A15BE2859E87C57ABE70A1
                                                                                          SHA-256:298839F7B1FEDB6AB84CC5EB369E5558FAD7468C9F2E1D9B898FD0ADBF4E47B6
                                                                                          SHA-512:164080E9B1AD91CDD69E5CADE5FBF6CA63A59403E8352EC299CB5D5CDCFD758E1A127C7C5A06265CECDDE507635D5298EF932ACF044493FF82BEC22590F3DD8D
                                                                                          Malicious:false
                                                                                          Preview:...m........0/U..*...+N..pg.OdznD.........S...X... >...D...N...lw!..4.......x..}4wz.......S..uw(.9k...x........~.._.#.......`..k............XL.O9.0....%R.2...-...b.:........6;7.c....(.w..$.O...R(A;..&D.}....gW.FU.t...B.....B.#.+..ml.I...V...3.....f.....#f..s.wa...)U....^z.u..`..OxXpV..i...~\.H,>.V..yO8........<Qn.....4<...M?R.......2.....A.T\...$..n4.;d\[.....y6%.....b......I#.....q...`!Zb...5..~.z...0.wl3.x=Rh.N~m..B.n..9.8. w<...&?...(hS...Z=C...d...'.....fb..=...AK}.....F.h^.F3t.V.N3..<c.A........D.a.EV.m7.t...[.c.[....T..u.B.b..2B.Q..j.F.LN.....L.Y..B.xO0.2.l.~@o...T.V.....D.-.7..tY.G.....a...,.2..ax....-.M.:^.;q..\.V`:.+...........r.x$U...DDa..&*C=.>z.4...9.S.9ff*|@.3B.U_.+.?IH..K....p..k..N..j*r.{.{.,..7.2q..%..m..d..^Sq.<.Qx...Im.q...M>....*.......%..9.T...].......?S..t(6-......2.R...u..>...bn.....|...\...'..m........w.U...S...A.....&.7B.KyPB.=N..I...R..q.1.t8A..+....y......N...~..A.............O9.t."...kn5W....,..

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YPSIACHYXW.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8281402199755705
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:rpfA0MIDT652gaDUdMI5Qm8kv8H9hkLJaTaYOLpqW+JdpLUqybnJiN:rtA0MIDk0DUKQIddaLJxSNU9DsN
                                                                                          MD5:36F997F7A2491299B6077E35B35B1767
                                                                                          SHA1:104B8E2B9E7B9E312599FD7C7F6F3E476EE7796E
                                                                                          SHA-256:5D1B2212E1EE49CABEF16737CCDD086660E79C72E1ED4B00E0A9773B08302F52
                                                                                          SHA-512:4A67CCCEE3DEE15A9A294C44AE275BBE7128F94A8CD21D92F0F6FB8DCEB5196A7A6148ECCD7A821896092584AECD3F244433BEEC15ECE0FE053510B9B8ABDC39
                                                                                          Malicious:false
                                                                                          Preview:...C..........DH.~....m?.[...I.nNm|.-....C....2.-(..g.IP....2..)....ndn.p.7z...W.\e.a........\S(T....U.I.;.m|.!.I...1L.bw)>.#(.OE.pp.Jl....B..........=ZK.<.&...B........5.or.....DW.........t.pO..8/@.<.8..n.:.".....;qb...?=.:_6....hS.....6.g..^...su6A.....4..8..k.z.02......`...Z.@.N....4.lg\.1...N..D._.....zN...#2Q6....?..6.a..a..a...t.....w.....&..w...s.D..^.~..tS"...Y.c.)C.k.....D...`BK8.k.......R.p..k...*...myg.....l.06.u...H.)(.t2.2...y../FN>?.r.=.@?.8!.dj.[DUAR.>].....g........}7.e!%...}...h .../.W...,A.2.k+.$...ZZ=.....5.....`!.4...5c..7.k..*.z.....R%..7....sv..i.......44..x.......:@.-.q0pX.-.<....7......K......9 ..[8...a.+..1.#lI...1R"bg............j-...zg..'$.2....r%...UG......#.$N.6.g*.V$M..]........Z.....;..4m.,..z.>.c.e.$W...<.kii.^.....o......`.2.:+.... ...9..f..A.}.kk..}.....Hv......\S.a..".......RM...Y -6r.....$....L_,.v.Vl.C.C.[..-...D.v~.;A2.L.m._....8...k...,K..s..f.t|.])Ap.en...d7.....D....e.O.....k.,!.[.......

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YPSIACHYXW.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.858225391111118
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:seKxclYVzWvr6cirmoxMvtO+3gs0+F6sIRdUsz5hTYCMxsw0OLQHYq5yWBmXhw:9OcWS0zxsZF9sdDXTYCMKB2smS
                                                                                          MD5:319071305D8AE0F8C4DBA19144F1510C
                                                                                          SHA1:2281434427AB05C5FDA5D870492C3FB1DD8E4B97
                                                                                          SHA-256:99ABA8745DFA531090527CEED7C240D106278FDC79DE5F60BD88DF9CB3C875A9
                                                                                          SHA-512:7C1BA39C8B651FBDFDC16DF4A6B5580300D1AAA02C4A6ACA95F6A95D406C24EC18247AA2947BD0E10884DC3786D72E7BADC470BDAF5165F04E6CB6D689C0309E
                                                                                          Malicious:false
                                                                                          Preview:.......9k .g=.pe.-.A....n.......lU9...R..P<..P....F/..d...<.[W8..5....A...W...R]cL..#.s..&...2..sP6UAdt/.....C..r.tY..s..o...x.{....w...08.&..v.)....u..i.Q1...Xwy%..p......{?...:......Q....EuM...6IWr7v.C.w..O.o..5.qGw.7.]..T.M.8=S.hM..M...C`.ymt.hp......Q..{.....6....O....3p...A..K&......^.:.><...5...lP...@L;......hH...$..<..OR7B...QN;0v.M#c.^~..a.hn.......f>g;..(..T0.-w..$.aT...\._.4....:B.a.]...&..>..Vd...`..e....+)p..IG..A. g.<.....v6 ..e......<.<..W.<..ez^....g...s...z...\..rTkP..R..5.L..s........?R......q...2?I....$.td.".4W....F...:.m...+.....-y.-./ .#...P....+..ou>Y....y.n+*.94}.J.#&Cf....{.E...%...)V|.....k-......Z.`..c....0o._.r)4.31..b.0j.&.-x.y.i.;ES9'.B....E........)..F..0@.}..<...R`..A.P".f...z0....nr...b.d...FM..x.W..u2^,.}./t+ .,......l..7.z]....$..o....rN...rM..:!.}...-A3;p76.e......m'.Z...F./l..O..v...eu..b.B.n....P..-../..wt.\...H.8-`l.....f>.z.$.J.5..pC.....D....|..a.i\..._........w...gU].e.[|.X..H..?.P#2.fa.....%..M......u..

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZBEDCJPBEY.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.850838932238551
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Gbjoah5l8B4O4xV3ACezf/e9BvYEkQY5W5QKtBUYNGmxbjYbFAh05Rl:GbjDB8B4O8VI/e9TkQY5IBfAFAh05D
                                                                                          MD5:19BCCC09798DB43356C1E94BAA3E9A42
                                                                                          SHA1:3FC7D2B401A288B262CE503CCAE584A2AC7ABB83
                                                                                          SHA-256:6914BA6C573D8FABF7FBA504C320A2A6E5B1F527D12D2CDBF59A8802B8E7DFFE
                                                                                          SHA-512:30EB34B7DE6FEEED8A52601DDDBDC8B1D52BCF7A20856C3E8C09F4216EA0229B9F8113939A3858279D208761467C8C6FF30F11E637D89ED5899D1C1A4A3DE7BE
                                                                                          Malicious:false
                                                                                          Preview:...0E.i".")..2...h..vC.`*\...R.\]....T.....B..f...~\.=.2Ynj..z..'J....B~JgIY']PJ..u....HC..v..m[T.Lh.G../(%....+.J.hk...b3/.{......gz{..2..6B.2...~...a.....w.k:.*....W.....e...H...~...+.ZsR;...7.............6.Y.X....K\.2.poN0?p2....t...Sa.C.8....,.H.l..ok.2QR.y.8v..Z..g.9.#O_)..f..?!i..<..&i...A[..R..F....2..Y(.y.O.(eP....h....K..z....`..L.8.....e.l..)..;...V..!...5S=.....>,..0+...$X..&...]...c..I..&..F.zmY.#.W;...'.G.5..u......=9.w...cM.o......xY...n.5..9.....L.....F.2.....u...<Z7l.am.kR.W...!...r.M>...pB..M...k...+..Zn;..$...;@.1..Ez....];AV..}.GURI.C..h0.%v.)L'a...P....8k.[.ZwOc...d....M....=.W.!.(p.A.......gR..D4.c.._.J>.X...@.HnK.o.t....}j...)8D Y...o..n.a..|.@.t.~.I[.....<.:"...`...FP.qep4O ..z.}pn6.G.y=L4p...].:....|B. ..Xh.w.........P...u6....0.e..m.*..Uc.....".=M....;f....6.+E.../i)C.y{.c.J....t.~...s...qx.n...._.^|-.OT...$N......Q.s.c...E.....qA/...vFCU......P.Tu+...G.....Qh.[.-...~...\.;h.l..L.zY.....c...md>..B........IL..2=..W.f.k.1.

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZUYYDJDFVF.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.85938493608507
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:HLtU4uKHmqtZvf+ePwkCiWVczibKeync6gaOdyDpECj2tqx9rhXii1vxixOsO:HyKHmq7v2e4kVJnc6sdylfycr0idExOV
                                                                                          MD5:EC244010C8FB95C74D10EE21E30F41AF
                                                                                          SHA1:3CB67263A534C00FB3F39C88FE88D87FF2E98BAB
                                                                                          SHA-256:B745116CC8EB2710C3AC796E127AB7BF9B74D942E26E77684D7B59E4CADB63D6
                                                                                          SHA-512:12B2DA31BE91F2CD1E984E4C855B3A6EE1E030BDF2C51C651095B0FF18EF2B5CEF76D6134220FBB522C5C1EFFE83E4C1D834052508462C4CECF92ED11A9EDD68
                                                                                          Malicious:false
                                                                                          Preview:%.=-...5p(/9V"'.>..`...|.#.4...a0..D...A.t3..,...I+j.D..G...q.L{.J.Hg.b..............LW..3XZ...j ...9+..ib..[J..K.JA..#3k.|....>..x.#l.R..t^D...E.zwqk......-......dN..m...O+..c..(`...l...6.V.~.=.4..8.e....M3...,i...D.O.m.....^S.*.H...4...'#..`!X.... e,0Y.'.&7W.Y..R..q......S.}l1...V.Cj.r........(..E..H.J...o>I... .b......|..p.sE[..z...8U..la......$.9N.b:....`...T..O.!..}n.j..&*.r....}w.~..E..$.n..qo8p......e"..%...=.").v.U...3D.P\..mHW.c...*.{.\...D..Z&l..M.......b9....cA\...,.tog....6....I....}<..../.]...h......;...I).q..%..^=!.....a.(....Au"..z.bW.=.S......P.?."ab.$...b8.q....As..3l......$.5..P]...v.O./c2...M...X`A.U.:+..#.\.x*..........].4..x.......3K6..dA`x.s.1...f..dM].F.t..C.&..C...V.^.,SPl....m.1vZ.(.[.."..!]...~m......v.Ze..v.`I.y.nc.#..Q.K.1./qH..........J.].........'M..R..g..V~G|9L_Xu.Q....L|.+Nfe<.c.....Ho._.....@...';.....=.L....z.r.....o..r..lX...'....^.v...*?..swisQ...z...+..........=.....\...Q.6..&3....2..h.\E}Yh EZ.n.

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Bluetooth File Transfer.LNK

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1315
                                                                                          Entropy (8bit):7.862285145210913
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:zHW1vj+9dcrexdmsV6h72PTKF82lnTm+xX0NGERtcKd41qcyX8N9:L47+Nxdm92bYlnTm+xX0NGEcKd41qc5
                                                                                          MD5:1CB9BE9A6435C5AE0D1930B53F38223D
                                                                                          SHA1:E8F900C85E0E6D2577E938149EC939E9B8A1619D
                                                                                          SHA-256:FC3B5DC25F7DAC520FF1258FD7CBB7D45D20D5A1EEC390F0C5DCF480ED00BBDA
                                                                                          SHA-512:D4CAE288D64B36296A005E2F3F9994D974A5BEA5FAB58F6DAE06E6738BEFF9985A3358A7BCD36F74A58AFAFC08C500217BF5712A2A644D833F660B855EBB6F79
                                                                                          Malicious:false
                                                                                          Preview:LO........%..o6....>.7..o...&8.L..*7B.|.............[.A.z0.......!.......|,..\...3..GCqI!=...jr.-uQ~.J...._n4....C..k..Zv.ce......c....t....C."..%b..'..h.....9.A..5-...Y...2..5.8Y...*@...S..`....lMiW....M...)...H+1....Kle..NN....%z.}"...._.7..F>..g..lY'.;...>i...K.-.)...L.z....)5hx....e..S.V......wV..L..s.n.o.`....$:........~.U...7..Z.%y....q?;m>1x.7.y.@..7..r .n..J.T.{o....-.$..............D..`..;.l1).p.........9...............p.)..=.....h....A2;.p..xc9.......+..9.{[...@.........X'.....j`.>y.......;vVW./...j.....J.+Dx..w..7.s.q.. .r....CX..&.......~S.bMOM.A.T'.U............Qm.f..[...'..l..}X..7#...`G...|..I.e5i.wMV...7s........".dk.....[Z...H..V.1......:..~P]....Om._.H-.-.$.%^;......g...{.1.(D.8.X..[...@*...p.c.]q.e.3...._#9[..O....53..*.C.....k..DK9.Zk....+..@..l=.6t.G>.K.:..5..0I...QJ...o.....A..............s.bZ.&.DB.o....;.......M..l....>..3,JM..~........s..|\.#"...f..U..D..U..V.0Z...r.io.R.......u...?.*9.."..s]8mix.g2f.....%=j...W%PRM=.v!a=

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Compressed (zipped) Folder.ZFSendToTarget.pqzX

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.22139502313054
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:c4alAJh1Ax5ZdV3m3V6xCldSZZmusgfEg8oKlFB6cUx2zfnHn:c4aY/Ax5ZdV23V8ydSuLk8oKl3OwzfHn
                                                                                          MD5:A1761F1E9408515E97B326AB8BA8E1B6
                                                                                          SHA1:96005B6346BF44435EA68374947F0A56C1B8FC91
                                                                                          SHA-256:0034D231FCD7C551AC561F6A6E5519D32A6FE362F49F3D3F24B60BC24D2640F0
                                                                                          SHA-512:E760E0DC06718DB79045E9F9CC970B963AD543FDFB9AACBBD126A378405424AC9C2729E0F5B28752D0BEFB9BC5D64DA992C1290DEFB563605922C221060D7A41
                                                                                          Malicious:false
                                                                                          Preview:J>.P..G@....`E............h..E.Q.F.GO...K._.b....G*.Dd........|.E|........I.h..".c.^..:(...=...M..Z..<.J._oO./.n;d."t.....4L.....uln...~N.'&3.2.U..z.3..'.`d.K.@O.#>..$.*..U..nt.!;.-.5c(...n...a.9W.].|.@7.#...Nd^...v.._p.g.uL.N.K.k..pX.<.e9A...;.i.W..kM<W.l.n...4..1Q'&.0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Desktop (create shortcut).DeskLink.IAaR

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.240675593646195
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:Q74IfXuLRGj32HtDXsJ6OQ/eTQ+n5IyUCiSkQhkHn:QTfXuUjWtQagJ5ZU3SHhmn
                                                                                          MD5:A4B305FD19F85563A5E28AE716CFB36D
                                                                                          SHA1:E3CED178F1B1DBD8D5C908C4F500E0CFDD27D8DC
                                                                                          SHA-256:005819D47B00BAC5AEC0A41CAD48509B9513EFDEA53929B410DEFE231528E15B
                                                                                          SHA-512:E681A2C5A201A9A7543BD146F316AC4F43B4A5F3802DA22C65D5FEDB3E046A9F930954FD3270E5A7565B313F1DE259AF383EB84FA77EF876C38D14438F9849F5
                                                                                          Malicious:false
                                                                                          Preview:..E$...l....</............$.a......E,..@..........[.V..". ...C....+....|.5L...G. ...+U..Km.59R:~.9bY..-b.Bdz..>-.i.*@.bS..........A.82....J.A...Hb.T2....Pr|...c.x.-..B.q._...7..J..~i>...|..7.c.sV........Y...h_.X......a.....6.....nQ.<.......f~........7..Z....V..^..i.0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Documents.mydocs.qINx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.095775661551711
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:nE6Fg15ITN0OAy8O8qIdIlGGGLOwv5laCK6M2L6h++c9mn:E6Fgfm9AVOMSGRL32HN2L6o++mn
                                                                                          MD5:EC3ACB890E3A6E8B30E26E5A544ED8BE
                                                                                          SHA1:32E270EF849692D532FB59CD3D6D1E4EC1954931
                                                                                          SHA-256:400A5443E984C75A14A5029D6C7769260287A35FF8CEC2BD511D427521BC1C10
                                                                                          SHA-512:2B6915AE62E2FC163A67AD6A2AA02AEE9D2254C41F0FD0BC5AA3AD06A52D84B0B2401C4DD548E5D834F062D0113A867019FE4FAD3D747F1B049737BB1C743E3C
                                                                                          Malicious:false
                                                                                          Preview:2.{. G.A...?0.t............a).fQ.......,.S.8*..=.....M0C.2..l....%...u.....of..Q.....4.......!...C.......)......W....q.U.r!N.Y>.q........7V...7.A...Cm}.....n..c$z-..b.F..1a...F....6(-?,L..p.k|.jV.%...".......(...FW.`.TN-F.{.D.p........^.p..@..Z..ZQ.).).......5.&n.cm0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\SendTo\Mail Recipient.MAPIMail.fcwC

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.082545801210381
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:oplctdWPxiL1CXWMuOz9sb5lekjWTfF4UMBmAdRf3kHn:oUj7O3z96Teqi9wdl3kHn
                                                                                          MD5:AACDAB90ED21DE9666D14BA6B76C9695
                                                                                          SHA1:7E8E80DBAD1007543E329975E34BF23C21AF140D
                                                                                          SHA-256:C35F0CCE9201EBA83E167BBBEF591587774BFEC5976A8E26C39F57CD44A95D6B
                                                                                          SHA-512:042C258F382C4EBBDE7D7DC2F8E0DAC0C332CA3E27F06A99CE3FB3B500756190BFD7C30D120BE5C1D9D2E35937C18268AF4184048006FB9ABDA3670086A0A3B6
                                                                                          Malicious:false
                                                                                          Preview:!dy..0...{...-..........*.T.#.Q=....|>U.'..n.2.2,X.~...V['..-|K...Nr.(mD.D....t.31..s.C..H.;t;g...,....8C........i..U..W.V...di....>..b}.^.......wD..C..\c......=<...d%.a..~uy4....'..z~.C..`..;.(0....\9.e.A..............{.l..N..xP..]n..`..P....7d.|z.h...#...-;M..Q.[0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):436
                                                                                          Entropy (8bit):7.538933846787758
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:RzSV0Db6P1Ox6TFFXlavztJSIoaj9hwxZ+g/T7n:9o0SPFF5wz2l77
                                                                                          MD5:C6DCBFA757FB948CA387DFD675802997
                                                                                          SHA1:7F002179AFCD86ABAF953EA540518C770528C090
                                                                                          SHA-256:9D024E53EB48F4AD7BF9248C0508452DFB00E83908182F3141FAC6CD1BD6A0A3
                                                                                          SHA-512:744626B2726A3084CC76F8C7BFC4FD20F603B604302F73B1C5FBD70323682FDEF4A0F7218B4097593E03E9BB7B6BBB0447BDC1E774855310147C8B0D8F0E971D
                                                                                          Malicious:false
                                                                                          Preview:K.[@.c.pq..=.w ?n.!<.<E.....n.f.<Nb...y.@....*. .A.y.c.p.$R...3q..I.4.!u.l.l.`...3-..1bF...4.w.C...O.......?=K...^5.D.;..._}.k.u.7..H..x.,.v...b..a...cY7.8.1.1.......Fo.KH&Q.E...Z{..}!W.!.."....}.%/..7..k.d>..4.....`.-......;j?.$...#.=;.......?H...w.MHQ92,......Kw..Y[..Ykesr'|..{)'k..h?L(..X...<.z.3B.(!.......O|.......|).6R..K..G..h.DX..La.H(.).L.QM.<...0G...E.*.x)D..a....,m......S.5.......Oq5&...0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1200
                                                                                          Entropy (8bit):7.8429013415452715
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:+XQRChoax+a2cOI/Rh+PTiobeagwuobG44eCRo55EjrzgSGSC01nvUb0RRkuC4:uQUR+aEIvETioaSu4G40GzlLS7176uC4
                                                                                          MD5:CD2D283D9BEB5478531151EDFAC326AC
                                                                                          SHA1:A29D69B1CAB28D978515921662D1552D22D1851F
                                                                                          SHA-256:4DC7BAAA1F5F52E8CE740C0458003C624EC4BAC62F13744D5EFA7F7174B0062E
                                                                                          SHA-512:FC0FE4A326987BF8C5F7EB97CCD60596C05E217835FDDC27955BCA0864295C8C8B801A7204DE618639A484C799AD82FC3C17E4F9A614624360AF89DECA187605
                                                                                          Malicious:false
                                                                                          Preview:..z.o..l6.3..C.1.2a}...[z.|.)..`'G.`M.1 ...6\\..&...AS.=.|...-Zw......W.=...6m.5....a*w..'.h..;.G.7.o2.U.q>P......W....... ..ico.;...9k-.]....6y.......k.b(....HY)\.\?...._...n..[.+j...\v]3W........E.f..o._.J.iiB...:).}a:S......LO..V....j....W....Z..s..UI...7...%@m%Kf]vD..T|m...W....`..Y...DL.,..a6..@...V.wKOv[^.....g.K.m.M.{....}.....px..BMB........O..*......r.W.H*p.....&.q~8=.v.....V>(REHY...).!.ej.....h...[....k.<...+L ..8.r[.9.dU..Z...."..@.->...$.....|.n.JS..1S[... ..Y.H...A.!...8.{-"...:6.qI....RR. k....].....C..+.5..l..-+.+v...A.yX.@......S:t<0.|....q.....H....~.b,.....k...4..>e..j.....Y!~..)......:.m......!I.7..3.P..N..T.....d!.....t...2k..Y......=...-.0.B.es..H...#}...y.t.J.O......Q.u.q.. .4.Umn..U...8..B,A#...>.Y.J..l'.xAk.D.."..s.6@K.......Z.0...K....D..R...>.F..x..".....4S.......!hst..7..R..v.B.............Eu..#Sq.h..U\N\...S.9 ~....(.0b*"i%..l...+.2...........Q.....C..CU.%...l.!.5@.i5]XA.^......O?/j..&W.....d..U.T..

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_1024_POS4.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):67950
                                                                                          Entropy (8bit):7.851257782971141
                                                                                          Encrypted:false
                                                                                          SSDEEP:1536:YAgZ14pcGrjw2RAal82F5EwtJqF1WlDBGOFBbVEmR:fY+prs2RARw5JqFoJnbhR
                                                                                          MD5:968EEF4B80655C0296D27F1972AF1756
                                                                                          SHA1:1362E7FB4922F8180547CAB5E048925C86C28B93
                                                                                          SHA-256:BCC7A6B4A479B4E8B49275FF6C7951262C0172351303FE5836D1F28CCBA14E72
                                                                                          SHA-512:568F588AC8BB2D8914F40639E01E237C239FD045B15BA2F26778CDE00AE58908E29F93DC83DA79F680B2BF0894814849FA3B096678450CEB401D275FBCE41202
                                                                                          Malicious:false
                                                                                          Preview:....o..H....X.M.FE...V....<w@B....B@eQ..@...8..Z./.............}.<pC@.3&B&.........r.<.{Z.....&.U.2.l1.9.Q.G.\SV.+..fo.V6.i|.~......<...F"..P....A%H..jwR..l{.P..a.Jb...Q..%.'"y..)i..qa.....z.B......9.Z.f.9..&..*..R...'.*X".o.U.L.J...;O.1...-.>..[;n.*..:P4.G.J;.U.DX3..-..i.0....) .-.-...b..e.+.+...r.U......y.SP......G..gr.<.@.WE.."..0.._...p$9.......T..u.......E....cR..2....#...sw.1..jke...<c../....u..pm.....<..6t..M. 0........q..g..+..(%h...q....|.RDlB...*B.6f..F6T.....#S-...`.....+.6X..>.L&.0S..e'.......p.i......H....Ez{U+x5....:.)...1....Y..Bc..).......Yl....../.f...V"...Y...J//.g..BX..E.t......i.@k..'...q.6u...j....h.y.wc.:.Z.[...\.....N.... A3.V.*K..l$....Ql.j..,.m.Jj..a.Z.>".........fO..t...8..X.[qT..Y$ Fkb.=...2z.m..p..gh..d.....4}`...v%nt6:.9.:.-Nk..{.p-....xg..p.>t.#....T...<4..k.J;;.=U3.....G.&p..<.?.0J..jhP..$...0.,)S............P.}*R...5....`u..I1E.(._.....g..W4$....4y}....?..Ta...\.cy..oLR........$.+XT.M.%..:.AL.....6_.E.*

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):112129
                                                                                          Entropy (8bit):7.709697389843961
                                                                                          Encrypted:false
                                                                                          SSDEEP:3072:bIUDIVYNhZBIDt9KFHgoYF0gOY0yLEJdUjMcpz:UfAZsVFF0gOjymdYn
                                                                                          MD5:E036392674EDC82FA1AEB503916B6B03
                                                                                          SHA1:AD66D23AB2F4BF547673B163346DAE1DFD451B73
                                                                                          SHA-256:94EA119DB87444DC6B2218ACC3F25E885420EB6BCC195E404123826BFE7C2E6B
                                                                                          SHA-512:78FD59247AD437C136AD920C08C7B14640617110260583CE4A9716A0E19657A1F380D4450AA16B182633DF898FDEB06638919F9C1C69D2E470E30CB0DF27D1C6
                                                                                          Malicious:false
                                                                                          Preview:...MX.r.R>..C.Hy...t.E.+.....t.G.._..V.A..{p:yA....V.8..2....{.trt..T...aw.:...3._.F)..'.4..{PU.....%8..xf_..n.6...#...`h..w:9...}.7g.B..g[.et]x,.....[...<..B5......^.?....<.Wr..........~..2...e.k.W.`..".C{.!..%.|.V..j+..lfv..0....eO......V.....7:.o.!...~U.v.f..:`..Ta..\$A%.....I.......\..DR.c...N7.R......U.r...k....<..lw..~L...........V..9........G[...K`..E.....P\...._&,.IG.:-.r.P....>U...$......G.Cit.40.E......j..i.._.l.6>..|...`..f.W..n...'b......@....y.w. ..74.?..u...Z.QCW.C.,.v.f........v....+.....l7.[...;6.p}^Rf..W...L....9.b..0.O.s.......y....U..q.,.T:.2N.B.T.7T....cy..V....K...O.bX.VJ.z.5..P.kZA".J`.L.G..'.a.>]...~5..5.jNp..Q.Y.V....r.!^U.[...Wi..YF.-.].N..*~."ur..I>......E.<."....V.St..k..r.E.{~c.%....; A.9z....@=%D.*.....E.$..)..C.J..L........}"1....J.MH...Wy.`G.lF.......F......h...7.?*_.s3.%QF...f" ..<..*fy.-.@.g.y.).A..8...kf.h.\*..3..*..0d,'.EiGt.....sh.>...Jl..6..."8.....t...9.&.../6.~.t..../.3]..m..C..a.T@Xn.G....(.

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Extensions\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):420
                                                                                          Entropy (8bit):7.444034053483834
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:oeEZIJu8tI+0TYUrBo7+Z+GFqZm+e+MU8EJfBpu/qaL0urHn:oeEZIU8t30TYlqZ+UJ+e1U8afBpuCanH
                                                                                          MD5:C28FDBE1B2365EEE01619DBFFCF04CFD
                                                                                          SHA1:4C4F06ADA00AF719D862F25C39567FEACCF38804
                                                                                          SHA-256:E3545A8645D40D9698F5FD1B93D17BE0C73D026985CC67D27227180BED7D33F0
                                                                                          SHA-512:B72FEE0640F9C28893F133B7FAC1CEE036DEBAEE25FFE4207F7239812E228F04B0FD18490F37474C1B6CB75C2415DFD2BE4060ACB63EF2DB6A4661E1A6443726
                                                                                          Malicious:true
                                                                                          Preview:'...^......Z....y....._.d...TIL.2..@.o".!.N.a 5..dj.`..H...7:..5............R.9#x....[.._.UX..g.E.m..F.Gy.!Y@U.l.F.%.RU.X....xU......W.lN..E.r>:n::|n:y:...(d1..X..T...g......:.....f2..".B^.?g.@KG...lX.f..C..i.MQ......&..!.G.-../... )i.j.....MNH....i.lq.L."F.6...^.9.*...0K.C[.....&G........2..w&..".#I..3P..Mr?.%.a.|.X.....q.......Y_.D..%9pf..e.:..M....v.>..kM..JeKO.;%.E..Y...z.._...].3....B..0.0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):2463
                                                                                          Entropy (8bit):7.925439188644138
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:XPEsgUf6+F4KnX92jpjKaKzkyJ2a2fuCgyKM6Qe4nN93Op:/EZ2ztCjKTJ2tfuCnKrQbnNBOp
                                                                                          MD5:9D2CA6BDAE81A6A38E1CCEB3A92665FB
                                                                                          SHA1:6F1099A69E45E76B6D424FF829601D8ADA3CA4F6
                                                                                          SHA-256:5C31714AD63B322939230E5C6F691B152CB584B2ECC43B339E4AEFE76E58DEBA
                                                                                          SHA-512:379015C442816C91B123D7DABAE5C83FD28BBBBCEB55A851F5523081ECF6670A4F58BF7F7D350662FBFAA23AC56228CAA416B0DF8D800D315593B4C8F786577D
                                                                                          Malicious:true
                                                                                          Preview:..1.........f...#Y...D....k.a...daKXn@..+._.-%u.......C.v....../.....#..J.......h.\.r...i...eU..1...o_b.+.M..M..M ..DU&[.4S.MF..2......t.}.!.~...q.:VEYP.$k..mK.l.g.E...1...O..?..K..Z..[....8.+...$.....ob.<.../F.A.5.(.^_U.F.AD.I..G...c..!..O..P..<1........"..,.4-...j.iIv.<..S]on.v.f.....K+.........mZ....".....4?.").DQ.[:].A.a...?.....hy...6k*..*jA..!8....~...U......!t_\.;P>. ...?.c..Z...$5~.....d..vmAU.s?.......Q....\...(?..".ji.!..X..D1R#.M....{.l.g`=.)z.%C..i........+.......d.........WD...w|.v...F.....8K...m...k....<jm}....<5....ih.\...}..6M..{..6.....P.C..T...r..g)...@.O.....o..\.P...A.x..B...'CB...........C..{....n0^..jR......T.TB.e....?..L.<...+.{;5.5...>,U...U......I66.9....c...u.....A%xw>_N.N.n5../..NtM.A.`1......U...^..^.......]...#ky.%fLj .IF..%...2.|."......P...dO+. ..'q..Xw.....V?.G....h....&\~..........%..9.,<f.\.D.....C. B.]...^B.e.GZM|.o@....Y.....7..lR. ...(@...T.....0m.o..gx=.j...o.t.#Z.....qdB.>.?..j....2_.....8..K.xf...9.

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\SiteSecurityServiceState.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):797
                                                                                          Entropy (8bit):7.776620386693687
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:MnaDvxP3XtjARn8b0yUoMvs0uLX9f441Hn2Re/zWTm7dols8+JoOLhUn:MkZ39jAx8wyUonTHEm7+u8+h1U
                                                                                          MD5:F01635EE2AB8E3C7D57A53C097424A8E
                                                                                          SHA1:AB3E137C2983FCE5AFBA0D2F9B6CC8A5024DBC7F
                                                                                          SHA-256:85FE2C1D7BB9BD1503ED745C925A64FF67C47FDD1367758EF323124A4F73F018
                                                                                          SHA-512:C3B448CE9483CAC8F1386B49D96F54629D6F30D1DBAD353CB68D35BF80935D9DA62E09124562506DFC098B50A04CECA9A8F27BB082BC7E6412D6F2D23DC7A44D
                                                                                          Malicious:true
                                                                                          Preview:.$._.-.1.h....d.<.mR>D..Fe..<.Y0-F#p^c.\S/..s....[]...U{..I.!.?.8gT....f...".j.v[U.4B....<H...`e.6..p+..t.cV:M~}w.F.....c6.N..@.;A.]3:.l?.."..h.7..#..n..@.T.^...I....H .%.Z!...{..4^(.......;.aj......KZ..r..]...6..+d.a0&D........~gSm....Bq....3PsK>Ql...Tr..b........A...e...=.vq,`X.........w....J..|2o..B.I...s.F..6.3:.4`>7..8y...6..)b.V........)..L-.-JL...1...b.]......m.:.E@`...qZ.....8F.......d...x...Q.P.'..)_l."U@.L...@.K6BT.../.d.........fxM...>...o....2.9..?Me.D..$#...z...HKx...`.u6....EOYzu<.M.!Z....T,0.2.....%..TN.O.4...4..04k.....*.(./.O.H..|..o.....x...=...../....O...e.`.Tn..`...*.y.....Y....",ntwUw....mn....m...2..6.a.;...dV..BQ#.D....Nt.?.I.g.D.'.........{..'.m7..&....u(.L.w...5....;.&9=.....%=y..+........z;Tn..F.$..N..W.v..m..S.oQ.q..[h..|u0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\Telemetry.FailedProfileLocks.txt.IhvT

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.170448753143877
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:YtjugMIb8JUF+tYiHa9ia/f/haUsesCMuB4JvkZefJBaptkSn:sDCJUw8i0h+sMkaKePaptkSn
                                                                                          MD5:7E0A7CD18E29631FEA59B884A826EF24
                                                                                          SHA1:D967DA4220F553C8467FC6310DABD6BDB76375DB
                                                                                          SHA-256:9386E6F03DBE67EC60C78BD38D64921DFA6AC0E53266F22D27FA97CDD1CD84AD
                                                                                          SHA-512:BF9D9C881200B48B2A53BAB46734E2AB5D8D34506AD7D0E1DE94CC3D1AD60E8B9D967ECA496EF9ECABE83933978325246610C18A4FB53668CA4937AB05799E6C
                                                                                          Malicious:true
                                                                                          Preview:./.c'.....A?.S.Q.............kQ....<x..+.A.."ZL%.V_...^.q...?..g.O3..j>Es..SE.=}.p./C.~.n....Y.8.,.m.*.#..pj......Y..eJE.s}F.tDy)...H..R...GS....L.[.U7.._..KG.....\.x....i....!.|..F..-.i.].......kh.E.(.......{GR..n.D..uz{.....k..1.b..f.......$..f...lx<...e.;.tcB>8l_6..0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):5688
                                                                                          Entropy (8bit):7.845811389377249
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:xwk6EyQkqbm1bgugkKga+CAwjKRNjaPlgDbk02PejFgZsVqo1/qTMgnBh:Wk6EVKhnXCAw+mgU03FnVq7TMwn
                                                                                          MD5:C0DB4695401468817D840E7D26BE382A
                                                                                          SHA1:2BC10B568BA07978033C6C5880048C7CAB9ABF8F
                                                                                          SHA-256:3AF2407FE6076D7154B972E0C0412AC200A0253BCACF5A397FC8AAFEFA057412
                                                                                          SHA-512:DA26AAED4655BE347455331FD7B5F0FF1BD62BF613501787928F13CFC15240157FE361E6CDEDF5DB0363D63783D0A4C8048E9E9392C46B4D9D3C8D726EC3CDB1
                                                                                          Malicious:true
                                                                                          Preview:.L...T.L|{P.tNo...c.9m..AR...<..4..l.#A.D5.M.....B..B.F.XB.....j.=....J.#......$.._..^........p.F.......(..4=C.j.B...4..*d...2..6...v.C....i]W..)X..U.........d...B.,...?......C....}o=.iI.S..)zP.....7.G$.y1I|.A......u._T|.wE.j...%...D....t.U.d.g."X.rO...(.....+>7.d.jA.s...u>.?...x..e.fz3..(..x...egE.'Y...&_..jR8M.P.......G.i...Y..F.=..)Z.... Z..J...1.....&..:....G>.{......42J.~....eP.$?....ebs.f.....e....|.e..b...h...;.....K...a..I*......MT.[.*.6.].Z...&.|g...5.(.e.6.:.a...F.P:l...=T....,.......&.:u.@........q.V..a.X..S.~.....BR8...rpSX.....$.$p..&y...h.....sl...$}..\i.......q..dI"h=..!c.Q..>.1..z...bd.h6..\..fW(. ..;$...H.A..f^......x.M...#......@.....X.l.x....r*.<...f.X.:6..X...YD...^L.....]....a.6......=.6./..u.a..=E....uA..b.].1.x.... .4G.;.].b.!ia.fn^...A...;.b.J.5A.Uo..+($QI..T....r..kc.[..;A....y..K..[.3!...Ht.VSB.....vH....[-.h.d[..5.`..<V&Oh(.......4.v.F.w.P..~...B ...g..q...Dj..p..=....y.....t:y...j......d+HE...0..'...

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):290
                                                                                          Entropy (8bit):7.179249317694012
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:jrp3QTKYm8UslrIGX4iLqNOh6HhqRIrmHXX8oJjaetkTQi3WHDTqkrDH+6b6Q3eM:jSGh8Us/4iq4hgMIEaeeT33gpDLSLYzn
                                                                                          MD5:2C51466A38819C7B5E9B8DCA8E331481
                                                                                          SHA1:93E98FB7718C8C795752B6A079ED6E893FCA7165
                                                                                          SHA-256:CF4CA82A82635868FFDBD60E133033B10A02264C3E50A6F590C6DDA3162F70C3
                                                                                          SHA-512:CCA3D13A57FD325DA77DE3D84DA9BB6861835E6B06A81A181081CE5F6D17D331244B80DFA43E7FC2ABD01941D22ACC9675135B76B726C11F2E4239F8D480D431
                                                                                          Malicious:true
                                                                                          Preview:OBr..w....u.ons":[]}J.j......3...n*._.n...'.DN-.,.=*&K.....3.g7e...si.J.|.X....v.?_"\:.n.>..}T...r~`>....8.$."+.)Fd.uo0..". Qf^.....>^D.#I.,%.VI./....H....M-Hu..K.F.Du..!i..V.....W>(......q.....q.....SP......0..>.m..T....j.T\..$......._.R.]..:+..\....HqDa....}....40xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\bookmarkbackups\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):229642
                                                                                          Entropy (8bit):0.8761605108359117
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:nBpEEAqCYS58p1zkVmvQhyn+Zoz67dNlIMMz333JGN8j/LKXYj5ku8:jEWDpUUMXCyIg
                                                                                          MD5:FA1DFF7759FD57A862BBFEBA29ADDB2E
                                                                                          SHA1:C19CCBE797A5B1DBFA2BE4804F387362AD52DD27
                                                                                          SHA-256:764BFBBBC1BB5B07BC7F0083F6E5A1F8149C6C894F8A5F1F909974797440B59D
                                                                                          SHA-512:16C0E940E351643DC801003AA9F7087980DA40237472BA91DBAFBFC694C182AB35A192B5C6444E9020B0D8D0DD5614A5F570EACAD17968E58A9C9F1B914D88B1
                                                                                          Malicious:true
                                                                                          Preview:.6.bX.-]..Nq....j5x.k<.q.x...t.E....(zzE.J|'[ ^.D.0...[}...J8..i.~7.X.Jb....(.i.|.........l-.(......V...p{#."...y..(.W.\C.].Vf....^...QH.Qy.?s...39.Y.N.,.G...\....[..h..J..m.JD.+/<JT.=.....N9iJ..iB.]....#O.^.!.N.R..j...8..1.Lt..&).j.{&>@.x..~.j...33...@3...?..^....*t....E........5S..9...Z..\'..]..y...",...."w..........i........Z.%..np.......Y0^..bW....WL.`.4=U.>..s.....0L'.W;<....&\.!.V....."..-tW..R..NJK.\..w0L.p.8P..v4.....4..:...8A.%.)=.../...U.k.h..f5..qG...\.`-.i>e...d..iq.T...!Z.....x..<......v.....K.. .X......2..%...,.......y....r..$_d.....6.F'MM(4.\K.(...~T....P...~..'....W.8..X(._Bs.W....9.&Q'.`.".`2l@.B.....[O....45.....(%......j..P...07C.O...e.)...P.....UvW(...W.F"...Kb.}..U.."J.j.......v......E$nqh..s..=[.*:.#l.$.}m5...$..U.........%>....^....Iu..z...7..\..o..F ..Kp.._N......X..fD.....H.v.Y.>.Bn...-.{6$.[..C..Z...o......3d.*.6.;8fl@#S.r*..?]<d..t.E'..p.-Q..[4....b.~....s....W.......9.AQ.....F|9..b.a`l...l.....S

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):466
                                                                                          Entropy (8bit):7.4755284882980515
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:RbYIogoovNi5+QYPNw5cjETW54U7xEUZDxIqq/OHn:8gD8GmCmU4USnqq/OH
                                                                                          MD5:F4FBD04CE6C27D2EC75EDD7F398C4D1E
                                                                                          SHA1:8717D672B09F110DDFB306AEFCB3BD441EEDF941
                                                                                          SHA-256:88399CFD8FE11CCD2366390BB7A411024BDE27D36F866AA64C491B6B5C854575
                                                                                          SHA-512:7D13A1FC08FF6FEC3A19D685A8733506D7DE52EC8D3825F1BC787486F932894D8E87D65712A5B3DF82ABA5454B3032FE365E5E60DAFD34CA0F68D1EA583BB745
                                                                                          Malicious:true
                                                                                          Preview:.E{...t`...EP.....q......2m..L..`....<.P0.g.l..J..=0f3yAJ.._....`.t..b....t.C.x..D.K...Ui..k.N....odcs..X.......c7.V.X.=........_.4.'..ZJ.R..41.P.....8..a*!....5H.../....z..^\.Bg.....rowser..Cd.+...n..$.B.D........]Z.....{.a.M_........0....yy...i(gb.g.U..d..P.&......H9c5..8.&...o..:I9x.B...,i.{..C.......,.K..nuX.z|...D.|.j.r.....k.\.{g.2s.o.8..BZ.l....F...w|.Vl....]A.yM....@%...q..........JT..3E..9..w..2u..oK..A.A.2q.?..i&...........B...$30xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.json

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1141
                                                                                          Entropy (8bit):7.810862086856516
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:RqTXWwsUxOwIBuxaxqt6holDQzUvR5VVtSXCnBDxzJiok0v1Tvf:wTGwr0xHhoizUvRXVtSXsJJiok0NTvf
                                                                                          MD5:F961E94C216333CCDE530737908C94C7
                                                                                          SHA1:FD81010D7AA7C1CB9D56741F3D92A0332A2AC957
                                                                                          SHA-256:1A03EA1B4AC7A83B6B8D496646528E72DACEC093BB412B2D2274C7504A335785
                                                                                          SHA-512:76728722F2677C845FCCE91D1D61C52E1D404CFD26320FBCC6C137B168987F21FF8BC4FED64D8F9CEE2D299E22B1CEC04C23452308506DC6884C6F0C1B74E78C
                                                                                          Malicious:true
                                                                                          Preview:..f(....p"...s.R......".@O...L...6.'..a..J....T..W..:Y...hG6..w...:.U..g.........1..Z.s=h8.f..6.E.zS..~..QX...d.z............O.Yw.#9.qJ........'1..:H8.y....C*.q..e.2...Eq...p.L.z.w..;nN...O.Y.]c....Q.x.kb...............TX.8..........A..B. ..a.Y.w.hZ...X.@qd.F.....tD......o...B...........<a.90..x.........9.3.......K..*.o.ha..(5x\...\.~(W@..6. .V.h..I.g..n.......p..!.....sd.[....H....}i1.*.).^...%......8H..*M...0&Z..*.-O9...,.-C..v.A.-^.]~7..lO.`.|....-~.....~[.[.w.@X...r......>..ZJ.DC.%|a'...+..]A.K.fk.......ic.k.....7.j.`.Oa_..7E...8E[..mO.!..r.....=.U4.o.>...0t<.?../i]..KD...f.n?...6l...FK.r....#{.s.iO.Vc.".....4.X]....3'..|.8/....z2..j..h."...X..-..Np".J}..b...,..!..9].eh^."<....w5.....||.y..J.......Sm..w._.!..m.l,Aj.W.l..64.B..).11.V....]s...7..z.....,S.Ai.nW.CX.......B.D.).@[ICZ..>.6.l......c..;;........hsKey":""}]}:x...X.v3G.0.X>.|.).s...FE.@..........@....Jg....>.In...CnH.[..`$.2...'..f.F......;[....9.8Y.8t.x"|PJ...........M...!/jV

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):262410
                                                                                          Entropy (8bit):0.2940889267237937
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:1ERy4M1fm8TcYg1CibDYuZoLNIyLOiShPnKy7bJyJZbaNkiledtMgl+mt4:WRkmnYg1TbcuZcNIyLPwKkKZbMNlITNq
                                                                                          MD5:9589E3317B206C0B97669A225A28325F
                                                                                          SHA1:11EBA4B5DBC63745D99C83F9D0F249FFBE3211C6
                                                                                          SHA-256:7313CBA8700228ACAD40D4EF2A675774100E48DDC189343FECBC47B5386BADF0
                                                                                          SHA-512:D2AC04547D39F4B404D7B9DD4B1B1E7ADEBE6F6D8E67418EA616A2E1C8376FF5F015EEF24C6D828B0200E39A606AE5E6C2137B92BB53A08B54094AFB4735A924
                                                                                          Malicious:true
                                                                                          Preview:-G.............>.k..^.Q....'R.z.......g{...#..d....83..s.:1uM.b..9.x.:.....<5.z.....k.Z9L...lR.N/......hs}.S...#?B.HF...m.G.k..2qC{......:..D.<.......2Z.k.5C.]..zv..3..g.$.....M..Lt.....Z`..&....a|{....?t.Z..I...}[..R...Cw... #......6......o.e.5....k...7km(....).....QK..9..?.?!.w.....#..W.P.}..........N..&y....^K%.s.a.R.s..[....K.'g..|....B..1J..,.t......L.....u.I...c+.`..gX.5.F1...E.VGp....&.W.M.`.$*....2.>.B.2..l.H...m$].x..|..{Z...K...c.7t..68.oY0w.2...z.>....eN.)...[.RF5.. .y,5...S^.~.BL,..-..@^....}DW...U.c.F..y...H._.-..W.;x@.m>^^)....L.H.Y..Y....-..6-o../2...J<W..q.\.b.eG.,.6......nj(._z....k!6l...I,...pW..8.y:..S..X.....f".g....."....u..h...3.tZv.....5;....+.p..{.z.....2..*z.....F&6.I.T......?.3.I.8.w\.(..>.*......."..SC...8..s..L..."..rNU.p...../.q..g.<[..s.).w..n.L..H.cWm^..0......1.b.....n=..........U..}.!.b2.a....d.....J..L..7N!.....#zo!:r.Zm...q...f~.L;....]..4.9...t.#j..&8N.........!E..h........w1.....'...C.F.

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):98570
                                                                                          Entropy (8bit):0.6745607484462334
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:E2WcZUe2rQOBd5/zUdbAgW88kXvvyuP83xGdTs:FWje2DdlzUdbAgW88kX3yq83xGm
                                                                                          MD5:AC1D5E0D02B31ED6107A05BEC870A3A7
                                                                                          SHA1:E4D232672BA28085FF544366910320CD7AD952B2
                                                                                          SHA-256:EC099BAF0B929AB6B8D022AB2BB15DBA2879A8092A7F4258838D25988838188F
                                                                                          SHA-512:37B9A8DBAACF4ADE6BC822851697D012682467B9469AB308AE52AF80A15CF7DE93078684B518C9F3F302BF933A29F725B2B20DCEBF8CE34C275AEBB07DAEBCA2
                                                                                          Malicious:true
                                                                                          Preview:..Y...]..e@:._.....E"...)...3k......F5y%.C.S.E1....|..zn.h.,....f.L.K....'.kY...^:.Vq.b....Y....y.....Bo.P...].g(A..A...+G....6.Dk^..).8_...].UK.|.#...Y<~Go~..~H..V ....+..."nDe...-.j..}..U>/..j...G......#Y%.:..L.T]'.].\.z....M\563....=....N....3.^U.Z..BF..)..=../.,......3Z;%...^.e%#+..].8.G.=....9k.,i.ko..?..41..L...5.W....p.....-.%.k.rc_".pp.k.Rd.C..FO-...#..9.c..-,...+...5..8...k..r6...F_db.p..^.n....T....OB..!.j8.......t.....\ym&.....x.G9...!..RN..Y.E..Q.J5.....k....v~.b.P.F.(...3.u\p>.P..j..i..!].J.]b.....h.b.-... .m....Z....s=.1$.@PM.k.[...{>....%...c......6s..g...z].S.8.:.R0..7.$......sY=..2..........4...[._.N..t.....V.}~.CI.5.aw..r.&k.q.)..6[......D.5.....#.%.".!..JZ__r..H.2W.p......V.S_d.>\..|......u[.@u.18.....*......\b.&4.W.4..~54be...:..Oi.'..5.U..._.........#..E.#.".x.Y..l...^.f.qS1.B.......s...q.g....A.....<...[..l..]pT......m...`....i.77(..#.-..sq..R....M....w..R.<....:..i.....|....z.8W.....xq..t...N,l..>..

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.6111615567059316
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:D9nXOpkQtxBX3b9onFqLAJKHS77gUlofNJq6UkxStYXN:tNQ9nqkSvl0NAkX
                                                                                          MD5:E8147227479D44CCD36E1E6D44A11750
                                                                                          SHA1:C5424788CF13A9EBF7B99A67A3E8654EE7A9DEED
                                                                                          SHA-256:F636D2189130B6DA43DC965FDC04DBDFFC9882C33F07E1FBE342D0F6768D67B4
                                                                                          SHA-512:7A9210A9592D4B3A551AF06F7E17F5B7651F9AD286859F3D4D2DC4C47701D8BB2C921B71E3BB51F2FE00483E73B280BF8A8C01AF03D1F7DF090A54A78CB40A3C
                                                                                          Malicious:true
                                                                                          Preview:..2...,..I...a..{QA'..........d..n.6.l..n..D...vj2.....$.`.<."..$...3.G.>i?=...dt8...P.T..H..4.<u3.)..q...gs9E&.1..V...J.l..Ks.g...TX8L@OstI.&.\..([..i@T8.[.l..h=......%....=G...........x.F3.8.........N.h..B.;;b.....j....A2.O..[..i=R.>.....DX..{[L..r&.?.b...a2k..d1.C......,(.{w.....j.N.a.}V.k&..{G.1.....e.....c...F2.!..G.k...lD.EV7+......H.4..B...zpw.'z..(...(...VU..u...Hk.u.....5..=.lh.."[.B[*[r...yn..}.L.D........6=...............x7...'..I....]....7.u?<...}..@'.$J.b@.=....4..9./h....y.N.knH.~.{Z..J.....sc3')c.w.)[.....}.p......6.h....g..=o^`.-p.E.$.x.f. ....|.b%7.Dg>kw.*@.[E.1Z....1...HM...J.[).-MJ.....|\7...U.>...[.W'......8...W.,..............v......H...8.L|.(}..[.......`?...8......l]j........<$b.m.OqQ......./..L....#X...O.pm....$l.!q.G...Ns.2. ...l.?xaOq.9...t............e. =...._;.a.\.c.........+..*..1H.(+b..<)j..`..Rm.E.....j....a..T...!.`...|...g..P.y~.7......}MM...uo....&..[....z....?e......R.~;..Z....7.Ga....2.w.........M..

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal.ywDm

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.252947865881041
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:cBKsBFOcUwsEBln6LzHMWWURRgYBAgJRvmRsfhdsSwIWqwn:cBRFnU6Tn6fe4JBlvmEuSwhzn
                                                                                          MD5:E842B0BB203A3441BBF7E5363C78574A
                                                                                          SHA1:6F9387E65001ACE6B3B2E5D98C10A0B78017A7BD
                                                                                          SHA-256:F136EAF7C5833195A976960583DAA2616B17804C06C812694D05C790353FBC09
                                                                                          SHA-512:53E1B36BC80B76564370BC8346B774BE5C437EFD031112495FB4E8C8EB461B64E5A0AE12871440A17C9813563F08CDCDB1980A68626394019CF8893CEA468DB0
                                                                                          Malicious:true
                                                                                          Preview:S.....T......k...........1..'.[Uc-..;:W[V..`."..T....%....sf4.q.Ap...".e#.....qpM..6.......L.r.....bj.....T..m.J....x.:....9..,.N..@..Rbz{..........;.g....J%...;.`..0..!...n.8g.pl..R.....QS.U.'...&."...a|.=I..^K.P....S.}M.NML...2.|...XI.\..I...z.tm......<....n.'..-[0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\crashes\events\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829702.cde8135c-88c3-4c34-8670-7ef017742548.new-profile.jsonlz4

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):4048
                                                                                          Entropy (8bit):7.9543294433458165
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:v4gdtxcC4d69de447DA6iHT+3sgxfQrFBqgIhBa4fodVuMSfUy:gBCsiv4/A+Rf02gIvqVRSX
                                                                                          MD5:868494E79CEAD6816FA8E52E0A6129C9
                                                                                          SHA1:C13FFBA21F089BD7172937F7E0D46E1BF5DFCCCE
                                                                                          SHA-256:69D354B017F8AEEF1060297D0F87D61A15FC37B6086B928364E3B3E94B0E0911
                                                                                          SHA-512:3456A31E5831A12BF185258150BE4AC7926B9700193E4C4ECAC0E8E96178B9F3CAA19E09F921D0049DEF6DCCC33237177A575ED0380275CBD9E1DBB6ACE6F270
                                                                                          Malicious:true
                                                                                          Preview:.......0m....3. l.h..P.I!.\.n....']... ...V..J.$.M.*>_>xFj..<.%3.sP..s...).o......fY..P|_.>........S........XGOC.[."....=1.@..-......4..&.u5.....L..C.d.....9.>...5..4...H ..^....).B2.Q.jI..._~S.......L#..Z....D.K...%.~ /;;_x..al.|..71x%A.......!...z...u....O). .7l.....=...y.(...h..Y.x..t....WK..uw.D.8wK&.".....bIs..l/.m."c...U...+q\"&E....m........I.l.Klt+....A..L>......a.;O..v....BR.D.[...>.<g..s.I`~^... ......~..^M..xN%.iu.xM...e.I%z..O.D.d..(e.$....Y.L.V.......~.B...s..rj.(AA.........x..Y..8;.0.#m..2K.h .z.....>...G..}~.n....].....5.......F v...C.....j.N\..pO|.D.'..w..Z'.o..\........Lh..?....NK....F...xvc}..6.)...!.1....H..x.-'...h.9..,..V..y.....0.8../Yd....d".-..Xid#...G.{gM....8.....R...@.E..N...^....R..e...W.....M.?..C..yCM.7..K..l( .A..8.MG...X..... .."p.O.D.v..[e.7......A(9X.%.A.t..{v.vt.}k".?H{...]...*.7...\.?....Ad.../hh.N...M8..Iey.u.A>.7........J...s/..7.a....z.....i.....l..G....t.@y...\9'..}.3A.v..0...Gz?.u..E...@.l..2...z...R.d

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829737.9f7a5e7a-2be0-4ff7-b132-b1f6e59a8e58.event.jsonlz4

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Public Key
                                                                                          Category:dropped
                                                                                          Size (bytes):4409
                                                                                          Entropy (8bit):7.959246349606485
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:TvkSVNgl/jU0DOtdfm7A5vA35G+/PuKrmUxxSlbeF5YFokg:Tvv/glbgf4svAc4Ph9xS5O5cov
                                                                                          MD5:F9F2138342EDB6DB45DC4D3F1758A527
                                                                                          SHA1:A391BD6588A149DA9E0B44224588E6DB20C01894
                                                                                          SHA-256:11D930F1C2C565C2909DD9D7AB277DFF1428B716398C1137D2ED7CBDD655C27E
                                                                                          SHA-512:A4771B34C29EA4FBA12FFFF1214D48FE9AEA509E62B8C0786962A2ADA2CA1334B0B80FD4358B67100EF3DA22902C5C99C98151500C9AD80034B5625FAF0A08D6
                                                                                          Malicious:true
                                                                                          Preview:...P...Hl+g.:.0z..&.X.Dh.?....J..R.$meY9..t*Y...Wpeg..N<.....5.....=.#/...xs.....b.%p...l.L..^P...*C.m&..f._.cY..Q ..T../K....V........m[..b..1-nw.5:.M..|..b....k..x...;EV..0:Oda.L..<..u...l7..^..)..M....BG......!t.B..,....)>0.@0.......+.$F..'+.T.B.`G.d...U.S.0.R`7...Mb..oS..u.....c.p%.2^Nbc........geD.6.z.o_r...lM...N......M..~....*>F.a.!.q..2,.....D..N..).Qc.7..V.M........z.......p.h..*...J|..+Sj ;..."....^..pn!''...42...XU...m...1....<.".w...j.0.D...F.....i.'hH.z..D.._E."..R....g.s..{6.|}...=.".zf..wVlYl..t..1.{.lq.......B.(P.F{.b..j.....u..9...&.h{Z....y.E..i..K`...*v........oy..5_...].....^......KiA8^P.N:o.../3....i..,.....p.a....T.....zzNz.u...Y...Nh...w...R.n..^M.V.o.f.Yk.3..I. '..L/.).1..93s..7J..y.Hw.......U9..i...c'.W.q....U.. ...............(..c..*.....e.....]C."> .,"p........='^=.WZ..;.....Y.D...7.Q...$..N....w.....d[../(1...3..iy.3J&...an..(..$.x.Q......PQU'.q.#.G.}I.1.=....zL....Wl..iq8[..:n.........|....S.kdf..a

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829744.7278f154-e8f4-4235-84c5-c5c1c6af0084.main.jsonlz4

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):18552
                                                                                          Entropy (8bit):7.416402294775717
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:KpPuG3kyc4Bg3+FlVB+hgMNMjJ1+qVKrvq6zOflExQyOsfbuylC+7BA5yJ/:0P7k4euFDdM2jJ1+MQvq7flExQybb1lN
                                                                                          MD5:0165FDB94D31A0585E86CFCEC2E9FA03
                                                                                          SHA1:840AB3576411867801178CE90A58758ADF03B461
                                                                                          SHA-256:F7F22D141CF609D8FFAE3B58481746D7D25EB7F104624FD2D3FBAD0D91D770C5
                                                                                          SHA-512:E275C38622F955096B7A4B77BB0DF65595DB3FFBD03F30F3405AD355C4F6510CC68BCA25C3918958835807DD649B48B8485EF60DC4560F5AF0FB58D4C3AF0A3E
                                                                                          Malicious:false
                                                                                          Preview:...`..t=....>y...A.%..[......'...8.......1.6.....W.4Y..s...=.@J. q.HX..y..e]..uz..h...........`f...v.E..V/'..~.)@.@.Ka.1=....[B........W.........p.....&...!....T..ID.^1\.....$m.h..E.....)J..S TU..0....Qc...y6r{.\..z.....Ws..../.n^.M.S)......}u.....q....!.!.\R6.x...tf.?...%...p.(5..W.{c.R......iS.F..E...y...5B.D...Zc.>..GI3...83.......Tuu...?n{..F8..z....^Vg.N........gz4%}....~U&............EgHx.+.......,.#o.qL.p..#\.wl..R......(>.k_.....3bqQdu.K...]J.....gv}..N.3..u>............ .F....[..a.:.&..D...:.<._.s...7......z^a..._`.c.G.s....X.u(Y. zp..x..`.k|S...&S&.^84.O.....a.Jb..Rl.!.7......*.c..fX../w.u.....N5i....B..sS.}E8.9X....e....n..#......`./At<.Go}I..#.......j*e....R....+...i.....3....6.Zb..P.z..@b.UP.. t.5....7J.{v."..c..^...7.WyC.HjI_=..t".^.`k...C. ..Ih...uF/^.d../....:Hh...... ...........&.&...>...B.......#...`...]TY.....'.....m4..g%...$...in..#aiH.R5...<Z.it?}.......`.N.2>C..e...(....B..(..Xu.d.M...x...u.....$r5.......k..|}. ..

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829746.67aa4432-87f8-463e-b422-f6679add9971.first-shutdown.jsonlz4

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):18551
                                                                                          Entropy (8bit):7.424270951790328
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:XkEIz9zET4f4LSVB+hgccMjJ1u0WKwvW6zOflESQyOsfbnDlo+7BA5yW:UJYTmdcDjJ1ubXvW7flESQybbDlTyyW
                                                                                          MD5:0B0A63CE776ACE3B6A0FAA66CA4E3188
                                                                                          SHA1:650281B06429BFBC502B4F5A4EFD2F6605CB7EF0
                                                                                          SHA-256:C13931DA0BB088F6BC4B38CBE0727E017F6E787CA70BC5C89961BAEA5B9106F5
                                                                                          SHA-512:F6F11AFCC4D4B824AFAA25691D34B05B6FD480B1A86347A9D749398CE32695DE231208643F56DA87E8902994F7DD6DA4A67480E5A05D8B82B08960EFCBB7E76E
                                                                                          Malicious:true
                                                                                          Preview:,.8w..6....S....y....|k.G..5(.&.:.u9n...E..mW.`.C..;..l.*te..[e.v..C....h..:.#...v:n./x...**m..:.O.....Sq.....b%..M~U.sH.i..@yA.C.-..v....S:.....u.0.V..myzM.>G4...sUf.".6..`C..{X+.U.x.kq..I.Ct..{.&O.5....0.g..;.C.-.ww.w.2No$......]...{.:.......~....{.E...]E...j..v...n.........Xj&~.X(.8..I:.q.<`.{.....}.3...MV.y.g...7....a{...?.<V.t~....}2.M.....?.b...(...\.^G.e..'.....g.Ro..$.:......XDt.u....+.J....p...~.....w..p..o..@l.r s..].m.c..%m.\...y_....;.+..].E0...1.....D.n.........4.!>..`.h\`7.%3.@s..........iu5.G.N.{.|..Q..pr9a.E..Q.}.t...,N.?..{..................k...q..F..L..T..+.m<..c..3..J.C....<.:.=..9xS..A.m=.y.I..&.8..R........E.B..(..X.....rf?.1.B.MV..?.c.."..=`.3q.<!.+....^.."a.*.L.mG.=8(\x.#6M...J.5X..."..kd.J.a..f1.y.%T...#...mh..;...;..Y;.~4..k.i.TZr.....q..b}&."~d..t%..'R...p.....Is.......*k(z..D....h.2L..t.y...to..>R...9'....[.,...s...K..I......KY.S/+...<&.n..s..3.>.9.G..0..6;s.|.+=..14..J{%.f..}..V..:....~..\.@.a?.(z*..

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834580.6fc53411-ad83-4cf6-a5f6-905f0f3f52e8.health.jsonlz4

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):709
                                                                                          Entropy (8bit):7.675084429622878
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:KoE8N3Oetxb8wvgSAZDuQiMTfsiuAqiqPHMeg3Nw3k/6hzdCLo1HbcYuTsOTSn:KD8N3Oexb8j1dsi0HMQK411HwYuTne
                                                                                          MD5:612ECE8EB214F799CACC995C7A1D9CE7
                                                                                          SHA1:5BC0194CC437133C24AC7FD87524F0AECCDEE2BA
                                                                                          SHA-256:31132DFA0DAE6D6A1A1AC83958AB770EBB5AACDE6B8BF9EDC7CB2FDA3A517205
                                                                                          SHA-512:512236057464CA75D89000480D40B61F5A2AC8B2CBDA72162616B69784B0628CF200E2F482406280C80E5B2DC4C92836399F2FBCCA341036A37EC56A3DB36F8B
                                                                                          Malicious:false
                                                                                          Preview:.......f0.....W...I....c..v...........&...XRc..{.u..a..%F.....i.5.........8k.74....8.....s........'..SJ'u..r*..hN.&P~..B.D..u.......d..B.f<.."xmVc"8.A..1.!...|...Z..^.j.mQ.P....Z......Ck.X..1.....1.P..WT..z.B....8...ed...w......N.5.rL]..@z.....b...TG.ze(N......-.........IX....gv.B..g.....h..'.".k.+.........hp..fo.9p`.uT...+.R.N..R......l.F.!.0.....H<A....Y.H.y..l..X......||.~.K..7jX@.G..l.5....h.\..9...4350de32c"}.D.E"y.6U.&G<.)..79uF..z..E..../P......p..|N.P.1..l....t...c....&....i.vO.`...'.-d......A.#....!a0..!..o.#-0.....W~B.yi...Tf.N.T..}]U6.........h......V.c@.]...J.....b.9N...o...4.GO..........m6`..5..e...+`q.]B*e......3.g..s\..........I..:B..!!c@Z0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834606.011115ff-9301-40fc-805e-ba07b7fdfce4.event.jsonlz4

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):4413
                                                                                          Entropy (8bit):7.956952669969587
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:/m1Gag8zOERjtw40YVajL8zE1dkVAZmXumJ:/m1tg8RRxw40gE1dZguU
                                                                                          MD5:4A7D0A1F3727735ED7FA546105A54B62
                                                                                          SHA1:C570432D5484B5F534B1B2552DFFC84A94C0115E
                                                                                          SHA-256:77BEA2AA9596B7FEB4221632ADFD61981527A22612A2C56471F4C85DBD3E3653
                                                                                          SHA-512:3820BFA551AD8DBFEB4F8AA980C196802D87C12AD823FDB2375DEB84E0A7762CECF03BB6006D21BC02E01D042C0306051BBBA7D285C9027568123694853BC8AC
                                                                                          Malicious:true
                                                                                          Preview:,G......C.:..\s.y..ISU. ...w.J..w...k|.s.....Ln.-....PKTz....#.^....R...8y....b.......Y....,...v....e..w.U..fZ.D..H.e....$....&]..]N........B.....3-....<K1l(.T...}..`....l..o..}..r.w?..B.>...Y.`...#....STU ].wa.q......\...........-K%..@)...m..s.|0......@yr..I.....[7..*..X..7.%.2~$....2.|.....p)........E.X.3...w..+.l2..*....Y\..(ua.p..X.d...Wz..Z0.....C.;[*~.w......f..M.oZ.."X....v.Isx.++..N`...K...."....8...?..Wz.q...$.!..!..L...Y.&..9\...L..Z..B.[.....6r......,N......E?....^,H...."...5(6^.".R.PO.H.r.&`..[.... .'.1f..dA..j.......;|.......E..DN.j..x~.W:...DK=`.V.1.WGO.9.aT..G.mG<.$.4*T.d......=.h.E.....~.Q.........2.`......}....7...0r.!Y.`l....Z.q.!....#/.B..`[.TI:O/..........]..RTA.".....I.h.9^;9.f..iGw.....J9...p?.5E......1.DD<..Y....g..){E.m..U......DQx.....".D.....Z..&.f.....=..<s........yG..p....|._...k.<y...?C...;.2...~}K.......+N....4....%.5^.."..=.A..|kW.q.......\L.]....\..........q.\u.a...~..3..f0.9V....o

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834608.65054280-9d54-477d-a3ea-afcb1f88e001.health.jsonlz4

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):708
                                                                                          Entropy (8bit):7.7363371970247385
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:IA+FTvtHxez12fW/hKCz6+PD8Du2juizZgToHjMqIJ9DU0XSe44betVSFae55OSc:Z+FTvNxY76+w6iz+IQJ97L3ezSFa2OSc
                                                                                          MD5:AE55D222179289D03AEA0090FD46C00A
                                                                                          SHA1:4CD0B15661C90952DD0E2F093C6921271AC630C7
                                                                                          SHA-256:6418B217C5C090A735E63747E26B7009536A29F78143CB75D84C1247122DA15A
                                                                                          SHA-512:95C08A3D481F72E9D587AF44631EE0A0F8BB6251DBA977CAD45C5C6FE3DA49F63EB0254BD5064C2E6883D433B17EF2BEEF4E00F303D014F5553AF076AD9B18C3
                                                                                          Malicious:false
                                                                                          Preview:...Rq...}.|..Rh.r.y......I....scmU.L.r.+.7.Y........M.h4>.=..{g../?....EA;z.p....J|.5I....*...U1/....L.\...6..4...9....E..jg.j.....b..\..~$..}...s....r.C..bq..t....C.....G..B.Td0i..k Z.....S).$......A...@_....r?0..Lr...t#.L...J....<...W.K."..nf.1.Y(G....p.QV4..v!W...XR.........+\+.x\......I.0..n...plg5.' G.<t..7...s7j..].:.}.h.&8.....K.o!"....h.s.s.E.-...RT....H..y.R.."H....?..m. U..._..w.....{&.\...n..YD.f.350de32c"}..Q..7.C...a.....0..zbA~v..J...3.".1..p...$.2.......a.4.....k...k.G.v.].E7..2...`UV...#........O.q..w..Re..|H..Hv..#.Q.6.!...U7.f.nd....HT.FI?w...t..fz@u..j._...nP#.S...W.$yZ#..}N....._....t].....n.&...T....{....Z.fu..`.M....~-.....{.9.2.,S0w.0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834620.c7889da7-33f0-4599-8452-58d47c58437b.main.jsonlz4

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):15341
                                                                                          Entropy (8bit):7.380828708901953
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:Faejy9rebWb7H9IVLJl6XZGPkA6K7fNfmfbiqSD6W:FbjyNb3W1Nm+D6W
                                                                                          MD5:869CCE6DFDCAE3C7BEDFE59E5A92EB1A
                                                                                          SHA1:9044438F56B7E8947D26C7407A718FE4A2E27E0F
                                                                                          SHA-256:300681135291E579472A1339E5C67DAA50DBEE345F081FB2F08483F2AB2FF3CF
                                                                                          SHA-512:E031D5602D6D0859FE8F2689FC7AC0BEA41898E6E20E6D12CABAB7E19F91E56D8BAEF19865FDC6F73F1D625D244B957D7E9290230700A659DDBF4E84F89FB9BE
                                                                                          Malicious:true
                                                                                          Preview:.o0..3.../.#x)..Kc.-.6..Ym.R.I&D.....#.7...6....I.U.p.W{.!5.1...J.)..IYt@...&.Cy.m.1.(.{I9...K>r..K..I...H...@.3..?'.....q&/......ir.>....Op.x.y.. .e..%r.v..C.....S...^+N.....L..r....L......t......C..'.S.];.-........#3.......u.m. ....u.r...v(..X.&r.i..Jm.....|.8.x..tLy..y4..G...0..&F...#.../f _{......"..X...4h......jz..f....g.....A.....)f..,.j..@o..~+..n.q@A...j.).2..nT......j..../..7.<%]Fy3^........s;.I.3..i.o...t.....,.dc..W.."|.{.3{u.th6..I..z...g..".....x.[....$-?I.}..4i..X.vPH.h...($YP*f....r.KOK.4.!....cz.E.....g.....Q....6..k....w.6..u9.K..,...J.ie.......>?j*.l..%!'8.(.W`8.(...F...7$.B._...PB....t.1..b..N...C..K.u4.7.>{...hs.N.......k._....6...&.6&.(.Q./..B7....q..%..8..q......Q.......\...D^,T..1..k.LK.B.F....u..h1._...Q...E..e.(ELm.M..f&...q.w..:^. .%:.....5...Sk..i(.B.%....lc`E6FR.AB.}.'$.((k. .d.D..m.]lV..s|.U46R........@|....Lpcp....`..l...#!...K..|}....S.. ...f..^+..j....m..>..8E.Cy...hl[..(.......>..a.#.{..

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857833.45e26519-596d-41a5-b290-e547b44111fd.health.jsonlz4

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):711
                                                                                          Entropy (8bit):7.7317745822327915
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:VhyHRgsHVMM1bcZ691erv8CoaJbY5K+2nvw+fR0RUuHIlOA/5CldwysN4PWbQ+mB:VhyHRjMMtY67er1s5K+2vw+WRhrU5CHF
                                                                                          MD5:72FFA638CB928B4E302AF191C5F34AED
                                                                                          SHA1:7BE69F03602D4AC990F7FC388FC16B4D147F7178
                                                                                          SHA-256:475C98A0F8786A84632E8A4AB3D9904CD641BAADB67A14E71F8A06FE0B307288
                                                                                          SHA-512:3D00742294C424B52DFA40110472704985E8D323FDC74F7F5CE8F988A106887A7DD7D113D823C5CEECE00244EA201A887AA7DC53F62EC6FE0D55D8A281E34082
                                                                                          Malicious:false
                                                                                          Preview:_.27.....<..).Cv*. ...s7......I...:...p.....b`.r.....2.Z..-.....)pV...oo9.d..S%.....J...G....8.e.R..x.b.)Ha......BE.Y..E....n..[....M.......V.3.M..g.T.....xg;.i.K....X...I.'..W.fdj:NID..-.1....HR....1Q..cM.....P.y5..f.......}iVE....|s....aGA(.T...n..R.Q..H....Yz.e.Ad...FC|......@.L..I. .p...'))h...w.;.,Rd.p.!..8,9..._....&..v._M.U8..E...C..y..sA..C.p.....(I.hlU.Z2..N...>..I/......?3.$y1"W.s.........?.r134350de32c"}3i.e..<t.Jn._.....#.._.G...&hZ..,.w.h..E.6...F). ?kvV.9.....7/W.B....~..o...R3.T..a...".2..:DS1....Q..U.F.x..kA.i..'..g.......*.."..?i.....WW..46^`.c...g....E8.......t...OO..V.].$....SNt..A.#..<`],....5.<.Vv.l(..fPX..`D.V.`...,.b$.).eY....R...^0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.81ddb4cc-1d49-45f2-961f-e24ea6db2be5.health.jsonlz4

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):710
                                                                                          Entropy (8bit):7.702854356445507
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:3C26nTucItZgfkW4aLMlB5MXWMcJogjX7+QXxQh7DrdwiYp45u3zue8LSUt7NGDn:S8cIt2YdMXNcmMX77XxgRTYpku3JVUvy
                                                                                          MD5:9E8DC409A865E29E51AB0940F53EBF97
                                                                                          SHA1:580FD7249FAC9EF1EE0E2DC61D93960C1EFAD21D
                                                                                          SHA-256:F59454C09B132FEAA40F0BC0C6EE8B5730067B15B472B0E8261FC0F22DE0C75B
                                                                                          SHA-512:4601EC94E35A43838DF3CB26810D3AB43108E8A5EF5B51A89CE59C449144FED4D132D64B232CD81F52D6C5CFE207B4363EDFC1B572F883D99C6B04CFC62768D3
                                                                                          Malicious:false
                                                                                          Preview:...X.c..?.}'.v...6...?.....M....G.!\..3.\..u@U..$..=..O.v....O.......$aW..`g........ZJ.0..l.3.3.37E."....dK.:9m...%.O.M.2x.dk..mJb.F.aQ!.&{..ivM~.x.Z.i...p'.AO..SB..].R.0.q7.ua.@...l.=....SZY...G.q.^..YU...))....>a.>..N...'..>j.......h.r.&..4.....n.(|...nRr'\?.Q.....f..d...OJL..9..I)k.Buc..V...j....."..9....g....u...G.....<..u..U..j.h..<"..].......H.F..[H...).........K.Y....4...5..9.X....m..Dk....r......34350de32c"}_...DX.F.Y..PL^...pi..P...G@@..;K.H.d..2....J.P.e.TM.}`._.w.SJ..q.......FJl.p.Z..B>..8O.8*!....4G....b4l..qu.eh......bJ6..mVE..jQ..qyF......l.~..@...h.n.......4..V"...V.7.G.r..IQ....|$.G...... h.M..i..+..mE.K...4B..|......._|.....>.{>v.R..q0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.a73949a2-5a70-4025-8008-88156c16bb4a.event.jsonlz4

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):4409
                                                                                          Entropy (8bit):7.95210261401454
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:DIX6XLj2tSCgMbkfEUfGZLIVuXr6G3NDkoGIk+8QX6s:Y6XQPkfZfGGVSrt3Fk5g6s
                                                                                          MD5:B72ED6DB82C3D3F3C24811A2AAB50E52
                                                                                          SHA1:A18E4089DD37DDAE6E6EA1113311A2074C92649C
                                                                                          SHA-256:A2E5A0F99FE0FF79EAB7C7745318DF8814B15A974918841C7C9557B6D6386422
                                                                                          SHA-512:FED00131B2BB738B4AD6D9134BC3E0F6A2D0BCDC0C7FCF911F6418BD930A1175C837EA312C411E064CBF5242550DF9805A9B0F84628D69FF3DC1808854EA7A26
                                                                                          Malicious:true
                                                                                          Preview:@{..w.dmO..|p....$..`.b{...q..BmV....D.>J..z=.!.Qr.f/.z..wQ..1S.D.uI.8~.x.B<.KF.N0C...........}M.L..4.c.[....w.....x..D<....G.Z7..C.....!t1V/(...-#&.=mKF:z-,.k..-.V.O.8...:-..n?n. ...{,....!Q...z.K..V.$.>...q]./.e.g.)......x.eaH..^OT^Z...%0.j....T.^<.vK~.....)N... .F.2....'.v.h.jo.".....{)e...A...../....p....m'{.Pk&K.?...G......2.tB%....!....>.C.......g.(...Y..m.............oC.F.......NG..x.+.G)py....t.. .-.]...W... .nO?/.H.D#..4......B......p.....D...t:.t........kz.E:a.St.}?...}.6+....7..............i.,..u=H....CS..R...aseE.9...A.E.,T...I..O...>$.u....iKN.Pym.EDz..s.^.e8`N..y...t.......y..}.....0.~W...;\c)....~..#.._..[e..<.ljTy...Q.e..c...\...\Q.Y.7......ri..B{b..r.vh..p1L&6..^V..<.I*.1u<...iCe-G....Hj......a:....<.."`.w...#..s.....]"...C..o.(.....4..\e..OQ.E...X4."g.1..U... .[....u.......@[.. jHd.Z=.....|.%.".&.).......:/b6........>y..8..T....U^.RZ.L.;u...........N..h...#$:b..Py..e...R.ffj..8.n.n.....w...L..h_.|-...[....=r..>.p#.(CS.....F..

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857869.95af30ae-acac-4802-b983-233d7fd3cf34.main.jsonlz4

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Public Key
                                                                                          Category:dropped
                                                                                          Size (bytes):14288
                                                                                          Entropy (8bit):7.417244728316184
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:0s45Fk+uPOeJ+7b+UHhM8x3uYynUFO623:J4HD8Bm+8Rzyat23
                                                                                          MD5:4A0FFEF295F0A7024C0594613B61ED60
                                                                                          SHA1:970F63D6CEF6EE5FBE12F8B5FA2DFE2F9090D540
                                                                                          SHA-256:5930ECAB299F1CFACA75178DB1F7F94B8DD94E4E326495BB664B7AFCA3561E03
                                                                                          SHA-512:C309F106028BADEC638A08698B5D3745543C24CDE9779E35E2C758F92592F92BAA88B91534739922FE41D0E2DCF53FDF7F92F24395D147203BB796D228DFF11D
                                                                                          Malicious:true
                                                                                          Preview:.^.!..\."!....pW..B.6g..`.P.T.[y..U.M.;..f..%*.F.!..*......g...0eo.....;..@..n!I...7...h\..xu.1.Ea....q..<.j..R}8..o.Y~..$7e...:.....j...=.G8fM.KAP.b..(.^...?B..-.}.!6...........[8W.....Re<...../.EY.A.."..I.<>.{...._..v.8i.O..\5...u.1`.7]!Fh7~...*..}.....g....c...u.8...i....k....8...)."....Dq.s..8....K...._..o.Cd....w...V|A..,.0...%..........E....Pm..O..d.+....U...D..A.+y.....T\...Z......W7'.Ve.Hm4#.....-~.. .I......?7$.M..s...'.1V.[v45..*.,'Q...+.I../..)......]..e^.t..U.xf..}..~e#.N..%...@.s.O..c....x."+..p.B-]B5.H?i.%.`.).dR..m.Hk.;...@.$.ci.....z..8...'\'7...hF..E..y...P..l.k~.}..8....[+.q@.rD..KI..X... .m.u.._........tn.3.E...5.d...k..,r.v1......._N....O.C.tI...../.Zf!GDr.....*kq'..|.....M.....?...!>u......(..%...{.}S.....A|Y...F.>.....r...|...9X....0...&...='.Q..l..Lx@...2d...>:@...[.>.Z.._o.!.o..J...f.....l.K&..\xK...zn.9...T~..?w..I.K.`...x.....L(.^......ub....3"...Uu........P".^..}*J.....F.%deX... .4...m...x.;.,.....$.....!....;

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\data.safe.bin

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):12692
                                                                                          Entropy (8bit):6.067803977736584
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:um3FAqxX8u4Pxy4+3+Z8aA6b+b+lb9bocJ2OPoir:um3O4t4Pxy4+3+CaA6b+bEb9blww
                                                                                          MD5:CF4B18CF264F68DAC5E88A927840D7BB
                                                                                          SHA1:8A2896C3F6C516ED950558D5FE030D5B8445FD0E
                                                                                          SHA-256:DF86CE0040B5B227BB179A17E8A6750895860D8AFAAA48B2E35280C9C08C51D6
                                                                                          SHA-512:FA186F61D71AAAB36BD558FB52880C078B9DBDD1DFE837BA7EE94150FCD0954085DADC46124406ADD8B216E9F5C14B87BA04439A06B9A6CC8E8A5A3D6F8CE1D1
                                                                                          Malicious:false
                                                                                          Preview:..|...V.....#g..x.........2y......46..O.l..$.p..`..jj}E..{N...`...Z...k...+.{....D..6.Q...IG.v....\...f.....L.../._...#.....[.x.......z&.y.Or._...?b1..R.o.(...{)C.F...8cv.*....E.%-..a..4?..`O..C.....X.....O...3...q`...w...Jw....<..8D..M'.a"4....sz.UG..5.....x....>.b.7.. s.JC..Yw.J.e.........B..g...K...6.-.o..B.b.=.k...hs......!..L;.....$D#..e2C?M.#.k.c..{\....<H:...F...,......n?,.7.ST.....?.My.$...{5.([[..C.M%.d...[../.UD..{./.f..QmF..KO[.]f...c.\.v..w..........x_.S.N...-3.!..<.|.[g..)-.+..kF..S..Q....X.X[.~..F.,.._Z....,....!....h..-{.....<..h.......+....D.b=.\.!.b../.d-K.0.GE..1gKI!.]#v.Q....D..LR.P.w...k.g.b.4z..~^.o.....w@.h..hds.|i.....Q..^@^E[..J.HB...i..c...d.../P,.}.s0....q.1...+4a.M.{..|..".X.6i.P.IK.&.w...?...b.w....m..Q/.|.e6.>.{w}_.b8.~..B.pG."o...|.9D.AP.P..?..).^.....}B!*4K.s..,.`.h.........[/.aD.-{....W..2M..KbZ.....c.Z.--!.sJP....+HL_..3.U...L3?..+...Y...2.......-...Vo<.%Xd2V$........~...:.......&8.%..(L*8.XR5N.....

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\background-update

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):717
                                                                                          Entropy (8bit):7.727765178318773
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:YQAqW9GYeQ90ZY1WWJU4OJerBVuC5JDxNfswFpLK0jnSrb5BWK8Bv3s1u41ah0+H:YQHOG5ekWJUzKBn5JD4wPK0bSrbbW4bE
                                                                                          MD5:2810ADE73DD5A8AE901FA4362F2BFC5B
                                                                                          SHA1:617B0E07A2F96B8864A23A9CCCDD6428BBB2C634
                                                                                          SHA-256:1257AF98CBBACD6A4D6C13FDB7C341A9659F088A993F71686E3D0A09A880F1D4
                                                                                          SHA-512:B154616FA6CC5D89A40430AA0DD8D31E1B93374B1CBA3DC4C08F85A55FB40513D32E6C4372F41A0E1599E4AA958A7833BF09F337701D864DCF195BAF6C20E91D
                                                                                          Malicious:true
                                                                                          Preview:3mT_;./>ND*....i<... D.j.a:.z.]Z....'@.......S.....}C#...x...J.;.J....+.h..+.p...._..Ki#.Xs.{.*.....r....h4..+FV.U....O................3......[z.....D.....h.{.?%...V...Oc..W,...#...9..#....c]..RE;.G..].|..y6#.........Hjm.%.m9....}_s....1QI..C.GM.'.6czX......i8+....Z.rZ...H.7.#mp......m..0.......V.^W.<.....}~l=..._=.]...r..........:..<..a&uE7..)e.g.N..h..AaFv".....y;..xI....|.I.A.i.s.i..@6.f.xO..qy.p-&.{....v..1...n.t.;.h..B...P.}}..C;....$..R.'.A.$?3.{.Yg`..'E|.1.\..........:.....w....e..T.t.....%).PX..o.2.]!.8..6...H.+..HU.....o...:... &..}..s.$^pB,.YD.'......N.A...0.{.P!k.N...PK..;...I<q.CVu.....m.........:.Wj?b..+.F.3.ELY..n.X..\k..P..V.m0!.yN.TdK3...!W.......5..$n30xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\events

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):791
                                                                                          Entropy (8bit):7.759266754603518
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:YvH9hskg03FdYxQejXmCooq1JhObkRjHlthFMH+GsD6VDWSFnh1TURJWmFcM6N/y:MUkgOFCDjoJkb0jHzPMkA0J3FclmtjX
                                                                                          MD5:5FF7F3C616C0DE130CCA042C7325A417
                                                                                          SHA1:CD35EAD5AB8C08C9CD9194AC5A08C9D73C2C66CF
                                                                                          SHA-256:517A74C23490AB4A18B861EA2B0C022B8BF7C08347D8D79805B64544231AA1FB
                                                                                          SHA-512:DBDFF3DA05D5FB6DC0046F516AE54746AA026DD81B5CA23D5E6E753C9EA772D580E7C81C0C63DD7DD48AB08863164B9BFC7AAE6C403D5D56384D40E3F83968E0
                                                                                          Malicious:true
                                                                                          Preview:.<..........#..w.M...MxR@QP..#.W..2.A|P....X.rmE....,J...z.IU.5.2..?d]..F.....r..h.Z.;....nm.....3..Ke$>.Qc.m...........?.%L.5.v....G."..\..lT...`-..H.i..}....0.k../.;C......MR...E...:.c7OCG.y.....h"y....q.....2....;n2.....1..T@..:..(...y..&..-..q.w..y#Rp.T.....J.2.....Z.k.?...vp.........[./..1........1p....<.]....t... i.j.w...E.(..I.....j....~..V.c...,4s[l...%.U....'n ..P..yG........J.$..l..`.Oy... .".YSjQ...L..WZ.g..]\...e...O.k.J.......:V......4O..i.B5...Q..`j......Z....Xy......^.XlityCache"}}.K....)..%_.....s*..G......0...w.....w............7.\.`..t.9^Tj.{...{.7q.UT..;....A.A....=p.U.v5/..Vk...\..A....q.l1..~?....S.]L.d..p..}..(q]..'.a`...9..&.K%..3"..'.u...e*.....^.jt.(....Z`.....@..!.].*..).(.~...V....q..........Q....9.....X0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\05d02ac8-b2f1-4670-8541-db8ec2bbf427

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1945
                                                                                          Entropy (8bit):7.9056139633566
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:2VwgMROQCbkpuO9whHc8ZC4WIoi5RNg9+W82nyVuy6PC46v8:apMEApajC4dPNgN8LQCVv8
                                                                                          MD5:A04054C6E93584844966D79674AB1F5C
                                                                                          SHA1:FC8EBBCE269278213C884023E38F01D363A5E86E
                                                                                          SHA-256:12B006568C640D56972530797DA068CDDDFEDF3F02D6E2CF7740AC3F9C690997
                                                                                          SHA-512:07486A2F12522C7E778C333BDD5944283D36E8BD2ED35CA377FD18E51A39FA8AA0101AA30A2025E6DF8AE02244355A4C24FB419F676743E57774F883C76B5DE7
                                                                                          Malicious:false
                                                                                          Preview:V.c.E...e.s/0...'.....D.!)..;....%.9iN2.w..X.......}D*.Tk.#...."S.~......).....^..d........{L..u..:.Y...Z...P.../......:s. C`.{u#......a....&..V..........f.<>a.b....r...b...c]..!.Y......_....b..l....._.....Y".T....p....M+...P.x.MA..Y....x.2......8.....xB.........[......K....wl0S*'....E.T..G.:ZV`./}3.2....t.........p...'.%C.m...qi.{.^..}D$.24....q?..?{..0........nh....[=..|.B..#...H..(l......^}..;<.E.W..S.f.......aG...i...-...G6.rZ.'n#....i|.=].#J}f;...l...r...K.e.`\.:X..e4...."....pU.`.8....cu..E....j....../.N.]....'...p.rG.fk.'.....p../...I..l..r.a.p....yV........6. m..z..z...u.ip.>0N.....A....^..+.ajs...o3RrHeA)9b\GV`x2...:.+...!....%.....8.[.mzI.NV...E.TD.Ez......6.s?.+u..m......>....ZSh..B....kALY.C./.>....#.3.......Z..N.".b. c)U-.,.#.S...'[.....|.k..Cr.....6..9....V.dB.w...p.|_2..<...C..).3Z.R...../L..........W.O...^..FG..~.@...-eW.M.Q.6.qz`.<.qg...6*....fEA...lg3.L.s.C...,.?.u.;@V<.tbO.".;L(.........H.]...R...L..5..V.......W..GS.

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\12f997af-c065-4562-b9f6-11000bb95c9b

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1579
                                                                                          Entropy (8bit):7.867495110128875
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:VVmWZmpnMbiFTN8OM/yNVqtfrZoRHxAYw9SZkGO3I9IBiFrR:VV7uT3LXqtfCRiYXk73ItN
                                                                                          MD5:CFB51F60ABEC3ACF0821AD0EFAD21C9C
                                                                                          SHA1:44F085F582F6C7FD522EF0F78F74965A4E858E14
                                                                                          SHA-256:6C26DAF0AA3BAFB31A98851A661E6B16918E93E9EF01903DF2F09FB7EF0C9249
                                                                                          SHA-512:F394E003C611876469B5F5CFCEF046DBCEFB07F756712DFB842CA3C2045A2924739A3BBD03358472F4D009E3806478745A4C7336194AB2D0AE7231D883C36BFD
                                                                                          Malicious:false
                                                                                          Preview:.0o...No.M17.2.d.Z$lG....\s{./f...Q..X..*4...H.$.r..:.7.#.J..........g........Wi.~oADm...6]..k.LQSf.%..+....U.I+..%....Np.%.N,._.?.[...A.....f.%3.2o.eOa\2y]Z.i.+&.|*G..$.@....'. ?.Ff..w..h+-.9...{....W....Nqd...&M;..=..........6...S3.1l.i[.&.........n.5'...7}.....E....~e.dM,.JVF.~.qjY.3e0..@K..ip..w.O..z.a'2.U5..f....?-.].b.g.2&..L.3..`.....!...4`e(..7~5......;.G.s..a...gMg.. .+...W...dG.w.l.....S.%...KF.@=...4....[..X.fU.k.......q!i......\....Keu..&...r.F.mp.:.].]....a....8;_Ws5.......:p....!..{..1z....0.o..r...N...o..h...-...`....r....M)k.....a...3`.....f..P.p.O qh1.....s.-....#`.....r..f./..1x..@..Ul..Y..r..n.........P.......[5z.8.f+2..u.......Fq..}.....V.L&F...{:;...........0.W.e.....Iw...U`l.U.A..-._....l..YLq..Y#.o....k..{..-.+..........P.(p;.m.....|s.9.o5.....+gr..z......"YK.-.F`.I".....q..`.H...&..Wd.>7...}[a._.@.K..S..ud..w...P.0.e......\.`.=.k..........G....i..JcG..~..u.r.F'!..8...vk.[.\R(..L.....{.w.aS.UD.....DbR.....u...R

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1435a377-bbaf-4c9c-8706-0811a779fa3f

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1945
                                                                                          Entropy (8bit):7.907286810133279
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:qbWsMV585BFjy79tux0eDHnO7TYrf1xbl4DxbesAQqD2oXaic8KsxDIvd2uJqNz5:4bIOx0CH2IFDNKicGKATdc2TI871J9
                                                                                          MD5:A49006FCAA0F8476744BB325D0760F80
                                                                                          SHA1:FADD868CDC51A8D1DD4F2FD2289E338461F6EB50
                                                                                          SHA-256:BE51DFBC95374C13682099D4230C5434C17DE7AEBECC7BAE6905E589D0D6438D
                                                                                          SHA-512:3F410CA057663DBC6E7CB56060C7E066394B4EFACAF0A72B1206619E89E78BA65718C8AE172248A0E41D0B942D359B1962DB6F06B9D132EE0AB55F6E1F7B1D20
                                                                                          Malicious:true
                                                                                          Preview:=..+dL6.I.2....p9~.a.~......G....o.P..VW..C.=n.C........UTl..o...e..e..fs.G.N........."...$.....K".X. 5..;..Z..M{.4.[.....z....S4.8.......O....p@.......*h......v.%....}`.I.>.......!.0..#.q#z.oMO......y.pE.:1..<C....>.)g.-n%.S-..5$-.L.yK....\.rv..t.0.g.[.T...x..lr.X.l.U...].m..C.^...!.-.%...i....XW5".vP..N.)`C.a;.oe...g;..9cP]@...j..a2..$T...2....:Z......b.T.......P..A......Z...K3.....8..M.9.^..(v.......U3......M...5....ao..b.!..1..@F..C.S.d6.T...f..Z..`..H.}q..59..T.^.h.m9{..}.<..x...bb... ......Ny.}.r"...).E.pV+......]..GD..p..Vj#W..-Z#.hs.G..r..E!.`......l.nD....34.MR+..95..2.S......;.<....A...<k..en.imH.;;...\....Bz....'..._#4j...)$o....e..c.o;..hA"Y....4O......hj[.^...\......".=>......"!+..g...&..Tig~k.;...KH.f[....8~[.k4B...Y:Z.(T....)..J.v..|.@.Y.....c`!.6..(..J1!..*.(\........aQ..%.4.....^.t9.a..]...9..7!.Yeo...*m.....m..R.......('U?Q....`....I+...5..._.5.>).lqR,Z........u...~..&..K.t.. H...,........O......i....\.f"{...+.8.

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\15f01145-7764-450b-9ad5-323693350a9c

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1580
                                                                                          Entropy (8bit):7.890527260382246
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:3WzemYmVNhFA1DTxPBiTVRMsiO9O6SMEnFmr:rm7gPmTvMK9O6snFmr
                                                                                          MD5:7826D51DFF54B203941080B3DCC5E774
                                                                                          SHA1:ABA90F48D203BB2ADF805D018CE4F6163E19ABFA
                                                                                          SHA-256:95757BB6B533B216B7FED58AD0803373EDDB0A8A33CE308D814CB037C5A95F21
                                                                                          SHA-512:62A64D5D5D77F7295D5291D6A2379DB5A157076C66040C7CF6E490637D4A10AE2ADEBBD835C4AE4CAEA6D8BD92239563B12FDB87C468912D23CCD823430C13E9
                                                                                          Malicious:true
                                                                                          Preview:[pa....P'2.{.i.T.S.~....u.....Nc.Q.zPY..m.7...:.\......p.V..z.C.4..gi...I.Y...1...r...~..Mj_.(;O...7Z3`.hvGeou.u..& #....`.h.B..r.*$;.$.".~....(.[....=~.3.W!.S..a..R67w.....xB.nP.S#.x!dQ.>3td..A.`5..>b...!.=......3..2B...X...j.?.0...sw...<....n.5C.7.1@..:.}.....*RI1lj......s...fO.X.......}.Dp..=(...2.3K.&....k...]./........V[.h.....R~..D....2...b.M....o..U\.....-.![....8...T<p`..|........s.q.,...".P.....lDA&...n...=;..9...\........2].q...Bj3X.d..G.Ox...}|.".g..e....qr.6..$.d/.IKDu.a.EYl....h.<..H.....Q..N.9.%.*..g{.F........BV...p..~...IZ......u.-..;..^q.....)w'....h!.....@...q...*.....j.......K.#l....ud..n...}.u.d..bU../Pn.!..3...o.p...9.....(`^..:Y].2{b.-.S...W...9x.f.....a.............V.....r..~+6..B.../.7..&v....'..{z......M..Y).rBZ....B. U....?.R...'[LSf....I7.o.&>HD.a...@...s.]....G.).-...@......&D{....l/T|5z...|L.g]....D.#-.4.....?..s.....q.v\...'.Y8.[..Ms.5....*.......O...S..&P.;...}.:0J..k.](.z}.g......~Y.].b..E.N'...>.>2

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1d5599c8-3f43-42cc-8163-9a43c60a06d1

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1828
                                                                                          Entropy (8bit):7.894597557686664
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:HHfzRp2WKucMSFvk4Msf9XMLdn1KlZeU0swDwPfePO0I0Fq:nD26c5v9mdnC1DfeG0Nq
                                                                                          MD5:6683F171C4C80DCF0E50B9C53373484C
                                                                                          SHA1:6981A7686886824CA798D948B52DC563F715A513
                                                                                          SHA-256:AE72F1ABD6BD2F406D83D7CDAEC43AED1B063E91A7DE217295F2A60B3E563908
                                                                                          SHA-512:E98F696A62C7ADC77F151DF4D678F6A23A43033C6AAEDA6949D41FEDC024701FC145F93C27B431C376E255E0773FC065A6E023B8D1D2A320B264F51A4F63E629
                                                                                          Malicious:true
                                                                                          Preview:=c6B]c..B.g%8.E....Ep.qJ%?.1..L....(I.....UJ..'P.........C....1o.w.)...-16....Oh.;P..h,x.@...n..'.X[J.I.%nt9..d..&.o.1.j.H...L.l@.../..Tb>.XW.xD...../...F/V..Q~m..fT..:..o<r..|.F...|.w..R..I.H....c.+.....<......o:..D....J.Ht>....=......HO.....*$l.........3k.Cb.:)..#g......{X..'....E>..G[...d.e.#..Ok.s....s..G..O.bN.-.:....E..B.1^.zu5=.<.y.........%...b.1...6.V#...^7P.c..........R..E`.....IK.......Y....'.B.......?...d..K...j.k.=..X.$q4.!f.e....}.,.\ ...B..U....r..a..rS\~.@..a.h.E.%...G6O..T..k#/....E.q(<.P.... ....Q.r.'......~...i.9J...n.8.D.u....%.xE.....s..).A0..L....i.'I.<?..v....~..F.7.......E..hv.O...{..d3..3...fDu.2.M.o?(.....q..yagN...G...2.7.g..'...4...l.4.....Y}.*f@P..."....M..~..-...;Rc"m....K'.Q.#.iy. H8t..i.KE.k#(.#.....I.g..@z.).w..K..mg.....i.o.r.m.T...:qB..O...4...b......F........YY)K......)i@d....6.D..-.....f...L..x.$..OlU_[y.v..ao......jH._........!T.....=#.zO.....;|.k.u.A.M.-Q....J..k.....Z.)K?.x.v..m...

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\277ffbb3-8e94-4f3f-acac-7a401d130160

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):3832
                                                                                          Entropy (8bit):7.942418863655013
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:K/CFm/hk/BExqgJpXuJPMpNVIVZP/YhZ5HPv8WAtbbt:nFmpkpwqgJduJPeMP/YD9X/AFt
                                                                                          MD5:2FD8BC4F479893B4DC14AEED825281E0
                                                                                          SHA1:28A88831295096065BD86F7B03DCD7A1A2AFAF8A
                                                                                          SHA-256:9794B1C554E88A5D3682B62C365FBEB4E31687249BF9665A3D1F19C322157CB5
                                                                                          SHA-512:A8D3158AAC27286C91C46CEF7AC40AD1B79F73F9BFB8A691B8FF7A128DD6A28A755256BB0294CA373CD432EB06189AE5E04F48FB928A423DBF4AA644EC939D8C
                                                                                          Malicious:false
                                                                                          Preview:.'....U.s.K..as.Z.W]..a.O....n..g}..gN...{.n.`...p..j`..O_...o.....b.k>..|^0.Y$.].E...c..s.Z:\..Ro@.......r...W..b.....f........L..QV.6Q.@Z.....r..X..(..B..=nK..J2...}.+.......(.3...........|.4..i.}.O...<?.G...t..jd.azj..'Jw.9..lFBf.Y.'T.:.a..5....K......;}.}.r{....~.;.t..ni)._q....,&......d..Y..qjKa|..<..a..\iIM{......M.v...2L-......,.......\.V....]j1F.......).eE.0K...L.u...T8.......>.UL.3..E...Z..E.TV/"v.P..,g.6......@.b..z~.{..4hd..K3.. ._.J...=.VuM........A......q..K_...Wjj...=.1.....`?{...".....*..$..3{7W.).....(.cP....i.3#AV.6w..j8.../.K....K..Hw..U.......(..`..........{]4.[.l.u.;I...`....h...='.;....;.\..o.....2..G}....}.)2W.LNI.y...A..L...~y..I.m....l.G'.k.#..W-..u9._.g....`S?.+.{.)<...w.:.0..!..L...Ll.....f...n@....t.2...'..u.d..MZE.y..`&...0.f....HC..D.G.O....X.eo=.Gil..6L{.L/..C.B..[.X..W7....c...r......n\Az...0..4.zy...J.K.z@"5M..v."u.......,E.....+..\..y....<[.....^o...VM..4.....f..y.l..ufPufq7.....Jxy.=.M0.W

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\3a40aaf9-3f8b-43a2-85e8-88e3ffc7666f

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1208
                                                                                          Entropy (8bit):7.824088527069435
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:sqjKyRBnwcN3Hyawdc26mQKQ1P0J8CE0Xm0poAZjaXItY00fNarC916uX:pXnpNXydcSlkPh0XHpoAZud9Ueeq
                                                                                          MD5:44694C3C0569124A2F043716638CB6B0
                                                                                          SHA1:D1C540A90AF0D9F3CCA69729BEF2BDC5F3CAD282
                                                                                          SHA-256:28822169B9DDE3A4722F9FE3A3DB83B8D63EA26533D219F5EEC493A055C46D28
                                                                                          SHA-512:EBA4DF5E904F285021B3BDD352C342D6A781604E9E11C4F93A85B4215FE13C8CD09110E24C836D8887AB06610A490FFD0F709A5E343F82F607B786BBCF8F6542
                                                                                          Malicious:true
                                                                                          Preview:W;.5x.#xd..&7.[..FB...F..*Bt....K.....K.#.......u.\.~...b....vR.:j[...~..?.......t.....?..@....jl.......j./.......K....&:/.*.l.hVN....E..........0!...H..5.,.[..G..9..3.Bxv......^.N.&.q.Zv.k.no.@.>..j...xG5C....f#Jc.f_....k;r.........+.,.......L|.A..;.u.</.....t.h.n........Z=q./k.......Y.o....^E..I.A.A../G.. .o]. ...!).s.!..W;..Fs......O....:..b.M.a.'nb...k)....Y......IRN.2.&.O>K].W.@.&p..e.)d.../..,.n.m{.8..$...W_. ....Z.H.<.N.w..'H.R..i.D.h...&zZ@o......w.%..s..o.3.'s&.....c.R....a..Y..C..n1\.YN.B.6.....g.l........f?.N....p7...2.....n.'..C~..dA.....>..J~.\..U1...O.....A....C.........&|$x\.V..."..~.%,[..l........o......c$H$.........a4.,.(x..c..b.....o..J.e..!./*8...I.G^g.Q!.....5.9.C...dn.(..bd.jf....h.E.u$......J.....rj...M*[S:.Z.:e......|..Nl'.N...g....da.q......w..r.bGF.=.a.#...T....W..@...:^..._5.t..j...<.i.X..Tj.!.zm...............#...8.....qW....E..r..ponsors":[]}}}`........C<.F.e.r....v.*.[.2.IdP....$+i.y...Fp...x../.&.+

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\78267ebf-1fb3-4b11-82e9-903e54a2a54e

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1488
                                                                                          Entropy (8bit):7.869625322337634
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:nXBwNDr+lttdqUiqvHsPu5ZeMJDc22Qs70xbhsJh7z0J028JqeFH+MZFxm:XBwNGl0UiqvHSuTVJDXfsAhsJhz0J021
                                                                                          MD5:802DC6A59A5387CB139826466FE6A0C1
                                                                                          SHA1:F929B0AF32ABBEBCD07A02BBCD913B73389EF1B1
                                                                                          SHA-256:23ACF5B308D2A1D933E35A84C0C8B19340BC78B4F05BD455F9E5CF1B29F68ACF
                                                                                          SHA-512:36997CFFE5EDD71EF60CD06807EFD7378ECA7C5BCA2AB81F002A71904928782D487D5AC5B3D7796FB9AAEB19709894FCE1C856EC482D167620B4767AAC057A3F
                                                                                          Malicious:true
                                                                                          Preview:.C...k`......{.D.....uQ..|.....D.....p.R.m\hk.UG2..2\.....zR...B.x`....p..+W.,=Po........>...].......-...t.#b.\.n.././.b.."...,:}.. .O.....W.i...n.........&.e..cj..Z.,,M@..m..O*wWwx`+....<..){.....A2.weW.W#.Z.l..=...u.NB.8.....>.4/..6 .1.q......>....|4GS..M .&...r..Mt%r..R.u.^...2...p...].4...".].....I..^E..u._......k.D.y2...^.M..V@F...}..K.!c/..8e..\.-c..WZ~p..a....Tq..).....n!.(."....Z\..k.....I.....[......d].df'..1,+.x.@.i..w.#.a..._...z.).,.l..ju...Q`...j.....(<ues.<9..v...a7.SE.l.oX...o5.).I.0...kw..z...+aP^).)........e..&6.f5...}..B._@.....I..8.....z/@.e.;#...#T.4,[.WGv...ID......`..7...[....C..|.f`.....t-......O..4.p'.-,...I.%..i.'.~...V.l.'<CW....);@...e..(2z..G........s2.4D~.h..#..~<.T......zJ.6r............70.....".y..(.\x........(S.P....G.|..}..J..p:#.....k.dIL\..Z.Wl...=.3G.....$.9m......f....&?f..A.0...R.T8.c....d..ls.Q.J..W8.[.67....6.m.!]0....>`.2[&....a........q.#Zd....`^8...........b.Z.n.i.v.v. R...."u..K...lz.

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\7d12ac42-15c3-4db9-abfe-259bc8d249ac

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):3840
                                                                                          Entropy (8bit):7.956241456624824
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:Mtg0akmkwnex/kL6WgTlavwjBCEBYJpLDWRvemPF4pmbq1s:Mq08kwn1LjRvwL2mveHpmb0s
                                                                                          MD5:3D2327867D678AA87284C23DBC93FCE9
                                                                                          SHA1:5F60B9CC57972FDD5C7D6597D0AFEBBA0CD4EC55
                                                                                          SHA-256:8282C3314D56544DC2807F9D2371860908066D3E4A735F328F2DC537098F56E8
                                                                                          SHA-512:CB7D1525F4293292E37576225EED6AD10A1AEF5A4B12ADCD68C5138849B6A2E1C6CEC57FC9233E6DC99BD04C86C44440AE0C5442F2FC37D7B970C85402E5CCF4
                                                                                          Malicious:false
                                                                                          Preview:.F..}.v...+=.TR..L.@...V...u...YZbc .Kn\........(IEJ.nEr...I.6.6..X.R.u`..n.N....)...\......0&.%b.j.V....H].G?..o."D..M....u....x./,.XO.M....$.)..O..s.^m.,.R.6U..nn..U...5.A.)x..7l^.(....J.B..G&.x.`.d..Q^.....@.^......G...!...F.=..m.y......Jm....m<.^B.. .9..2..9/.QM....R.w.7.roH...M....1.......O..\+...a;..2.Njs.uY...C.M...AZ..y....b...].d.%.>........ADC.!....e:......\..e..Hr...T....q..U.l|..;^'.E@...C(.3.!]|M...J.W.#....G......>..$(...+.5.........z)s.FI.ab.L....BD...........s.o...2..}.f(.......Q<..V.......&....psz......Iv....o._!z..)a.......b.LD(jN......~..'.t.T...e}`...U.0..U.0....2...c....".v.2lJ!}......!..N.+..7K...;B.P2..v.].k..(..tY.%...h.{.5.Mj..\. +.]{A..Zdt%...`V.^.2&....f%ba.D.y4.....2.Y1UuXO.).\..mRl.&..j]...68H\..(j......tu5.6,...-..Ai...QNX.....#p.......b..Z.J....<..{.d....V;G..y....g.Uc.L...=Z.T\..^n.JLf6.`.HC...s.....>s...tzx.../...G..t.2...?.n.....H.^P.R..........u..t.R.q...xG..".A`.9kUwy.F....U=/z..3...r...o.

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\808127e8-e7ed-4078-b3f3-7f09061a011f

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1580
                                                                                          Entropy (8bit):7.871778212410197
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:AkIesWAx8PW/L3vehbVpnk3mbNLMIyIzjR0f3JU5rN6SHagU+aeJrFDT022TEHBJ:AkCtLfd3mbNIIv3xPagnNFDTf2YHBJ
                                                                                          MD5:8787C5D59A91AB9D6751123F64C85AF9
                                                                                          SHA1:455907EC6750521262473DB878EBE0C07A41C4C6
                                                                                          SHA-256:F4C2D8C3E985A41A693BFC49F5245CFAE1A741805E2B62F3536B81F2C60B1BC0
                                                                                          SHA-512:BB17DDADF4D8227A322369F3D86DBF9F3DA29790625BE02E5A0496B31EECAC8751CA56322C0F88B7D8DC38E537BF9810217B1EEB8300B8759DBEE75DA71DFA3B
                                                                                          Malicious:true
                                                                                          Preview:....H.R.k.U*.....b.......rJ..7AA..O...q.>B...e...^v...j.:C2..(....c.cc...z.].............|n...#n../..K\N7...9+.T.g.......n..........~.#.^Z..e..l............."~.[...z)XH........<......7.N3.fxiam..><Z..'....b.82.....;.R.g......+]"........}7......D^.......[....M.h.[..N..().)...X...4d.W....+..b..O.k..........S..*w.s}L.)&g"......U..x.......?.I..?z.8..k$.8T.hs`^..Y...c%aX.f2...'..7.....8...5.SlT..F.g..1.a.uP..\{.h.S......Db.z....TF[.W..@h.J.....R....z.j^o.^eR:.f/.A...=...Fo..M...$.l..|:...H..E...-.sNk?....J..w....d..B.T........#..V.C..dc.....I..1h..lt.\..2.c_N..NV.=.e....a1^.5..M_.:&~M?..B....?V5...v"............/f.......$....h._...^....{e._>.....tn..t(h..!...ae.s..x..hO.^.......g%'..T.'lr.....wy*%T4...l.C.Wj..k..vC@.p.({.8[9+..D..*.d$z1\Dr...X.........R.....2.`=...z.t.Z.....G(..k~.'....F.V..AtkFD.Q&.7..S..<.......o.4K...6.........p.\..@..f....E..q.. M.\..u"MV..9.T&.l.}...W../..08....Q..'..R..9).&w..;..\>+q.(c.>..o...N.....

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a5d6ec76-765c-4778-afd2-1e05a1554d8e

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1579
                                                                                          Entropy (8bit):7.89067033712225
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:7pyBZvOjyg1FaD0cfxfLoGKNyKSgiLBRM58O8U:mCZKrBRMO8
                                                                                          MD5:2DA4ECCB669BB755370966C7807B1FDF
                                                                                          SHA1:21C0B7F3A47B506FF82B9BD266C764F038D63D11
                                                                                          SHA-256:BA76A86E3070FF1AC9C2CC19F7F3DD3A1674B9262F0151CCF818403BA5FB65CE
                                                                                          SHA-512:B3E9720466A102D931917AF4F9BB703AA0FCF4D0F3A8DB0B9662D89D96CF9E08FBB47B76F213CC42FC1E41556048F7E97BF5447E16B1B58FDA4EF282D8E2C6A3
                                                                                          Malicious:true
                                                                                          Preview:...*..D..@.}Z..>.A.....y...{.[.z.$..T.SVe.Hpj.......AS.uO......7._..ZS3.#^."J.I.>...#...l..2.6...28y......a..K..T..M...xq7....{/z|........r...l.V.v......c...iFv.$.Z......5........4...Z..EP...,..~N>.zb..5<....d..k~.....L........I_.......X@..~.aK.NsTV".(.B.F.....pb.=6....^.y....2vZ.......]....._..Vv......D....rB7..-<..Y...,U.$L..r%..d..T......4Epr#..a?.JpVx..,v.6.....=...J.un.@...l|J,..*c.....T........u9-.....a@G.......Ko..A).T..=..%...o.}....}.....9*....b!@./.......EDMA.!.Rg.|...F=........A&).!...t...+.....f.-.v.H.....N......9&..f.bJ|...x{.ImY.....!.U.S.3...F^.:Cg..f......s1...b...3.@x.%.W..*.;....9.y.j..hO?...[k.|..>......@.$..Cg*%U.;.YZ...7.).f+.7.:.*...;..UWAi......"~.C.....!....*]b.:...w........b.O<7.....9....p.....;.....)..x..w@..W.@.ye...;..BH..u.7I.\..6......qx.v.M.dw.7.Y.*~/..{H..9.#.oS-V...h....`..CT.Y.....=..g.#H..9t.hB..'.S<.'5.6T~.~.......\.......JH./O..b$Q...I....Z.h..0...Y.x.6..3"9...:.2....K..e........Z...T2.u.&.a..C...t

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a7174184-f177-48c4-876a-8a51c2ed8fbc

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):1829
                                                                                          Entropy (8bit):7.9089470697991775
                                                                                          Encrypted:false
                                                                                          SSDEEP:48:MnaV2PJWr1spFWybqkWiJxAgaDNGSit2yw2lcIsG3w:MaE8roWyJwgeGF2ywUsGA
                                                                                          MD5:A63252D50116C5929BC2DD9D9EDC6F89
                                                                                          SHA1:E0B0FE6DC9CF5986FADC6A2ED17E964C72FA460D
                                                                                          SHA-256:B67DFD13BA783584B6647654E5FB04DC8EEBD3DB216CD16CC6EA38A41702C477
                                                                                          SHA-512:A560A30EA80FA8D0C2A14BE7B2282EB220E15ED31D299CBCEF71F1D7C93EB3401888EBB40DDE3C42127ADC6473B6EA7DB5D2CB69B4D6B4ECEC7DFEF29446E946
                                                                                          Malicious:true
                                                                                          Preview:..!......|.M_...8.^8gR.*>G(k.5w.k....Qo..Sp....[7.Q.X.,...lLl.....JA.3...P...%..t.z.......F...ns$.U./....F.#<(.h|...R0....if.#.5..Y.Y..........b.m...D_...a..iM..[fd.r0+*.YO`..2w.FW.b...8/.....dt.5......{..)o..?.>Pm..[/.v.N.W.ib.U..?..^.'.......&...[Q8...GY....1..4o......6...H...M../....B....&.A..T..$.....x.A....W..{.W.*..E1P.Rt..c...c...4.5...Mg.3(...e_.a..r.~..~.^.g^E......|L1...K...J..2P)..F.Gq7=..Z.AJ4..#s....;.e.O.4.C+..W..o$....u.......N(V....1`l....V.....h./......W....gT}.....z..E_.qf....MZ...4.F{.,n..?..TsQ...2|..R..^K.0....W.(iN.$)...j....T.J..j..".55...i..Q..Li.A..0..F...R..L./3Q.zx.t~.y..G....l.XyA.s....h..b...s?.2..>...U'........-..w.9..}...W.P.d.@.$!.-..5Ip./...E..h. ......y.0Z....Q....~........S..=..K..^....3.".3...>j\..S...5..&2..W.....Y.zD.IJX1q.X.....]...x..W<..7@$.....ei./l..............U\\A..|..i...,.6.C..n.J.#..g..<g..S.'syl'l(].<..._.&....`>&j6=@..58...g..|M.W:....f.@8%.W"..<.)&@..?.C.hs...-2..E}.s...5...r.K.P......s.~e.9W.

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\tmp\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):427
                                                                                          Entropy (8bit):7.532332014951942
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:pd/9/f/JWzl/Cx7JeuhYFcCTlML0wYzcI/cX2a4TA0DzhrW2tOMLms6TrIPHn:nF/lx98lU3ZI/cm4GzlWMOMLR6qHn
                                                                                          MD5:6ED185DFFF33CED8F37F4A3D9B1AF2B3
                                                                                          SHA1:03D5CEA1D034774F4C60F911A0562582E34D41CA
                                                                                          SHA-256:454911A226F584B88655B8F5CDC0DA576DB4C1E5728B411BD4C27E1B437FA174
                                                                                          SHA-512:DAB713713710163DB6B2534AAA4D98E8F99673B05E17BCFFC5405052FC252F3ED2022872D7AAB1C2130048CDC4C7AC6E0D24D3D6439BC22325281508AA72638E
                                                                                          Malicious:false
                                                                                          Preview:...d..o~.#+(d..X.MQ..i.!4Dw,?.B_.C.D...-..k..k...|.k%L..,.Vl..O(.$R....@..'.^A....?z........3c.g.(.d.Y..'.2.Z...@v.j.8D.....5...8!%...|iFRz9. .JMU .&[].}.i.....).a...*.7=.<....b.%d...0...M.c.D..Jm.. ....6..LQ..V......8....=...l}.4c....L..._V.G3C.......".I..."..n.XU.(!{...A.4........]4-T.P.6....d.h.DVC.0.Y.] H.QXf.......q.~U..<.....=.XG<,....*:n..f..#..o.wc`!.?.....t....o...p..];.){..2......h.0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):317
                                                                                          Entropy (8bit):7.289654065190111
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:Eq3jVyBR6YK5VybMy/698E3arDJ0Tt0XY8zqNFQoSijvwtyDOHcn:EYUqYK5V5yy9876Tt0BqXQL2vw8DO8n
                                                                                          MD5:C7F890E58292FD516D6154DEC59488F1
                                                                                          SHA1:CE9956E50E3C1E72B557183E78B68F770845B9DF
                                                                                          SHA-256:76E63DC68AA16CECCDA722221B5D1374229ECBDAF02E19D3823AB95AE7995D81
                                                                                          SHA-512:9609CB418F82457818075CD07003831B2D515C15008228082EFA6A700378036E65279088BF00AEE41B3ACBF29E11AF9B11E4557B44F162E92613A4E5770E2F10
                                                                                          Malicious:true
                                                                                          Preview:...._.N...^.=.....h....'00M.[......yQ.@j...E6Kc"}4.....$c....na........W.H.0.....=K.@h.....rQ...tn.u..0m.....i(|..zO..$...I...]....G.r.7.I.|...:...V..(/I...\$.{..S...M>#x......+.........J.5.@.......lV......k.|E.EJ8.8..yz..<..k..PZ...w.....v......p..I6#......0.I.8bj....^.8...........?EX..0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1355
                                                                                          Entropy (8bit):7.841384869252655
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:TzZxAjAlREoDX3sbmERBbdNIfJfW09IIb872Q82Zekuj7DH9ngMAeeDz+c:xxpCobWmTfZW0CIdQZ+XSM/er
                                                                                          MD5:6A92BF793C7B12454C4CAD0AE3803FE2
                                                                                          SHA1:7285E9DBB390344C45E0F3C28A822D3983ECE684
                                                                                          SHA-256:D0F18454ADBA89A3B22FB2C4840691D012A534569122D65A56B52FD5F5BE8D91
                                                                                          SHA-512:300BAC5F7A10F50DCC14C2AC83FC52BFF220D5E6F81A5B4C7B53F85A364308430C36185037C7CB8E473F7CE11C23B0069811F2CF6DEF48DCE121E5D37ADB640C
                                                                                          Malicious:false
                                                                                          Preview:.m.......~,.q{.......K:f...O....{.......z 1R".Z...l.....t.W(/.t.dq...0_.P>.h6..qA.7{.."..WO.z....5V..pph..#.....?.M\.7..]<v..B,......g...4.U.M...H.'.X.g..wu..D....sb..oI)....,....A..*..../->4..4?..B..U.9.~...'3'.60.....lp.P........PY{.7...oia..Q.M..Mx.d.E.3.....*.(8....B.N......s.rL@#.3..1GQ.u4....X.>...X.eWW...lH.D..7........6..~.... ....o..?v.........Jef.K..n.v...m1*O..'*-.k...k.(...:LD.ss......v.X=....O.'y.l(/.H....\.uU(%_..<A)I%IW.#7.'z@X"=..!.'u.&.aI..D.b....o9gV...-g.w.{..&OF.>.6..R...J_..H....f.|./."A`r.=..H0.&e..K.......... ....)..{.....T....+1..h.M.."r..+X...a..8....l{k.[.........i!..J....]\...........-#..).....K...V.2t..3;...>i.}...a.1......B.v.U.[3...(.H.^.NT`..N^Z.M.........rQ..8..-...x..N....%E.}..;.cr.3..ir.Db:...../.^U!.%?s..X.^..*.e..1z..".E.B1....e......uN.,]<cw.=..tll...z...k..C....)!?...5.../\}3..j..M...|.....8..._D%@.',$."W(....XZ.@....O..7.i...v$.k...9b5n..#.w..K......"..$.s.....Bj..Yz..M....e....ZrA.z.{.Ug.$.$....4

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extensions.json

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):37096
                                                                                          Entropy (8bit):5.8100675260768995
                                                                                          Encrypted:false
                                                                                          SSDEEP:768:4TtP4E6C4p4EC4Y4QfEWvM4B4QS4z4444XQ41:4Tt7fdvF
                                                                                          MD5:A5CD542F3C96D7E1BA2686B470F3AE8E
                                                                                          SHA1:B53E74C6ED7A5303B3E82B1A78C1CCAB7F6407F9
                                                                                          SHA-256:42862E7B5E46D085DA450BDB37DEB54B3CD2A0E59676C5C3FF36E879624FFF87
                                                                                          SHA-512:41DA13577FB7B874994D46A199194734E3F361B7102391FEA650BF04BD9984DD60FD6305120B9EBF3DA10DCEAB55220D699EEA3224C112D63C5A418D492B8704
                                                                                          Malicious:false
                                                                                          Preview:.o.\......`[k..u.n...%..'.....M...fu..FS...p..rZ2....f(..?A....0...)..RU.YW.t..Z.:...L7h.>._...!?.u..f".J.Bjhg3a|u.h.E...v..tN..?i.e.<......}Hm..L..8j<..g.O.:R.X.?..c.{.C....bY.&c...>."$..O..(uo.......YW=I.?..g}......X..n..I.2.da.F..........0..&.P.jh.'...+9.[.G.5....U.....?...K..'[0.l.t....-J....H.Z.....r...<..\...7:5..?311.p.....9.......8.....H.qoR#./..Y...L.k...iy.S..i.e...8.).k...U........]0."...A...>..s.T4+$.0.uxr....m8......!..l...e....`~...sB....:t.G..|..Q...5e/2J.A/?.T p..,.?.sWQ... ..Ew8.2.......|........+.Qt.?(.3....,.*...M.._..)..\.....HxV.Y..'.[9}"..3...;....M.:b..\BC.._-....+%..I.7...b.....I.Cl....).k...L.=......p....WF...X`V}.\.2..d..PI..&..a... ..0.C.9!.....L6......=..2.....H3h...Z..y....CB..U.G.k..8..h....40.=&......V/_JE..$.|.A.|.Y.oE.....|.......Y..!....5VF.$'fI...aY@.I...|...ibB..q,6..fj.2w........<aHU......^.,*...a(f...Z.c?Y.D".67(..-..t`.dbq1.E.lx..[!...k...&.Lc:..!.".x.(ku...`.....6t..?..O.-g...3.,z..gq.=.x..;.W.L....w...^.j..

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):5243146
                                                                                          Entropy (8bit):0.07334086906790116
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:bKWolkFFOKopn87ftn2+8sTWosbATH8CHAAAAAA7Lu2+PFTUOLu2+PFTUvLu2+Pt:+WoK+Kotytn2SsbJeZzOZzvZzsJ
                                                                                          MD5:A8BD3BF77089A188169921C276240C92
                                                                                          SHA1:E6E42BD296BBA66AB0763CA03C39217DEEB3361E
                                                                                          SHA-256:2C0A082A2F970ECC0EFE4AAF59956DEF570DAB09A33C799D3085F89CD34063F7
                                                                                          SHA-512:2C013C65C9856F14046D1FE3440DB368C8CF8269382A12C267454E2F7492FA376921140BD44A60CE391D3F49C4E4E538505A0D9B2D4450D07990F9D7A54F3E34
                                                                                          Malicious:true
                                                                                          Preview:.k6*g.).j.E)<....C..*..8.`##.....;.."..o...=...t`h...O..k..sU..Er.uJn.76.E.....P.N..7.W.......-?R.z.....r4.....#....R.}.r.>.E.{.(b.p7kxb_.,&~.......q2%d_..{.G9...z.M,.F....QL..bp...............[.L.@UsV..e..7.W.b1..+.......JIJ...r?\l...l....|.....w...B..s}..g.0K .b.0..3..;..b.-..L........=?g9..h.9.xBG/P.4.*.D.q_Fe@..p.X......]...e.....(.,.vl....`.$.{h.........`.....!..Z,..[...h....M......qX.Jb9pB.G."S....,..q...wH.c....e..(T.7...5W... ...nL....1.4........F.e..>..F.C?3.q...DY..i......(....h4@....^....NtC.m.q.T3....2........V....\(.....j,.XY..E...e.z..%...l.3..........>z..*Bp....i~Wb.l.;B.q.._....P+$F.....4......w%..s..QVo.....Sb..V.7v=R..,......mR.D{sQ.......3..;j[L.=.8y.._@.R.>.@.. ..,.fc.3....._...hH.....{.7.p.k.A....<..1*.P..|.].....9m..4.D.......#...j.L'%,[79..ej}9..VP...*Z.m....VyZ... .............'Ff[}.....U.3...2.S.6.~...Y...N.A8.....A.q......$..&.@ .H...H.........|@.....u.....#".1.3$.e.].g.......J.s......6.bl.....z(...&7{J=L....7.

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-shm

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.6087444557925417
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:uxiLnh6LA15OvsphVrdNOU/6D7iu3D7jxUcX9xIraCWlVCa:uxiL4wAvQVDyD2u3D7jxxPIGC2Ca
                                                                                          MD5:5B46DC4A6C2760D38039CF7948DB718A
                                                                                          SHA1:7876AA4475B7241B79D7D5BBCBA8CE78F2BBE7A8
                                                                                          SHA-256:4F25A4560F2911A5A683B4FF78B1AA7BDFB8EC73D3DCEAA116DD3FF85B83F24B
                                                                                          SHA-512:3D33C5B6D3DF5FC26E2F8B5BC65670D4D55C7B5D25E04D906C05F8B23803D32AF8F13AA2300DF01F57EA811378971A284A856287367E381C2CA261D9D98D31CF
                                                                                          Malicious:true
                                                                                          Preview:.5.pG.w#.E.1@.!...~4&...?7q).A.{.:3{..2..Z.. :q...=...;q.#...l..!....LS...{..Q.O]7W.....j.T......_d...}.y.... o,....).:Z73>.e...t.......+....Qxi.........o9..y.......M..u.jT.LBi.....y%....Ji.......$.I...p....c..O.1.u,x.]..V]P.#.[[o...L...M...&.6.....q..g3.....+Wi=.c= ...L.....z..U..a..j.K..&.,..r.N....i......u...| .r".B/...]:........)..k..<...$.......:.x...6JO...'.Ru........#$.D^...@...N...b."G.d..ZI..4O......m(."...j:......@7.>...&..B.T!..,)......T...CK..PX..H..c.n..Y|.....U#...$1.13...}p.../......y..c....S......u.o.t.6..D....@)........B.....Vm7..>..B.M.....'..7..\.f..A..P.~4...DM...|....*.{...<...)?(.rhj....Qe.....Z5......1...}.......,E.Y.. ........Wt..U..Q......a.O.z&-.5....p..[.Uy.=..y}iw./.<N.3gw..........u.?....mH.....`..K.N......+.....G.....Y...F..?h$zH..cb"x..F.Tw...$.M6!....E6..z<..?..8.i.....XxJC..Zvk*..'f.>=K(F.,t......D..HNd.geP..c.i.T......=.^@.....P...i{..Y....D..$..x.4...D. ....nT.,c\.HZ..*_.;.46.1M

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite-wal.SQuo

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.166892343960695
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:Ppcnf66zevecq0mocFOnMmA6Y3Yih/D9QQotwSn:AGrptnioU5Q/twSn
                                                                                          MD5:80352CEA7FE717784BDBEE814B58C3C0
                                                                                          SHA1:4601D772E56119EE7D0A98680C884A0E613D47EA
                                                                                          SHA-256:224F5FFDCF159753951DAEBD0E5A12C2BB7534FB635F0089F5FA1815D750BFCA
                                                                                          SHA-512:12C8E887B1F2C1FA10707A4C89D36BFAA8BC70D85DFF0273FCC16FE72FDEA0F2C92D6D402771A233353E8CD7B6976BAA875CFD42DDD1A65B1F70F9ED4988AE7C
                                                                                          Malicious:true
                                                                                          Preview:.[.zbl.6}.k..$.................}u....Y..zL.........GF=..u <..\..........4.M.....32m.PRv..s..M.?.v..RB....V.c.O...1....{...?w..3......}.uT..B,..)c.....".W...K.......=...[).r.......,.M.(.55.g..6tm........([sS..$..2.1,8..u.0jO....[..Z.........Nm..a...x......jA.8E.0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\handlers.json

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):646
                                                                                          Entropy (8bit):7.677146704312571
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:otp3V4hnu+YqDSo/h4tghiBY5IJwBAu8Ue777V5wNcnfR/OhNKyn:oxiu++iKDBYiJvvBRu6EKy
                                                                                          MD5:5DD7BD2F5E798D3F26080985A2BF29F2
                                                                                          SHA1:EE14F9628596A9C04053ECAB1F3E2B3C2928980B
                                                                                          SHA-256:F950FE9D5B4FDFF2363F5DEBC8A9F970697A95034652941F2F86F39044DEB739
                                                                                          SHA-512:5200986DA2484E2FDD083F3BB31822F4D048E727AC1F35FF46EC32408194CCED94652C1C12DF2E4F3A738032F858B84163616EEFA11F066D67D1E931D25F4000
                                                                                          Malicious:true
                                                                                          Preview:Z~'W..U.`b=.......nf.Y.*.. ..8.......C...|..y.]?.0...o......y.e.La>D..'n.D..u\........#U.*L.T...-@.l.h..+...*.#Y.f..m..7B......-~+...Y.d|p....g2......./~...K..w....g......,p...|....m.....VA.j..sR.{...j........b..Xt.5F..;4@...Z-.7o..s..4...j.....4.3:.U......[...(. .!.A..y.<0...g...B.K..P....x9<-...G..+j.}.G..B...O.@......u.)...+8z.]._.7_...;.x..~..Fated":false}..$G..C.....(.-7rr)$=..SE..0.m...,.,.`!9.......HBJmO....<g.i..@.+.....9.6.....C....6.8..4#....*....O.-....8.uOw..Y9../.T.H.c.8..,%..x..}o..,..M.C..p/......X^E....../!.5....o.>...A!..M..D.....{.(>;`....r...f..e..)[o.Bw8.n.5o.K."f.r(K\t..L?..../0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):295178
                                                                                          Entropy (8bit):0.30018052104248
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:8iDyxn/cPgXxPp+Bmg52jVaBva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23vI19:Hq0iPp+ogP1zkVmvQhyn+Zoz67H
                                                                                          MD5:F42344436FD1A0B65224DB689FCE7A51
                                                                                          SHA1:6DC2CB15D20041994F7FE7211DFC4BD29CFE33AB
                                                                                          SHA-256:B2ED75A7236DE621465ED67E4301B7E5D593A963D7151F461F38B22498BC08B2
                                                                                          SHA-512:9F5AB0DA94BF5FC211E5D24EB06311E29FEA43AF9E63E4D8878483F8695530A7B994CB3077F34C4477F7C94F466D1C09BD9306041347B07BB26CE22C5538B052
                                                                                          Malicious:true
                                                                                          Preview:......?I....u.........".R..".......W|...x....r@........[...m.;y..i..X..I....?.T>.......:P.b@....<W..y....c.....CtC.V.. ...7.y.[....=8.I`iu.3.1....>{).M.%+..l.p.._.*+X*WHK6......M....P......9|.T/..... ...+.C.y.eX.!.m..<...}.e..Z6oD....9.@.g..._..YV.8q...H.......`..7.......@..0.<....Bi..L`...bf.;._J...b..U..>..K$.N..7I.._.g.,U...Qz).-'n;.......e.......L.r.4.IB.....4.{.>.G...c.'.Q-\p.4.......-.4.w..6I)..q.M.......yE-.%.S..........-{|..D.2...FDb.m...K.8..-....B`T;.`=....4..&......$.0_......M.m.....]...{..p ..m+.........X[..gd.....As.K.f.J.8..WA.m%~..:........l....w...S..E...!.:C ..Y./^..`.....]9O.V...q{.`V.ux<N7.....H......I......\...X..>..k.Zk0.O.y..XRQ..83..F_...Q.'...?o.>o3.q|8..6....c.g....Z.!. ...c......"Q.v.X..2.w.'s..`..>...;..3..3/N...XrH.J1M=.>....v...{..f.0............G=2...F.....m..F.R.... '.$/.Q.J...S......~.^...A..T.=]..>0..SgP...D..k...T.Pz.............{....x..G..$..\..U.~...)..J.B..:..w+y..d0.%.....-.Ia..S.|....{Yr...G.>...)..[

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\minidumps\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\parent.lock.DfJx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.228155873990252
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:DXItL5zpFutKtHeZPBHcZ3cLFkXx7RV/HFXsUyp9K/1u4iAr3dhgLjn:DQtpFutaeZPB8Z3ukB98R4zL2n
                                                                                          MD5:4B055A22AD6A25D8BE97957FC64CBD88
                                                                                          SHA1:D77E7A9EE38B5A41D1269C684787E21EA3C06A73
                                                                                          SHA-256:09079D230E8563CF097B89F3CC1EA735D9C6DC5660530C44094F770D1E2746A3
                                                                                          SHA-512:7D6B1A100C56E5A93F392A8B74E0ECEDCEE687DD6AD043B0D3EDBB09A5EBA3F6E3CC42CDA146767744CD82F4F9F3945D4172F59CC9247F3B46111E7EEDB7CA8A
                                                                                          Malicious:true
                                                                                          Preview:.Qm.2G.c......n...........?...F.c.....)h.U...}!...6........_a.N.e..}...F..~....EDt>H.B....y..`.....=.S.".......e.<".G....J4v.....~..&zj.5I9..j....;X.p^W...iF?.Z...9...-8D...[.(..l.-..x2.r1.6=..B`...<I.hoXa=4.....=Zk-L. V.Y5,..D............E.......`..6.(.bbP.C...F..}..0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\permissions.sqlite

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):98570
                                                                                          Entropy (8bit):0.6580379369771284
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:SEKRHel7PATKvpysA6RoNWlC8x4DqDlGO7039ujYBjTZVK:EUlLYsA9Wn4az/W7K
                                                                                          MD5:807BCE9F9B6192A109AA5280D11F7C4E
                                                                                          SHA1:BB7A8A1182FA0E42FF7DD36F04935A531CAAC3CD
                                                                                          SHA-256:9A30CE438142FAF6401C02A7C56251B6F118A1E0C51BA31D2FE94A71889D4EF8
                                                                                          SHA-512:38044F26B1497737B517F0FFD0B67C4815449BB7A304AFBA9B121629BBFF41AF045BFDACBE88EC16EF439E9DD4C1C9460A5C7490FDA4EFDEEEE126E8E59F23CB
                                                                                          Malicious:true
                                                                                          Preview:W.Qv...h.e&yg....54.!...P..{...@.I.v.]...'+h...$.o1..@.K...#....l..X.......%0...H..=.lP9j..#.F....6..6Q|W..4.|.'.....w......^.6..b|...4....I.....T..K..8"}...(n.vV~.m...-.._=|........_....J.A.wyV..]$..e....l;...,..U...Hm.q.R..?..q.z)'A..G(~..j_..@...1.x....O..=C..*H..4.r|`..O.w..... .......9..J.. ...MP].B?..h.]D...P..^..rL...Y....wR.".F..,.$..Lf..}a..')..... .`..........g-(.F.z.4}..<4....)...+G.>4...@+xYbYP.o.....h...O...... ..(..i....u_.Vxv{...ZV......!...._j.6..0.`...7..C.1K,...v...!.7[y.....)...Mo...01..$7...+.6....=.n.7QX/.S../.<.....O.v.@y1....b.!...V...q9..do.........z.$.E...M.>n.,1.....G.gh.9...l.....7.R..d#........i){dN...[z(Y....{.%...*....9q.HR)..m.'..F...K...U.{......&1&"...`.(..0...&..VF.f%...ST..]...V..Gi.I.f.W......f...F..e..*...u.n#R.....J.}.....4...`..0G'%..rl.@).P.%.b||...o...."B(....wZ.%.1$P.x.|.......[.K.... ....B"...c..F....).`.pS,.,...L.....y....f......_...QZ...T#.P...e......VQe.Pb.4......&...m..Y.......3.=.pD.

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\pkcs11.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:PGP Secret Sub-key -
                                                                                          Category:dropped
                                                                                          Size (bytes):783
                                                                                          Entropy (8bit):7.747770776165886
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:w11QdqenhQ3XG4n9znMoopc7FwPkLwj0Ig4BO92gWQ/s:CQEehQ59znMoopwGkMj04B5FQ/s
                                                                                          MD5:C385299C643E4F30EEB5F6C1CC9321E0
                                                                                          SHA1:A3F2EB8EE787F0288C38A7E22AF3B0EB03C2BC6F
                                                                                          SHA-256:FD5C1912F6B7A865B5B01C6E5502D3FA4021FD6C17DB63E4E890999278179B81
                                                                                          SHA-512:E4BCF4467D3D6FA1D277A108A4FC429B72FAEAF68996ADC3C7FF45424083A79798FF2F01519BE4CE53D362BB473988DFAA53BFB97B8992380DAF6E6FA68DDC3F
                                                                                          Malicious:true
                                                                                          Preview:..2..%.W....:F..}j...Je..H.J..8....T.n..'.=<..S.9.m.S.....z.x........}...-..B..e..@H.l._tB/..&........V.Nm..sL.r..&.'..A....P.h..Mnx.....LKL.k.._...&...d.....A...[......:.q2.N...=.....,hv{A....>.......z....N..<......;.O.l..&.O.N1...W.o[....?.m...hM..N......).u.....K.@eg_.R....7X.7..W......}N..' .:.... ..A.4!...=l..G.......WF...|9.4|1...M....i.^.W/.{..R......d..r....;.)..*..a...7.hQ.+2J.....b.P....Y.QF..$..H...nw.W......Z.z..r..O...u..'V..6].......3s...!l.p...j{r..G....p94.?0.)......k..q...Tq.......=.c;.....:O.D....V.gL`......}<.7]v.~.2.a..e.1..J$.)..@..\..t....}..l.B.|._."."......J9..\.....,~..k...ED1$.B.L..3M.:...d.Z..8..!..Et...;.Wh....jE...(Jh..j$.g...]H5}.`.^..v.>....Y..2K.6...]...a{.).d......^.2R"W.....-..a..O..K3..).V...0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):5243146
                                                                                          Entropy (8bit):0.05241424789202152
                                                                                          Encrypted:false
                                                                                          SSDEEP:384:RzJfXbZXZRzr54w0VW3xWZWdOBQFal3dQj:RzJf5ZlqVW3osUdC
                                                                                          MD5:3589620D60133C10464EECAF999070F2
                                                                                          SHA1:5AA0EBE19FDB501D0A50ECAED56C0C140829E941
                                                                                          SHA-256:018D730594D19CB597DA65810FABBD3A792FFBBACAEA604AD9A3DD10BA4971F9
                                                                                          SHA-512:3C63FBC9B9123DD45DCE9E1EDD0C9E63E42F89620CCF47678147D4311699FF3B979AF7E4720E2595639A8FDCA18A77DC7BD31669C10414010E70AE4025763A14
                                                                                          Malicious:true
                                                                                          Preview:...oA........].7G=~.Y..\P.....c.0.NO...am..o...2.....W:...|.nF.c..uQ...n.>O./{..m.Ti..]..q-.......T..S..&...E>.?.........QVO(..6J@.....e.J..!..o`....*...h......^...j..U...<......m...Fk\?...Bx...0p.....7.......:.C..>...f.....N.V,.5.o.X].3.y.-.../.0..."IE..g......e...................].p.#uM....#...B.x..'.....;........Nc!......1..5.~.".yi.O.1-?QL.<'.g.rr...cZM....5..w...W..A"....ew n..{ .d.....&0..f..\HB......G.A.t}..%..t.3.=8..... ].w"B}...\B-.+0&.xV.317.VPV.!....n....s@.4TM.`..O{...Y.....N.B.o.[...%....P...D.O...}.."k.mz.2../6.5.&.p.,..N.9g"VO.3...^^`>.{4*..z..G..-..X].S.%..O...ga.*=.........<.."].)J.g6..?..Z..V~..../...`.....d..{..[..VJ.e..a.M.c.....]yRih.j....>Zl..!.O..N.%.BK.o<..?0.3...N&...).sm..;....L..5..4.my.E{.v|....Y...b.6O..GG.!j.&.}.K....OX.b..p..D............;sH...-...f...._.OT.%q:.z...rB.\.W33..0..g.....Jj....4..g$.G..R._...w.)'..:..(.%v*.....(p..E........<.......r...v..........m"a...:ic......AA.?.......I...D."...m..py.>

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Public Key
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.607635551582054
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:QdmUj4UVmaJ7qttnMCiBHf+0dpwJCjiqrtTFtrH:Qdm64UsaJWMCp0doWxt5trH
                                                                                          MD5:74FAE2DF81AEA83EE433EAD294635BCA
                                                                                          SHA1:7E4245B582B65DC73CDF6D6B4EABF1A62D328FFA
                                                                                          SHA-256:157DF2F893A76D16D2C3FB8244A023C6B4BFA29EE9D463AFC580A83399F2086B
                                                                                          SHA-512:7ACCECEBB0E3CA641C6EACE9D6D4496286B223D3FBA29A62AA734F14F3FD429BD2132FD51E0D3A04A6C6BFBB75077BB35EEAB2FBFD9D53B05EC33ADB7BF32A42
                                                                                          Malicious:true
                                                                                          Preview:..s.T..C.O..67n...H..a8.~3.....h....F?..V..).5|.1......!.XYe.(|.7)..h.s..#.....w..@.."....tL..g5Wp.....3"...W..O #.[.Ip..6o?.Z...z.........p_ h.O.*..p.s...;.s.u."....C~Aw%.^.....@.......>.....s.D}.g}..M..|7y;.....+....+._.h.y.....,...........P$.....`.`...........&.....p.UG..........)......a.I.p.....) .........6%..9G.....y2_.W.l.....}M-.j...'..........3.[....../...y.@'.UhQ7....7/......`}+i&..lMR....(.V........W..z........ofl.jf..MJe_.M..g.xn........Ee.....9.<...q..V.$.f}..\.3.....=%..l.DD...W..c....V.G.9.b.ER....NW ".O?..VH...;'..R.J..0g.6G...Llx.>s2....j...D.D.. ...."..l...].....Y-!L..{.(..u|c.W.ln....0.g(|U..W..^\../.....P...5HG.u......4..c.=`.T...M...R.#.=E..A|..:'..p'.K..Jy.d.............w....B@\M....Ge.N..m..q..."CQg..I.I..p...|.FGI8...]x.+..p.<..u.o.6v..m,9.k...c......zB..Z|..#a~jI.....|..E..=....WK....._....6D.y...*` q..?...V..g.$............Ts.V.;.&..t!v.[..C.....-j..97.7|..}i..)I...dt...SZ..x../....c..b)r..;W`M...-..(....

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal.OBYh

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.185881073098248
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:+oF/jV0ttBzjeFSDFRndvoB1TNjSQWntTJziCPkNrmxyXTPFqRSn:+6bEXegFwnEQWDzii8mxiP0Qn
                                                                                          MD5:DA162E8BDA9721ADED90A27C3DE832D6
                                                                                          SHA1:8E9AD242CB2CAE46ABC29DB288EFA4B3D2CDF046
                                                                                          SHA-256:0C9944C1E761883CCF50025C31EA7385CC3A8FF2AE01C61F633CB76612AE3ED8
                                                                                          SHA-512:F16FD65657409189A8C5E3C14D5069EB054107B31D639E66CB59DC2307A5FF47726E7CC8BE92BEB85848D152AEF36B32FF30571B740A400D99B66D920ACF5843
                                                                                          Malicious:true
                                                                                          Preview:.y.0CQ.h/..P. ..........T.......r..t.....%.e..[.3..K......tE...........;{{].R..3==.n@B.}..m.....&,}..8..G..D._........w..h...u+..f..2\....O...9jL...j.v.......7./O..s........,...u..ND...y..7uR.#G..."m0.B.>.v.#.IUj....:.k....~\..W1...e..C...+.../>.@$X..L.L...q..X..._.0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):9837
                                                                                          Entropy (8bit):7.167279232365294
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:NsUldBMIEuFKhIEkpHuRxBmycuF1qSoyaaX86KKkfGNBw8DJSlHq:NsUAfhIEsiBQuFkDumcwQ0Hq
                                                                                          MD5:4769854EA77F6517B73956A483C6D933
                                                                                          SHA1:D107656C513D8EF34C261638729A758E9A7A2571
                                                                                          SHA-256:732B236F917D4B5D7CD664B7EF85D433AF28EED43CA314C33842351BEC92EA05
                                                                                          SHA-512:3E3E25144F6C6BC4848D3C6B8BC9D3D967E2B6AB896938227B55D9611CF37AD6F5F98D53856BAE4D3F100E1DAA651C48F7F425053C940DCFA8679C4F18EE9943
                                                                                          Malicious:true
                                                                                          Preview:-...fC.e.X5O.#].%.b.......%./..<...6`au..<.-!..;..dG.?.7@w.t.0.!.....=..S...V.{......]pp.?.1...;..s]....r.p.+.....B.........sg.......'....;y.../..~...s..%.0.Z........h.N.MO\...q............{^..OO..o...9.]j.j,$.$k....3.._...G..K..^..Xg2..!l...r...5...a/.?..T}/...!....|P..ZL....vY...`.<Wh...s..?..}.6.}...M.......`...6f.2..5..lj.z.2.*LpR).a. ..P. .}89n8...j3.V..-.K...R....`....D...7.E...f6....&.........ba.C.d.%....<g.[/..Ai.az.Y.g.O...(..O.h.78..wO.&`...5..5...7r....i.k...9..`-..V.>m...\5.....?.N...J....@&...y...D............H....X.....k.(.^b..>..=..w.Z..Z.cE....[v .ze..>.W....D..$..N.:..+..F......_.*.~bsz.&r.V.........-S|.C.c.K.F./.$....U.u!. 6..0.>.....S.u....H.g....CX:t..O..S^..t....#......8.EH.U...4.'....j..7.]...+...7j.F..[W.`.z...h?..|..1:..>.Or#...}5..c.Q.*..._..8.)....8W..J.w..j../.?..A........9.F3ok.N..S_.E....,r..m...p#.....9..!@..H.`x.B.5...&.Nw..._._r..<*./%.?u`...=..i5../.....";E...Q....G.L5.....yu.9...1.\?c6.E.`>...-.Qh.?Y.

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\protections.sqlite

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):65802
                                                                                          Entropy (8bit):0.8991905049722114
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:TBSupCvUF5q2fbf2vo0z91b7xrQdFfu9ma3pgibc+:TQ6HqAbfQn3efSmah
                                                                                          MD5:84AFB889AEFB0B7999776F6A0970DEA8
                                                                                          SHA1:8421949580AED672B8769928333C6978446AE1AF
                                                                                          SHA-256:BB7E132EAFF5A05B6C9BB382DF1D365BF9C698E28CBD27C981EA3493A908A69A
                                                                                          SHA-512:19FDDDA7047ABFC3825E0A5FE3885AA0E48DD9AD99E13AF1BFE119CBDE453D04B7593AE3A602CCDD789F92A9AF435D8A1902D6D343BC906E9E46ECCB25AEFE40
                                                                                          Malicious:false
                                                                                          Preview:ou/..ZQ..+..Z!?=.[....../}...I>..Q..*.m))p}z1..]......T.x...6l...o.I9..S.>........n..5$n...-.c.gb.6.G....@..V....K..Ws..'/_......u..42.l.Z........p.../..5a<m5t@,u/?..?.D....Y..f.....+....@.tb.j.j..@.|5>;SF....1O..bQ......y.t..........[....s....0......5&.!.f..k#...1.;..i.SDF...}.....K...I.2_...B_..o8.... ....3a..}.$...e.^.Y-..]2cX...W...K.p......&`*...d)....X......C#...h.<.=.".n......U.......G......Xk..m.v.....t.u.f;.X...lW._x..f.....q..{.H.#.].6g..oP.jR....,..s....f....a*<....G.......HH.E.Ol..nQK....:../....yC.......*....|RQ.y`V....+S....k:%L<'.3c....W*E.1...U.A...+.I..p.w...z3~..\.r.w.s...\L.57...h.=-*..l...da.).2h..b..JGn...uN..........z..&T.j.".\......x..`WL....V..P&.....u2.......$),...pHX2.D.X...x.u....5..f..j......|U...!..l.u..B.5..@....|....;..c..qj.y.9.X.....z..j5Q.G.s.L..=..]#.......f...5..^y..0..,T...|...:0...."2..j.u.f....5QV....>.......a#!;,@>....=......@..v....I;./....".R...yH..U7...^..e...0....6..g.....K....t^`F...b.....

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\45e26519-596d-41a5-b290-e547b44111fd

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):758
                                                                                          Entropy (8bit):7.758662670794124
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:jsIf8oZBiIgXsSWZIVpPtdJT4M0o5Y8ziAGeuc/Eja6QhXDqA6TaOyka+7JMNk/q:jF8oZo2l2VJ6MEAif/gMg43FLaq7/QBl
                                                                                          MD5:255D0F4FE8FC0FA7F4CC491D692818F5
                                                                                          SHA1:68E5023C968BB01A3BCEC353B1B6E10C0B66DD9C
                                                                                          SHA-256:CC6DBBE1130EF5039E5C43F0DE7065C5CC02D39F88E73E833AD3CCC2B971BE3B
                                                                                          SHA-512:5918CA11DBF7B7DD78B044E27D0CC0BBDFEB002FE328CE2A1DD8A02866FD6F8816D90D061D3A5A636369226822C3E7D6D4E656CAC5F1A00380A7C027C31071E2
                                                                                          Malicious:true
                                                                                          Preview:..M-....@......K..x.......h.........._np....a......p)j..y....J..(........C1.......&$..0.B.....@2...Z).ta73@.).a.,.. JJ.czl.........U.n[..Si....8.......T'.^..(9S..J:~..4._w...R...A|./.D_.]$"....!Wr|..M..=..sn...o_....m.a.3".#..q...}e>.....L.......g..]..<-.m....%.n.......7...hV./85.]t..b!...2.D.`...(.\..@.=......JbO....K..o.<......<.?...<r._@.m.7.O...^.^.;.#S..s7...).].M<..g.1.......HL........lUU.9Z..V...,IC..p.zs.u...|....=;.../....9.~*==..x.^.jKx.h......<.34350de32c"}..f....$...~....'{....../S...".~....-.(%..!..Y......EW,b..t...>o.........6W.8..k...KS.y..A-..?*ui.B...X..f...1.%=. D.ef.g..P....\.".>q|xC...e'..8.,=M..?.......'.Y^C..x_..t.i..J...dIb.B%..../X.1<0f"......<....8...lPU.5.>o....3.f>nF....r...=.k"0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\6fc53411-ad83-4cf6-a5f6-905f0f3f52e8

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):758
                                                                                          Entropy (8bit):7.659275204885763
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:mBAriU1sR1f/yCd88F5UqpJTUf1RyWg1cEeNlcIqVDUEQRSNEA0BfVJWNedID6sJ:lYRpFhXYfHyu//cIiUE3KA0Vye657Gqb
                                                                                          MD5:814526B5A09C473011555FB10385AA24
                                                                                          SHA1:5731C47C0D977F202D958567176EB966F8528FFF
                                                                                          SHA-256:CDFCE3B523725AD46A0D57D8085C692AEDBA971426FED2F39B5F9479786A5126
                                                                                          SHA-512:344EB16CC81708ADD39A7BA8E24211169756D7FB49B089F48624E715155D2493C56D41189E7AA9AF9389A89260C940959F3BAB84FF25CC9E67CC453079059C7D
                                                                                          Malicious:true
                                                                                          Preview:u."A........I.\.M.2.0.^wB.t'\BAc.....^..,....e)g.x..2-..{;e....e\.{.j.....x..<......e....`......G...C...^...m....E.'....;.C.i.w..+..S.%..j.<PmM...3.....O..).Z.J(.e..pA.....f_..e..l..3..X..h.A..#..!].J....._A....h.|...D...>xD.Z.I'V.....FSy..l./k.ZV..".1....|<_.}......5....%...r.Z...@.)!.......).~On...*b[G..;...0.!.......:.U.........c.g(I...v.|.!.........6..'..@....l.Ecv.......|...G..SS.F/._...S....R.K.6..."....\].XP!....<G..GW\.t..iZ.....*,W.@.`}<34350de32c"}.ae...I...{""._.. .........r....n.%JI.O..h~.........z...y.$...*...Zv+.0=.`...^..VY....U..;.l....m..R..N_.?.".UT....'X.}c.g.Yd,R.f.G(...r.e....>d...bIt`..c..x...c...o.W.}.........T...".b.-.lJ.....-./...?zs..~?*....?..f*E@.c...Z...;...J..t!.....Y0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\7278f154-e8f4-4235-84c5-c5c1c6af0084

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:DOS executable (COM, 0x8C-variant)
                                                                                          Category:dropped
                                                                                          Size (bytes):74436
                                                                                          Entropy (8bit):5.6101737050633735
                                                                                          Encrypted:false
                                                                                          SSDEEP:768:zZ07mMQBEL2drnJq4WJIai8UwKs+VFzFNoXzFS5Y0l:2zre3GEwKlVFzFNoXzFS5J
                                                                                          MD5:5D32F4613AEEF679F5F419419C82F091
                                                                                          SHA1:9EAE1CFF8F32078F1216CE9DF687BD4CB4440739
                                                                                          SHA-256:01BCD08B58936F893034DF87D8A3C210A67120C7F24455493EFAADD8762B386D
                                                                                          SHA-512:7A5E9E65952C42FA5A6C1FCCCA6174957ADC05D7E009CBCD8217C4C27729E4A52A9D65B6F3DF0A0B75F6D863484D010C057D2F0ECC2EFB52FAA4DDCE100B0E62
                                                                                          Malicious:false
                                                                                          Preview:.2.{.......}w...n.t..o."k3~..p#..9#.y..eg;5b.&...){..B.....JK...!.S.t?..2no;'".....-.....O.{E(e..w....Cd...BL../.N.n.S\....Gy../.Z..U...m....Vaz.+..V).d~8....3~..e.Q.._.5.s ...O6|o..L.n$.!.2.R.0.1(~.AvMl.d..Z!5.3.M..2e..H......Z...o....'..v.Z..p..C.{O........|y|-.....2....dg9.y..j.Q..9...._'..V..O..Q+..'..4cG#..A.......%.{...kt.H.3.t`.......)...........a....Q..#.&..@......2.F"..Mv.B\."...>...;...^...wf..=.t.....{.O-.U....|..4...I.......I...~IR s..b..A..y...4........+w.Q/6g\.{uR^...6...:T.Wt7Z..}...^.....}..p.b..%..O...,"..<....,.<.`.O.pt.7.......IW.8.Q.....~4~.)..J...w`..,....S.v...@..u.$......]..i..m..eH.xsT$u....E.U_.Q `$..1.J.V..p.eY.=.*..x]$.O..<(>.Um.J..e...*...x.'.1......D..b....V..!..i.Lo.K...#./&i!x......&jl..._.V$..s...{..r.0Y.....i.1v9.s4...:..g7..7f.|SS.x.{.f$.Q.2{..\.~.]."L !.........A@..%...:......q......C~'s6C..P....L6O..:..O..0.Rc.&...z.1.h.....x?.oJ..2J...2c....T..S.+.@..*..x.f"..Mf..f.mt.........O.AE..3...Fk.....4s

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\saved-telemetry-pings\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\search.json.mozlz4

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):615
                                                                                          Entropy (8bit):7.6385367737610315
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:KW9QQo1ehoJqmv/0zqTZzprlL3cM9JzHG63w3s0QuOrvBneV2D/uT/iDGzP+Hn:KW9QzIh+qmv/0zknlTFG6g3s0O9bD/Ay
                                                                                          MD5:FA45F4B129CF86A4CB4E53621882EA39
                                                                                          SHA1:C77A031DDB1A82505A42D548B1F0D8FF8235D312
                                                                                          SHA-256:176F4B73C8F6BC95CD70CDAE61B20BDB30684254EE6091F4755148E479D9601E
                                                                                          SHA-512:2CDBA7651F4328811A32A704E48460A7A162AEB6614DE21E53B5AE0F3AF1264B79B3152E13A98304CDEA8A8B7692C4F21BCBAA849606FF146CA0729BD299627D
                                                                                          Malicious:true
                                                                                          Preview:.....1...l.cNhe..f.<'cW.._l"... ...........|.....x_.z.\<...b.+..v.(1U...l&x".X2....^......4b.d....-...[....Q.B".GFK.;..N.p...a.*/.l... L.F.2......xc..!.o..Rg.R...c...R.....,T].Uc./h.w..q...[C.J.,...HSI.....1t...m.{.D.s.....^.%......*.^i.X......4.m^........UU'..38*.C.p.^.w.P.....]U...6us*.(".E.......l.l-.Y._rd....:.q......Iz..Plt"}}l..2..3g(.WaQC...E.W,....5Q..}Mr)09Z.....B.`...f[...x.5&.....-......;.V....$Z..Tusu.8....@E....D...yR..o...w.m...~|.W..mEu........`EK.............&.2..9.j... ..C.Lm..`~.......9zM....+.!m......v..V 7s.Zq...V..N.O.<<T.5..'.Y....2.^.D....x.Q....?ld0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\security_state\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):554
                                                                                          Entropy (8bit):7.58267447445682
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:EZEGaK8/MONzpusxMynrPata6WvUYgsLz9fPXRHz2n:Ezj80ONzHWHBejxv9fP8
                                                                                          MD5:3FF7284C7E7EC64F05C5CD23FA0DC010
                                                                                          SHA1:FF82DD2D639006069748FB3087742CD950404A95
                                                                                          SHA-256:01E8F92799573CDA0692C4A263D15D4B1A6A45131D4E78F6C36C1B2EB4E78BE5
                                                                                          SHA-512:AE2EAB01C837E2858CD4492DB11A64B96319F15DC7564C8432AA4E35D8FC43DC31A070C694E65A079C39DED9556DD31C304E297A6DEB494371CB05084AA4D6FF
                                                                                          Malicious:false
                                                                                          Preview:Yn3.....mC..57KY...T+d....O>..........g.r)....9vu..d...<Q<.j...O...'..Do...m.r#5A..5.6..Z..@ni.hy..7(...q..*...3...qD..eqaf....u...K..]..1m...;n.8G....I..8.hz.......>....w..16.*q`.%....$AxI.V...*#.](.7q;.:....Q.o:.Kx......d.N..V.'s...%.^..j.m4...k^..A...y.'..=re-change":true}T...".*.m&....x.(..^H...3.\......\?"N.cU.s..;jq.=].c.v/..i..9....^Q....,.U8a.a.^.....9.x..{......2.|.3#...@.../.7d..r....|.g.-.....91..z.;..R.g.."..N.*Q%..4...N....N......u1....J.GcJD....f....F....z.1.e.....?.tU.....F......jy...&.o.0St:;.......s0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1482
                                                                                          Entropy (8bit):7.87004799249267
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:gGPiI4hzTkWqrRW80c7elK+gdSs0LvP16I0P1vr5wkh704u7rAkdllQRCQUH:gGPiIBRWkelNgdGP16f+kV04kAKcRiH
                                                                                          MD5:A147C583835B52E55C3DD6C2E990997F
                                                                                          SHA1:FE326A130DF113A3B5C72C40471DD2376464554C
                                                                                          SHA-256:209B663072B12489B281935AF1ACE04EAB7AECC8F33B4FFE18D46D303279428F
                                                                                          SHA-512:6E07B0DDE9E1C112B67112E51CC3BF058A16234FD43105F133FA4566D3D190F6D7BE5A0BA97806F3A7BC992BF1921242857FD89F3B869AD39B8BE0DF2CC676AA
                                                                                          Malicious:true
                                                                                          Preview:9T.\.Y...^-.....o^..../..Ii.....&..>U.g*N..g_.t.c...q..kM&[.....aA._.a...4./|.D6........wN?..{.T......y....X.z...._...BR.B....[.<.^dU..........ME.T..f.3}..-...2Ml.'....'..Vb.T.'1.#..=,i...<..4..Q...Q..~......:..n.pW...Ob.v./....=.X.-Bd$.p..?..z.YC/2c.@..".R.lQ....!tg.V03.^B...[.aWbv1.......1.:c@..g.I`.........U. w..l../.c.)q....w..,..A.1.8oZ.&.)4.}=...VY...9.....u/A..!|Lh.b/.Ue...1....H.....p....../...y.....B...'=...?..@..n.F.,..b.^-...-6.....#\....Q.Jj..9....X.f-{.o.h.... .m...._L..(...M3.=.c........xp...."...c..m.6._..0...8.=".\.F..i.$..0.l._.........V.xkQ..P..K....{8&1 7.[.\.,.....4......C./...c....-.?p*bH.......'g..?_F.Mu._..~.fz.m...N.54....r...5.R.............{.......6....$......O..Pf..l._..|..[....`Y...2V....]."E.D....i..s.i....9.1.)(Z5w...M..To.rA.]O.\.....w3..7...*6....+.....f...].......6.B....qhg,..D..,..c....U..Og......y_...#W{5\..>O..>'....\....q]!.2P..g.o.H.!.C...>..'..._..P.I6\......2....T...,r...]..;<.nl...7.J....%

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):4681
                                                                                          Entropy (8bit):7.947504457521908
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:tHAd1qwKvZqNXO6E0SXPoWyed+0mnI2UpIIbXBvzbFYSEwOQCsc6MwT:hbHkNXO6E0SXAWVdISqaRvzpiPlS
                                                                                          MD5:E82C15075E61EAEEF631D1AD452F90A2
                                                                                          SHA1:99062FEC2B4BC044A03D6D18E25B60824853093F
                                                                                          SHA-256:E41F8F393ABC5313CE163FD632A3F687A6D29786D08E8A4E43C796D6D729A752
                                                                                          SHA-512:9F7ED6F6560E6FF7A338AFE130D7B0E500A40CB1C9A4BCE4441B761D44C5C6A6EDA8812A0FC804F6F346469C982EB326A1F88816D91847E9F64C9781F0BEF0B9
                                                                                          Malicious:true
                                                                                          Preview:.l?.;.x.-q....:.-....Qy.h@M+C...j.i.V....0t.._Gb.<.....:..A...H..B.....j..3...qq.?_4..1.;.L.]...~.-yD-.m.4P.|..3...Yf....(.W..)..Rw...j.].......C...........]....o.{MfK.^(.P......{+.....<.M..2Aj.B...k.../...V".t......M.TV^.q9.R....{D.'wTb..}...x*D.aE.~....>."O.fXf2....3............U.I.......0J.S.......g~.d6.t...... .1.aQ5h.st...4.............=.?/..=..E..a...UO.&....#.".u{..i../-.'}.....t@...YgP.9s..+Y...`m..>B$G.N..]..$4..2\.....q:B.k..z..\.G...9.g=.[...%A4F.^|...?*&T-b}......(..%.t9...f.N{Et.Yy..^.P."..{.6.BU..;..K.h1..'Ce2r....%@.x..$b7fL..n74....3....g&N.).<R.e....L....2...~..@.sG. .....@.....i...}..JAC3.iS.b.)..n.0.!.k..D..m.#.W....}_Q...=:.xT=....?.<..30.&.3*u.;.;sym1V..I.^.B....o%Tv^.....g'E......D.,..T...`..+.G.zF..|...K-z.....9&}.....}$...n._.L.r............_....iH..A....h.Z...w.C...f|P...C...v7.......`..u........o.t...NZ.Fi.M.G..8.D*..].x_...Jn.!m.U.E...h.;z:...,@....m.O...S..-$..`9..(....L..........wvW..RY.`.Jc...[...

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore.jsonlz4

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1484
                                                                                          Entropy (8bit):7.865389087317041
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:JTbTvi3sFZ2WZSfkVmAU9emoBazt3Jzk01M8w2n74J31Iarxq9m:5TLBnVmA2N2Kt3dk01jw274J3149m
                                                                                          MD5:1B5D9D866ED890E893D2AC185ED81C08
                                                                                          SHA1:903D778F8CF7643266E0EC4B24298B698E155B3E
                                                                                          SHA-256:B813CA2429CBFF5BAD70FF4A2D3509A030431FB82C7CB443BB66D9C78B4082FD
                                                                                          SHA-512:A0BE1ED06DFCD69738D7E4C9F70BCDA6B61B087326EAF89DBBD97385CF691D103A677E5B9016FD2B204A8AC8199783690650654DAB8E7859F580C076EFD4990C
                                                                                          Malicious:true
                                                                                          Preview:...w.....Eb.@..z.....f...%..q....UiP5.W.....9.*.....[..t.TU..iJ.#._%m.,....4.*....%;......h.mrv9..!..D....j3...{..m>.(...'.c..%A..=#E..... ..jN....{.....'.9.......s2.3*D.M.W_nH...~.2.Z..H4.&.~.~.....*.,..!..........X....C.^..j].......,....U...Msv..m...,..4.%y.O..*r../...n......<....y[.R'.......2.........B{....|...0._B.%.gR..$...D.r).r..m...].....GC.b.gD.H...=...i..2K......mG.i..;9.P.w......wvH..N8.o'.........5L....Vr..[.......b....g..%Y7......M.~4.3'NW-.x.....[M.....F.[T=....C......i..... .y4.<.o>...qy.^,..A.......|@.[y.^......[}|.P..0.t>..bi....>.....K.e..W .>../...z..."..|..(.yU#.....hI...$ea#0yimf...D .....h..4.U._K....)NEl...>....GE.......H2D...vY..n.|^..R,.o..0#....B.R.G....8m,.........R......i.H.V.f.z.'..../..gIrp...zc.+..9.Cs..S!tR<...Z.+....W.I>.Xd.......<.$....Q....*h.iJ...X(.N0._8r.).N]RH.......'.td.=1le.3.Cj....x..5....../..PN...|....H.yqQ.Q.:..C....PtW.H.K.C..../.V..b.U?m8.C.5...|.|9..`:\........H....!.....l.9..`/.g.f%....G....

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\shield-preference-experiments.json

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):284
                                                                                          Entropy (8bit):7.247711677586645
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:8L1oDarNb7h3wtemPqprPBIqa7de1fMqkfD8Yl0f5n:XDULAIzrb1kfD8I0Bn
                                                                                          MD5:3BAD010FF97721A6479B9A4ED053A8E3
                                                                                          SHA1:3FBD4EC78492485E5147337912FCAA09CE8CA627
                                                                                          SHA-256:558BC2E7CF2DDB5A8F457732BF0334F9192CA8C3F1525BB20D6138974E8418F1
                                                                                          SHA-512:C3C4A9B411957866800013579D831269AF5EF8BBB118E6A19353678733162106D41E4F13578628501F1919BE00706544BD8588CA1EA495BF23FF2D5166ADC4AA
                                                                                          Malicious:false
                                                                                          Preview:..3u..{OQ.[.~Wt}}.qg&...[....r.B....m.....q.X.A..H....0..k.i....Y.... .Q.........^UEk.L.}_BY..(.S.H.l..K-C...L..7.....r.......MMR9........q.....*....?Z..Y.s{.5..+....g...0.c....Yl./.W..[...o....D...<....E....K..7F.d.b...s(@.:.._.......DX./......0....&..].9.0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage.sqlite

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):4362
                                                                                          Entropy (8bit):7.954641231084235
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:JCEu+U+mkZ2gMT7wZz43Jzn78WRJaorzT:JrmkUF/wC3x4WRJaorX
                                                                                          MD5:69D247EB582F33724C19B5B04DF915A4
                                                                                          SHA1:6D39093958EDB526AB28F65B0C7B77030F43C020
                                                                                          SHA-256:9754BF664822EBAA82CE958F958387F4FA36DE001593552B47B998A03A437DF4
                                                                                          SHA-512:E6494476918731F323685B8A78851C7FADD9BCDCBDF6BCF1543FE24CBF57A4D90D73C3C0653704AAA2910F89C6AD02B332D51B52C9DA82FEFF4DD7B9FC115D35
                                                                                          Malicious:true
                                                                                          Preview:..'x.je...l.|......I.....%.......o...S>2..g.>.Y.9@..[.......u..Q0.g)...*......I...M.\...'.y$a_...g(.q....9.N"A9..~..?.5..A....O..e/>l..qH.....G.D....r....qM...A........y.\.1Z......r.x...t.1.V.Y.TU.G.`.~r.......f.j..8l....7..1..7.^..l...uo.7,.g.S.......O..:~y.[..y....W2Q...;..e..h..........p...P'.)bKZ..../."..G...!ut....;c....o.....]...4Q.....E....<_..3......W.-o6.zC(nl.........,..I.C:VPu.=E...BD........(!....Zk.S.vz..6.]...b......X.,.'.Ql$.B.'.4..>.dM.P.:..Z&.[;.........h.Fp+....&.H.p...~..Yy..,S...:.......G.7...gK.%.5.?..2...(...D5.b.S.Y..3......yE..T>..t.+L.{....U...]+...)..]..~.8...^..6..v.Bp.Hp.^...O...d+l....dh7..]....K..p..cx.22 .q!~...N.R..4...2..m7..z.A.B..Q-../.....8...!.............8.bH.+.P.#.vJ.{.Ih..^"RvTE..q..!.K..ai'.2._....kXMI.....o.R.i6....(..E?.Q..Jc...e.<.y.dX....;t.....ez..BH=>...T.-.ek..y>l.<.u.~.?...Gi...\dm.c..A|.<y_..^PE..:..7.e....i&VTS}..M........Q.W..V.....%../.e.M....DlU.c..*W(...a.;.H.3w..L..nb.i..0....J

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\default\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):131338
                                                                                          Entropy (8bit):0.5078382965045062
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:R6NJ2G1sLGMlCONhxdLFR5tbddJYcgCavdM0LpPB304V8snNgaa:R6fhaaMlxhPXHbzJYPCalM0L1Ha
                                                                                          MD5:F097632E580C4B9163BF7E58D3958000
                                                                                          SHA1:71B64A5641408C14ADF11C358660A608B2A0711B
                                                                                          SHA-256:D551F513549B498FB4F98E481A70A2ACA7AA262BFD143CC9A41613339695647F
                                                                                          SHA-512:B8335CA404CDD7F6990A451527A3A512D338EE44AB89C5CAAA1F41FCD3BF113A973FB44954E734B65DA7EC1F88CDC985CA8D39F9CAB2A43988370385775C1279
                                                                                          Malicious:true
                                                                                          Preview:.v{?-2.:...#.:..sE.?...../}.&..S.h.P..IO.1C-.v.....T...'y>Od...J.|..J+.a..........-L..d..*.....f.T........=...w}..%...4C.+.9..........D.S..<......^.`..71..7.A.B.....w..../...`$..?O.C|C$.;&S!.D....o.xl..*..X...%......|_.z.D.[.w.C..X..F{.7..>8....U.-..........f.g.ao6.o.........^..`(*G..Z...L.h..-..3[.W.67..F....IO.KZy.......#9np%'....Q.....].0k....."O..h..R.e.....<.....{..U.Z.......+..W...........t..U....S../.........)...:...$...]z..K*S.~ ..A|....".n.!:..0.]U......?.^i...xWU..d........_...f".q.P..+.d.....frr..vf.L..UH.&.. .5..!........V[...OCG{[..rT...p*E1.ff&...v...]......F.../gK.zB...,w.$E/..@.s~.X>9....FO.....-&.0;..;.g..}.w..T....}.....{...?.........I.P...J.xs5."=j........?..W....[ .W..P....J.A`..x.]zaH6H2.....3hn.{C...EC4.<.Uk }.lj...).2[.*y...Fx..@......u..O1.BW..:.C4..o2.4..c...S.b...W...._...`..C..;A.~++A.*..}d.1Tb.F..CNW.tz...~p..z.......jI1..`-.]l#i..9.Wh.3...5*.h...n..~.....!..U1>u..3;K.5`.V....mAm.N*...+.......!..k...>..

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\.metadata-v2

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):302
                                                                                          Entropy (8bit):7.254593419750205
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:4Zn7n8qAlAAOULWfP7/21lidLxX/iJHnSvNVVI71BOmuQi+n:4ZAqAZW3z2vGNVVKXRuan
                                                                                          MD5:470A8A7B9DE9E718D51179060A82ACA4
                                                                                          SHA1:FD5E63359228FF1691D785DEF5F9DACD9AC0FF44
                                                                                          SHA-256:EE7F4A49E87DCC6456FA47A9638AFAB8D3BB32A479C7C8B7DA137A284328CE48
                                                                                          SHA-512:64E69C3C4EBD34DC00C868B6034DDC6BEC74CF51760F731C41CFA3879823F92D8E7A8B1E23BD1137BB4E1C2B4F94469839B8160416EE3A6A991C267F03FE7E4E
                                                                                          Malicious:true
                                                                                          Preview:."....qB(...,%...K.....f....0pome...w.....V~....K. )..#..=..\i.<c...L...m...oi..(s.Z..@..Z.L.......o.B.A.]~....#;....hc..uG.....H9.....(.',.-=!.bJ.1F...Hc; v.z.V...........!Fi.bs...6;E.xZ.bdte..........?O6..\.5?.kB........\....n...Jq"..E....~.....7K5....3.h9.......>..H9.q0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):49418
                                                                                          Entropy (8bit):1.1558058422774429
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:x+KlxFSq6ePIndEvhCl8kbL8S5UcrFsgMqu+6jDZUP+iwXem:XJZzClLL/r6jDicXem
                                                                                          MD5:FAD31A06B3C7BF7AF7B75E2F04B3F5B0
                                                                                          SHA1:1C3271B9096D13E773C16A374EA3A4314F58D1DD
                                                                                          SHA-256:DDA3E3764AB05929DDDF5F1F6E89384563181B614E5AA5848375C0D99038E759
                                                                                          SHA-512:99FA9062C54E82E6DA7D62193FB82F8BA6518DE2311471C3A9BB68D88E85A197234F74D127C455C26AE82E88B862116FA29C13CE8E0E3B5D674415B10A65C997
                                                                                          Malicious:true
                                                                                          Preview:....Y.*.Ph....~..s.F./.7...f..0>...h;....;.K.....R....,..n.0...q~...o..M..[..F?o.[E#..~.X.M...e5...RF.1D..L..(.D.?.....`..c.......L...m&.dH./....M.....E.I...7a..(7..i.A....I..^.&.=.....>..F..!M~..G....0...q..O........9pY.s.....[G.n-..W.gjo.V......).j.V.>.z.V.0.n...y.).;.b%.O....T7.HI.v,A..fo..M[F.9..r..w;.$4@....&....C.f.P.5....q..99).n.....+m...Xi.+&..w.K|-F,.t.f~r._.y...P.?A.E.......k.....D.$.m......;.....Z....A'D..].R.....*..T. 8.l..(.....B.W&...(...&Z.\....K.3.F.....;.}t...Fr..Y.c..%..J?..&.?.8.2* .y...4Q...>..I.4.....E/.."1.].k..W.L....P`Y(.P.^S...~M.d.;....b....}<\.....C.QJ..F.......!..."..@.f.I.h..D^.I...w......@..fk^`..b.>..B;.. 9...s}.v.[........e.i>z1S.lt.?.\......&.".R..+.H....tL........i.....b.9..A.....!.R..Rl.. ..R2.?...5k1.$.../.v..s.#y.B.....s..\d.........Rm!.'.].........W......~.....6.^....^=tgl..R o....Z.8....R'..rE@A.'...x..&ezD...6.W.U..>..o./J...H...-)...vuWy.09.........N.Wg...^....:.......2...."[0.. ..

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.6105299555770998
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:6crCczsyMOJyIELQV524qW2UsSNH/Ixy5/jtZvLrKLLJVtGID2h:6IpBMWOZiNQy5/jTyLdVah
                                                                                          MD5:1AD1630BEA57D42A919C7AFE097EBB3C
                                                                                          SHA1:F231B78E6BBCAB53D1B7A1968ABDD528863B8707
                                                                                          SHA-256:867D46535022CCBADCF960E18209E3EBB7F9DCE478FB2F32250B8FE3F9F8A9D8
                                                                                          SHA-512:859F4B7AF49FC2FA16BD27E09BBD9DE38E6BEEB1E9366470FD39B1EE1B4BD3D6EC546363B4F6A5908F52D7037358CF404C9751E1C7C084A67179A7C1B50E77CF
                                                                                          Malicious:false
                                                                                          Preview:.q...i.L..^..b`E..4..9.`Z.Y.....z....B:..L..........%.P.+.k..k4.^<...e......7..0;..Z......!...p....L....u.c.<w...}.bq.1.$..N./...=.>..Z,.!O...}.........#[..;{...a.^%....5.k...K.-.u.{.'Rj.A.vR.....-.lh.s..._.h....;..S6..9.....y.../.........v.wz.I.%...../v.M...4....[a_...Q...@..X..._..l. .Wv.e..m7.Z...k...X<.7.).....5.x*m..Y...-.&o....F.A..i...I..KvG.].p.+..^R.E.&...!%.3..._+g...H'.."...yck.D./.|S.t.>.-....,.;A.p....u$...uMK\....@.mo.b9...2V..z.....c..b....i.0.Q'. ..5-.m.?.......B.>o..ZGz.:..T..D._....N...x~q+...qJ..>.....$H8'..+.kI.F.=w2.{N......DCFX....%..",.wd...*..#...{.I...H...x.$?}fP...AU......:ch.+.Y..S..pD....G.;r}.....F..f.a`..7@..'NhB....k.ez....8..v.-u...+w.....J.H....(5.__Z.....T/..i}O.jt(.[..nM."gxg....3......Q..\ e9...Bk...#..z..6....L..R.g_....>/Hz.. `~o..<...L.<....lP}.wj...x w&.N&..`....wI..y........xS....c..JP....'_dF.....~.6..z@.(.\B.).a/.#d3..@U...{.....9Q..S.........A..&.......4..Y....^\W>.M.....t......].5...w..}

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-wal.utRF

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.133721947378612
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:ATVtlXNKPJZ/Q+Stn8MiufWbrTc6k/eQp0jgIUAaXjhRsRHn:cNQQ+SN8MiuEUvr2gh/XjUpn
                                                                                          MD5:61AB60C5C755A0A84E5132E4B0CA0FF2
                                                                                          SHA1:9C3CE3BC843846A96D44351CB7A7B3AF207573F5
                                                                                          SHA-256:01E92BA5B451EB717E32292EB215EF086E29CDEE28E7A0D5DC89ECB4F5B82C74
                                                                                          SHA-512:63FB4DC3EC66EFE24C048EF17155719D77AB7511CDDEB6ECF713FE887EA8DD87A5F2BF16542B85E4D99232AF9CB492BBFC6AACA98411C1E1C0F11B38F3FE2274
                                                                                          Malicious:true
                                                                                          Preview:[z.[..Q...................,jH[...h{.%...OKy.F,...W .n....lwuDz.w.....e[3HN..oa.*...X.....4..9.....4L*....|.....+.O;.t.!..j..........._...:...`%.o.9..a..C....YZi...#3.V.Za....D.....V.`...L..*...;C.H.XH...G.\......E.6;.G?F....rg.V<.].{1FzE.......,n..C..u.QX.\....}.v./.80xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):49418
                                                                                          Entropy (8bit):1.1780507547658536
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:ov17z/SX+3NN9sBmUp4+yPurL7GEhWMcP6u7Ctp3zKQaeyIlx:gXdN9/N+bjAvJE3DaeyIz
                                                                                          MD5:6CBA1F2FEED9911388372AB1B0995DF8
                                                                                          SHA1:E7B56DA89158CDDDF13937E6D29F7FD0F052D24F
                                                                                          SHA-256:9CA649CC5D9DA290B14A5888198C5218307D215BF1B651CC549457426C47BF9B
                                                                                          SHA-512:24FDFB7D25594B5364CC8231736CBE50AA083671904CD152282B5B3CF65EF07C80ADF399AB74B451F392D244F48F198594810795AE6D9B4993D073C7D94A666A
                                                                                          Malicious:true
                                                                                          Preview:.U.>.~..p......{.M+W.........ko....)..2...q.#.:.....)..).Nj[.......p.'....9[..E..M...g..].......y....6.h..?Q..<.Z.{.......I......C?..}.%c.F...;.+1........F......!.L.x..s{.IK|.].uA..m..=;.....|R.Q..9...C..T......83.C^...8.2|....A...^..I..b...B..g.....Y../......$U>.:.=.{..R..<P..)Z7 .,..6.<.R.....0@......,..\(.x...q.-Y?!......;*..n.4.fH4&f..r.--.>...jT........l.;....}.r J..9.......nq..+].>..........8...E.C.G.. 0.."x..XGY.\..-..J.....#>...I..m.Ls.C..Y..f. GY5.U....5...@w..(...w.............|E].";..Ie..e..L...(.`..y..Y...Z...}....B."...z../....6.On..H.qW!...C......4..s.Sx..\tc..|.gESG..b)1.....I.Rp4...7.l..{...#R.C..F..L...U@@A`.|1....r..,.<..+7PrQ9.{..........o,nh[h.k...O+..xr....&Rg.......1E1...9VY......t.J.*..xS.f...\7..&(A..X.@...._.%Vz.e..='"~.z..Pa.:f.Jp2<X..".C...e.b.e...`..jR...u..,.GgC.9..?.#....N...DD.F..BS8=..7..j...,6..`w.U..&.....E....WO.C..D.|L....!..IL>."..F4.~.X../..`9............g.p.;...Hx.....Rf8,n...?.:; P.S6..K.W...co....#..L

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.6073680045020615
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:WuChcKN0BTHcNgCX5T0UZfh3Wny5h5+tj4GGkCxhn3ZqviA:WurHcNg+TdhGnihk94GAv3ZsiA
                                                                                          MD5:A2F4F82345E09C5B0A194F77EC5A05FF
                                                                                          SHA1:FA402BF7A7981024BDAF38094B140B5E781EE67D
                                                                                          SHA-256:821B923C64DB0B62F8E6F1A003FDE52C2D2C94671A4FF441CC23B83789FFAEB2
                                                                                          SHA-512:972A2F8BA7FAD7DCB15DDF14A3A2C13196D6B74A0198B630DF50CD8BF2E7E4078BA30480160EAD5D23E898EBF8DA53FCAF4111FF88609962B203383A355E917A
                                                                                          Malicious:true
                                                                                          Preview:.$...u.....y.......{..6ef.3....0Sxf...+...x.......{LLwf.."C.\X...<...$L`...:...W...........E...Y...[8.....\wK...at........Y0.,.H.{..<eU_.XOr.@...SU7.'[....`w...Cl2.{;~..A....9Xu..>.!RC....w...hq..-0...*^.8..i|?.\.:..,..q..n.8.U..]M2..."@.Ftj0g9..5..vl..R.D....|.......=....~p..(.o.I.......@.lZ..A.)...}....h...).k...F....p0...4...Qh|..t.....>.e.e9w..it...{.A.F.%\..F.K6....j.#.L.....<.c5s(E.W.z(.j>..0 ....,D...*..m..n....b.t........1+Am.%@.`......?..Z.l.7F.Z.&..?.....EYl.....z..E.......>.r..u.z......:.'.S......jJ,B..=.#]....G...6.E.Fj.).....,*..j...!F...}W1.....^..f.B.%..*...w\..U...............F.......q..1.*.6.N....:A. .".uq..6.5].l?....fq.f.&P........x. ..+..c.z$).|./....#..!...>Xr.X...I:9./#.9]....~.;t.d.A)iH..S.......WC.......V5.Zg.......F..o.).%.......sG....v..R....].@".8..Ml.Me...h.a...7^t.7A82._.|;...(..A.A....'...S.C.......0l.+....p..f%...H.c...(..U.:fy.J#.[...X..8........9......$P1CfC.FYjLzaL..(6....fU...D.9...W...)...P..#.i.

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-wal.IGtV

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.186574677243417
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:GIMyBA4WG02nPb5KVCjpwIuH6FfKo35a+iL2F6QsR6FVMdBzlzDPguL/TpGn:GEA4AcwVCVwIuaEoJSLg6nwVM7lZsn
                                                                                          MD5:5AF0D97B207C423C329B83FA09E45A84
                                                                                          SHA1:CAEBD711DB8DAE0458D69058897768CADB229609
                                                                                          SHA-256:77797767CEA556F8AA85B447A7EB0075FDC6E2BBEF4A6AFCB95743C11CB0BA3F
                                                                                          SHA-512:DAD067EFF7517DF18B1D5514D0CAE04E3A8CC931612B9553CF99B665339A54ECD483914379876FF46B47C882248F011EB24ECB5855A2C147A306C1F9370BFBB9
                                                                                          Malicious:true
                                                                                          Preview:pJ|J.ya.....y..............K[&_.D#....F.rJ.6j.s......ee#..Z..*..]....JF.B+....&. ..^.....2t.0..lx..h*.'.=.U.FXU.d>U...)"_h....A....o5.....A@%u,....U1L......X..>.J....O.....p\...B....L.J.4...Zc.J..s.....n..o.Z..v.s%.S..^.T..,..z ...ot.8?.....*........C..6.,.pl.....1..0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):49418
                                                                                          Entropy (8bit):1.1538112478602425
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:h17B0+kbB9xy/9ow7R4UYuPt6MBqUbehJdhGIuBcYI5sFX:Dd0+g9xYow7R4DuP4hRuWA
                                                                                          MD5:BFC379C8B5055119852B8B2B8D150888
                                                                                          SHA1:FC42163AFABDD38B4E2181231C07ADCCD1EF7017
                                                                                          SHA-256:C8ABE2E536A5A37848AEA07A1CD3ADCC6056284D2D233CF538AD0C37C68A7072
                                                                                          SHA-512:9F110CC50F0B3DA35AB611C3093FE7F164DAEFFAC1874FB9095E0DB23EF7CCE62922320822A645C39C792092B1954D5360D2C02E6974744FB4BEFCDB8D5B669A
                                                                                          Malicious:true
                                                                                          Preview:.. ..3>i...].6.n_..!:>.L..0.0+z0*K..j._g..!09.u..@...v.Ho.+..9.+......Zt.K.P.._....b9....6"..B....0.2..J.Ru..%..J..2...q...{......a.Y...E...p.6.5.+.L.........1...t.DM=..zH.)E...>.6.SK.S.6........8p..y./.m....l...l..3.p:hr.f..(x...h....}._..t..t..........c...+...B...j;.........'c....!Xh;.....y+.....kR5v5..g..ezB..1..W..+..qk.GY.........2Pc.....>..(..Cf..n.....}..U./.L..Z).....D..0....Q..p..w......&.p..r.\ "g.......~......\.s\.]>..s..........sT{Q........".]....7........\j.C<V...Up.3.....2.v.............0.`.a{.=HV)w.nP....a..}r$j...._3..V......@.n....N. j....8.-k.VL...:...e.LC&B7....B....t..`PD(Cieg.].....~.T)+DDJ.G@Q.?.>.".(../m.p....x.T..%..........f...$..1..e........<&tO......`N.H....'........Z|..wU....v./xn.M.....x$;.......`.P......5F...+m....o.A......0..$...?.|.>./Mu.r..!..x..x.=+.t.Up...)..2..5..rz.i=6C..x...g..,#.T<...ow..u.|P........,f...m....w.......!..#........./.nZ.FT..}".k......Z2..8Z+..2)/g.....M.I90....%.N...l....1)..v?

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.6080393698775075
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:anW4vpQ77mw5K5Gx6mFAhLOtEWcjszphQ0FGT7ewXVzZ:Vj77j2GghLOtEWfzrzqec1Z
                                                                                          MD5:C1644F5E0DB6635DC25A9A9DFCC258AD
                                                                                          SHA1:1AF83556184D4439CD14A83D6E9FBC0601277117
                                                                                          SHA-256:1EB5B2CE48EDC2D0CA4769E56FB720B8B2EFDF1DD3E52E817462F8B52BC67D6E
                                                                                          SHA-512:4C2C14950E49257937ADE823F584F48858F32F7A79C3DC958E25ED640CF3AABD00F847C2E7C555EE0160B7069D5716045F1D889E28BD803C9670763C8DDDC591
                                                                                          Malicious:true
                                                                                          Preview:.o.\...+..-.Y&Om.v....%n..... .1}..o`.?vO.[.k.2..A...4...Gs...Jl>....L..Z^.]^.(.[.fC.Y...KJ......:....S.Z.x|>..l~{.e.5....u..M..k.`hh..|..H....z..i.3.|P........1i...b7....n.hX.,p....F...jHc....@..`.D.._P.Q)7.r....... .....i........N. ...n.^.G....pIT...W.3b.\.GP...I...X.-.. ..(...iv5C.)..<N..<CSN...$..3..m......9...~...=..S..RI."..A.Mz.)......%.._.H..".}?~.L..&.{..Y.o*&."6.n.J.........e...............V..."...U.j.s!8.@_./Fx...L.R.S.L...........>l..z..+.,......L"..De....|.$B?.k..iO.;.3....X......rX.p..X.'6.s+^..#1....n.....fv+.1 '....t.GY..;....i...^e^..O$"....j.......v.............n.`.&.O..;..)..5.p}D........5.. I...U....z..y.Md.l!E^.W.&....z,!C.[0.....-..hV\.dcN.H/.W:...O.Hx~<.\..P..L.:A8..........f.$.@2$".*"`5.`4...,.8<.I..}...TC.d...[G-.....0..f..].e....>qD..c..;..(.@?.....>.n....E.[)...xv..dR.<.....Iv>....P.N....>|..NO.l........F.>.../e.mY#h....S..T......#Qe(A-....4...........>...Y.j....`.[..>........<6.=....D'.Y.....A.7..c..u.......|.<.

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-wal.SRdg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.222985411646662
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:UQ8zrlh7RdvC2m9VI1SU1qvk1TZyPSZLuoDMH/oB1L4XWFvMHn:J8zrlthm9ISUovkaPSRuH/oAXzn
                                                                                          MD5:EA55995080F29BEF6C7D9D6E898995DD
                                                                                          SHA1:E4E00D27725AFC3EF289C050C2096A48A2E61D47
                                                                                          SHA-256:9D54ECC5E2F7C5C6DFB4A76CBDC8A95358D732875A1360FE0301CE07A517AE00
                                                                                          SHA-512:A3386604350790329A528A3453BD12C0C565FB14B775B45CC5D7FB70EA6779C14335BA2E1BC7E6FB5CEE0600363A28C2C9BC282CFDC5FF60BE7E31F9A1346A41
                                                                                          Malicious:true
                                                                                          Preview:tC....`.h.5.*............V..e.....UL..LW.Su....xT...G.K<.J.tnI......s....+.]...7.o.L.\.y@P.....-^..o...0......./ ..ls.4..4I..P.d.b..v._V.7.z!.6\..P7....o.}C..FZ..;.U.Wv.E..Jw(.9Y....^i..\rMz....xSs.0..j...j...Lz.%......S...{3..?..6...oJH..l.djX\.K.._....Y~.....sD..Fx.,0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):49418
                                                                                          Entropy (8bit):1.181659436203414
                                                                                          Encrypted:false
                                                                                          SSDEEP:192:S04FIw47x6akDWmIt8QUTss+YEUTDcWLRNV:1oINrkNFeWLl
                                                                                          MD5:9DBAD88BE0C2F96488E327BA864A6EAB
                                                                                          SHA1:8995BA60078623D257B7F7F7844E0F29B7A7B56E
                                                                                          SHA-256:0827FA6A62A449FD97DB641497F2B74A79376C55C1BAC94230F04833999FCAB1
                                                                                          SHA-512:5122D278CBB6A67A45818878893EB7817866849D482F913AEEFAD7D7AFA22BCCBCD9911AD4077E501EE5169F3ECBF8C66C6CD6AC49214976659D99D03741A69A
                                                                                          Malicious:true
                                                                                          Preview:.....b*.......XxJ..<M.4..........|C.d..{Fk.....f0....o..rs@.o....u.7....5.?b$..pI*.].:|.<..n....kg..!.Y.U......./D..f..u*.$|$.&Z.......[aa..n.`~..4......f.b..ZH7@./U=.gh.ng.0FP+.,.....>eN..i.X..P..d..Z.......I..........]?.h.4.....u.....I.....O"7T......+.te...[P..._......6.u:. .......=.F.H..%S.@.s\..-f..dS9.b.....s.--..).k.)}...nXd.6.......+...P..&.M...=.0.k._.........&f...$L..GHaF.*I.............*.G!.j..8.g.3.m..l....r...c...3...Eu..:-&..|p:Z..g4v.p...T...o...fRhn....d.IZ.;.pg..66%=..H......6..H..j.oi.L......H..P......^uk.\+f..d.-.J..J00/~.".o..._..~...t.2..\..%._.y..J=(.Fm.u6.6t....H..I..J.E^.....V...~..y...^...nX1..<.K.G..............?d..@..N..LN.`...<....*...._.........#.g..'.~.'r#....g........u#.Y....L.h..^.4.4...$.Qy...K....)i0.F..n&...nb>/.....0...d..|....h.....Lq......oP....F....w.Y.-.V.c7-..X... .g.K.#..(...*v..|.OpX."x..vcJZ...J......G...CT...3F.y[.rm..<`)..y....a.`WL.....}i@.M.k[..$K..OQ....:eN.....;3....2N8.w............

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.6083749343394051
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:QFnPabSUWBwVWvn7TRfmjYMjM9kl8+phH0l2+S8Dk:Oy+UIwkTwjMal8+/H0lS8I
                                                                                          MD5:415CF61E087ECC647614FA9FA646E497
                                                                                          SHA1:B5B438243DBAB876A08418511C4DBC399A9F4067
                                                                                          SHA-256:52D897C08E090282991DEB197912D438D95233C6E79B517874022EC77598E9D6
                                                                                          SHA-512:098D3EFDB2A507B615E7725872A5D3E0997CE3A31393D3EE04E12D3EDBA5CB72BD88431674A277520FF94157E5BD576A2EACC393598168598BFDD69FF0721017
                                                                                          Malicious:false
                                                                                          Preview:..N.`..RF}..;".l....>..9.z.Z...A.f...&..........._.Ll?.ZX1J.....yCuyL....l.. .....b....y..].<b.^.<..(4.!.iV..}...........kjU..z....3.../Q....3.O....."~p...T..........oK...b..9?...Q...3{,.7a&z....vn....r..A)..!..ta.,I..oU.......N..&..J.. .....~....y.f.V.w]....1..l~U..?F.....@n...[...s..H..g.e..$.z.D.'=...k.......[..BV}2...JF......*`!_.......:.n...T}A.<.C.>.X.c|'..F.....U..~|....A...9...2.d.R...o=......A...3@hx.....g5Q.B(/D?...._$2o..C.yhu.....1.{s..X...... V..+..U9.~kx...Dq&M.)..T.q..qU......n.Yz...us}H.3.......~....`7/ sJZZl7.+..q.hD@........THl~(...p.p.)..$...z.1%^....l..u.oqv....o..*s.m\.;.}..).i....b..F.4...Z.-...oH......A.....4.o....!....LL..3....\..^6m.....Z.......0.i.v.<.`c..'.P.[.....O...3f...yfI.!...ZC...O..Gs...>.......Ro.l....U.Q@.......6.!..](N)"b...m7y.F...*N...>-{c...k...o)=..[....]k.........0.-./.$?7u6..<R."]N.V....[....E......B..Z.jw.,...g...f..._.....0s..Fa.].+;..`q.LR....Jf9K...U. (....e...$m/.D.l/\:.;B....s.,;..~4..2c

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-wal.KAOU

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.127525469931158
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:u/E3dga7vqKVZGK0PVnnVnNZhWKFxeY+0yIIqQtKG1FPn:dNgDGZv0PVnn9hDshn
                                                                                          MD5:22BADE952E0EE5DDDCB1595B64A05F4B
                                                                                          SHA1:9FD51D1BF9260A92DFD60C115AACA9E30D7B356F
                                                                                          SHA-256:DD67DAD820BFECF5601385BF24967E8FAC33039639D12221C1414A2D74F4CED5
                                                                                          SHA-512:E8F4FE2D9E6ADED693912B5835F4F3542C5EC0BBB6CC42F08A3FBC11FE1CC0BFB56BDF480970DAFF77E68A8D2978C11479962D7280FEFB2FA502298892450D72
                                                                                          Malicious:true
                                                                                          Preview:-1..#g&.n.4+."=m..........b..M.HA.E..{..%..j..WG.bG.z.|.\...[....G.9<........_.gO........J...C.cw.3..+....l.0..{..>.Z.....$~..uM.jG2..9.d<n.g.@...*.....2B..Z.^.$..x.=....h..C.5...n..l..!.C..8.c..c...;7.{p.g5..>qb...+3J..3.P.rg...r.3.....C....../NI.o.....tx|.;....87].0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):49418
                                                                                          Entropy (8bit):1.1548478938116005
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:rqagQ+2XqUp3HHDLc05fUOfXo8RbZblXEXxiz1tf:rtguaUJDLckP3RtRWxiptf
                                                                                          MD5:34B3E84B26351028EBB1B33D6B5321BD
                                                                                          SHA1:A2AF2BAFBEB6365B5DAB0943B6A9B4EBD190A25E
                                                                                          SHA-256:7978AE0E2634FF7E62B3B72A6A2DDEA6B6148C5C82F184670FF6F519CF70E161
                                                                                          SHA-512:64D31DE1637B52736CF469CD0BB9E8D7C4E75059EBECF647A92C2299B64213C770F66FF08ABA14B06B4CADD9D1ED56D15DDD183A824F811A8560841C45CFD481
                                                                                          Malicious:true
                                                                                          Preview:;.k=....+&.?*.9.q.B......)..T.J......"4.R9.Z2.........k...j....\K...*..u#..Y.p._....F..>-..#..k..Q. ..rKeX.t....n.J.."Ho....[(..[...&CX.-dw.,.Q........A..q3y>e7.F..F?.0...c.N.#.+...T=..V..wwX.#./......wE.$...r....8.o..iW.<...t...A.2...-..r3`B.R,X.. .}f..?..2'..k.E.......-:W..}l. .Y-.....E..X...u.)..2~]b.#c\~w.,.G.. ..4B..S.3.~J.-f.s..\.....!.....7..g>..h5.$6i9.&t....w4k..a.l..g.5...C......&..\a.v.w.%k..4eR...#.n.0.j.!u.<e....;....'|...h+....c..H....p....Q...m..~......!..`.....O_p.WS<.@R7..`D..~..x.....=..J'&....P.d.;s..WI.W2..d.-.....s..da.J.].6W.,.agT...,*e.\QnB.R".......,i.%.9g./%..x....qm..|.j_..\.vQ.......{..@.|.>B.{d%.*.|S...w..?)...*.._.M..6..Y$|#..hn....Gkj.....3.K..`.vk..O&m....|vL...;.0]...3.Zux......_.lT .ip..H.0..)..e.......i.....&....8..9-.2......&...T..2.$..S.l.Mn.d..fMf&....X-.l.*.y...N.X1.K.Y7.T.....2KR...2F.JyS[k..n.H?.7... .t...n$...._i.5.!a&<.+.w.].C.Z...-j....XUq'...:..c..NP.t_.1.J.....].D3...M..@Zm..m...FQ.].I

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.608007095398162
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:0fnPjJxZQznbd+dluq/gBgOm0x8lP3tgPFk3FO:0f7bZ+Evd2fgtvFO
                                                                                          MD5:0276965D000ADE139AF53B171130FCD7
                                                                                          SHA1:7B9FCCA188E91785C9A3CEFD4FB0DB73A38177CC
                                                                                          SHA-256:66E6FA74E3E5612A77F07165F430508F25A1A133C8C41FF639FB0ADD67163530
                                                                                          SHA-512:C20423E570C3C108CE231C2DC29476027B7A9FA67DABA652AFDFB20D4523303057E29AFC8C11CF3963ECDF4A464A41F433CF3A7B7277A90D4EC04307B7BEC101
                                                                                          Malicious:true
                                                                                          Preview:.8._/.1.......a.mg..j..l.-...9BF=.....Ze....l.W.o.(tO(T..Q..G...*)......zG#.-...&..XiQoA..;....G../...zc._.q.'...m..^!.....p..2.83...........&.....>...{8c1E.&..|k.H...-u3l...v~)...z.y...:&!.`..T.r.;%...+p.of.nG:..B..7.....=$......eP.%Rz.tF...^}..-.G...Q}...T\%..4.C..8W.]33.@[..B..t4o..s.s...1..Q.M..tf.5>Mv.n.......e...t......_$mKp...............I:Kx...KWA.Z.LL..BNBu....J......&.....2.......x.l..7G....4..%.%.rXve....v.l....Ih..y..NZ.-.....M.i...c...:x.?H........E.}<1.P...j..._cw}...u....iX...x$.Hh\.+w.D...(..3T.......}.5....\S.S9.O.N..|K.'*.-.w%...b1cXD..y~.l'..:...0 .Mr\.hs.q.ct...lk.@.e.+......R..[cb.-.?..{.....7. ...M.*dRGQ..r%..[..w....^...8....'3.D.w..0|#.?..<.*..c3.uX.q.uT.uu...D..M..Z..J.Z.?.l......\....%;..C....>.........vy.sE..r...5....8.y......F.&..p......E.e...(.+..3..L.-.B.....\....uNT.2.}.d%.WY.6..K....I.&h...\..P.........:X.......Hc....'...W;KB>+6Tk...G.[.d |..=..Hj.............5.............uA.i.......^E6..O...\........Y.zu;j.

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-wal.kmYV

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.159098349893056
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:MkECGL9SuFwBZjqsGRZaCVSLMFmeMhCloECKQHrRz8+8jnNuNjrSn:ToLLFQZesGRILEmeMhCzArK+CuNan
                                                                                          MD5:4C2C25EBF6CD5AB397ACDA2B742BC7E9
                                                                                          SHA1:AD9456F72AFCE17D422B9A5FBF94895ED3AAEA52
                                                                                          SHA-256:791E855E8C874B0DC00E440845F1371338826009EE9D9FDE78924021BF3DB006
                                                                                          SHA-512:270144ADDB421FF1778CA0AA6FD126899FB58813713A2D3EB045482B2C3138814D4D39C7AA05BFCD10D23906FFC0548C996ED1F2CC2C56A56A5EAD771739502C
                                                                                          Malicious:true
                                                                                          Preview:D.3..'.@5....3N...........fr.e....K.%.7+R.....M.>.-....]v.te..............^l./"....,68...u,......Y..{j-9..,.&..u..x.O......>...O..G6.L."..$=.X.....#X.n.h-.@L.....D.'L[..-%..xD.P....?........f.....=.....aX0*U....]so......p>.t..0........Q.vs[G|...=.........j|..R.....l.i.0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):581898
                                                                                          Entropy (8bit):4.368885758108065
                                                                                          Encrypted:false
                                                                                          SSDEEP:6144:PQTHbcE5nCeV0igTEwbz2hVAGkGBqD7C7G/476:oTHbcE6igTEwbihWGpqD2GQ6
                                                                                          MD5:CCB5CD2D0834F5719A13C25E04FBC24A
                                                                                          SHA1:1AF1544E06ED062902FA2BE3BF9F3A1BAF81357D
                                                                                          SHA-256:69AF3E41563CDDCB5F0B7D34767FCEABE39A2E039054B18BB2A7934C07AE3C09
                                                                                          SHA-512:D0ADE44C56A9435D57CC7A4A87F629621FD1A307A9886FB2304A9E947111BB64D2642779D353BF62C4B54C7A3415233ACC638C1173EF996D9825E48582C8265A
                                                                                          Malicious:true
                                                                                          Preview:..wXz.Z..z..d......h%*cl.SM...Gd.1..E...\....`.*..C.B..<....)...^.J.R...d.:%_q.EtO;.Zi.;.6?.'.A.$....l......#..H..=.e..;.CV...(m)_..>....'r4........p.,.B. ..d.K/.q....0.{*3..t...5.my?.6...a......n./.F.x....$..q.t.\&~.(...ph.s.3.?...-!J.W..$.#..f.......d....6.*....|..=m-...9Xl_.[..*..[..f(....}.....G...".H..by..w..[...`C*............G.....Y..8...._.^].....8.ts......L..o@...j.+s.].W..d..Dyd.W.n.....co&M.'W.&.4:..C.F..`!ReS..0.......o....*W....P.#.,.D9...6or.U;..5@G.iRv...%...)..[(VS....\...G.^.?.wAX7.q...W.%4C.Rl...i..">..I,...n..l..2&...2=[s(]...L...{Z...........s......q3.{a..}.U7T..SD.(zy.r.7..N..4.....N..'.o.u..7Z.O.-...%}@..v..z.Y.l..Z.iL.....`.%J..6n.S<>..{......F...m.i..=.URO.u;.......fV...I...].{..O*.8.......%....GP.{..........9..`%...=...#%Q.H..~.).|..Y..*..AC.i.O.SC%.c...l...U/#.e.vY.\k.!{.r%RW.2..H....*s..j...k..u..../.}N.L|..._...-..R..Y..S+2........|.G$..K;F...qvQ..W..x...q..-.#OM.J.u..%../f.E%..M.l..&;p...k4X.f+.....Z."N.

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.6080407530303797
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:3tu/5Awrma3DI7rpBiJMvgetzvdncb3OZqQm4kD4dBex:3/s0hBNp5RZqIX7ex
                                                                                          MD5:327C59C88A34490DA1E949B257C98875
                                                                                          SHA1:B2E493D13EA3B875CBFFF3441565389A9AA6FE71
                                                                                          SHA-256:87B5B4A6ED77F467C338069FE72198CF99CB5B24F9DDA1742921EA9AD50F4AC9
                                                                                          SHA-512:1A68BBBE79A1947387E7F1B6844D069F2C40B65CE91326DFB18E18B567340224AF508A8E57D14323F85185A4BBF924E12FF021A4C7D03C4328940B0ACB5FE858
                                                                                          Malicious:true
                                                                                          Preview:i.=.. ?.Q.$.H0F.1.p...x.= L....c._..H...../&T...Y...d..c. .#..L.e..C..H...A1..(r}.c-.J.~.....M...0.-_Q..*..1\^.ZI.B..7..2..]s.c<."uG..o.e....9.M...v....../'...k%...V...9.........eO!.'..-.-.P....E....{`...$.}.,Y%Oc1......Q..{.q..J..........5T.....1h...#.NB?2...r..K.}....0.X-k. ....(..7..1....(.q....._.P.w..X....W.h....q$es.'....f....b)Z....@.D.d^.......\..5.5.V.u2.t....9.......C.|}...M.x.[F.......8.=.v.p&.vI....#.6.W.....Ea..J^..k..'.A.|%%.6...A<..<.aQ...X...*.[.$....RX...^QrzJsW.s..n.M#-........[..PU+......|^u*e.-.....ChH..}[......p..!...G..^R...eQ.*Q..5i....6.WZ..T(.4S....!..l...E.:}.F.4..r....G.%.....-........8Q..sE~.....5...$..P.....@.\.Xf._.w.+TL.z.At.a[O.....bXr...7D.]sK..V......p{..J.9...{.-.|..}.b......;:Y..0V.s.Ik+-.g..=..s..b..mh...G7.<S..'h..p.HE.Q.....R..4.q._=.4..@.D]....(.nd.;.^..iu..P.h....3u...=.....i..r.;.n...................7[2&...7...M......Jh~nb.;....}*i.u.....f.y..o......O.>.|......>..[L/.>JBS.....1....X.

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-wal.GwmU

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.218037317680715
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:OCWQ3TbDGtQMgMRvra5ZdwYpyhOIJLpxM6CcYVqwn:wQDvGtQ/oTyR/EInqwn
                                                                                          MD5:7258610CD3CEE41EDEC7AB83A0E2617D
                                                                                          SHA1:10426D1D3D4930138471A1009B9D8E4395E643A8
                                                                                          SHA-256:08F38F6BD9515EC3928C06C0EE5FB2482E3EA025099248B0957364793B35BAA3
                                                                                          SHA-512:9ADA2F00B4DC93DE8310660DD188EDA72DB8CF8B775FE12AEBF92D295871DA5D8A0F00AD530254E0A5009D56F676D36D8FD8B0821D2C53498891FE5A8FB16735
                                                                                          Malicious:true
                                                                                          Preview:.h...\.OJ.~.W..............J..[\......!O5R....,.[..n.=yR.R...H+}.B...s.1by.Qo.i.S"..G=.M.a.:..)......k.....,7....4..|..W..-i..._.`o..?...jE..K......7.W...n...p.h....P.F.H....d....S .)........v*.X.+.....^.B=}.k.....D!..].G#l........%..B...^jFT..n.9....*C.1x"........0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\permanent\chrome\idb\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\temporary\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\to-be-removed\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\targeting.snapshot.json

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):3953
                                                                                          Entropy (8bit):7.955615973932801
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:1jvKFOItvOT3ATOg0hoJJ3/gmu2GwBkT0zVOWfgT60:1jvK4IU3ASg0hoJJ3NB+0zUMQ60
                                                                                          MD5:366F55F94203EF7D2C24122290123275
                                                                                          SHA1:26A9547938C0B9A430E2D085DD251C2EA894A38E
                                                                                          SHA-256:355C58C67FD4200BD7D7D0E63E3873AA66EA434A623E4756BBBEDF014083EB13
                                                                                          SHA-512:B4A7D1ECEB98B3325AF19D66D2F70732D59FAB187DFF319460F9D5CE2DB06E02C687438C004C8D33F8B5EB518DB3B6EC75E62949B1373E490BF3C1791B21883E
                                                                                          Malicious:true
                                                                                          Preview:.&.[RE..g...B.m..../....~.....`....e..(.9}N....TLw.... ..|.H\...9..;....+.F......s..J.a..........a..Qj.....j..l_...0B=L..p...d}S..j....d..d...<k.4..D1.....uk.%.D.....h....#.Pmk.....&.....&.R.$.w.y....$..g4.<(.M_.x...o....H}.A...b.0q..".$X....z........ .Z...'.R.U....V....*`.#.n..l.b+-....r...K]+....T.^..[.!....[.(..[M..............y.{C...KmR.1......2..{+.....p...).G.K?D....~sK.*.....00.q..g..p...:.......u.......Cb..KO....v.a[1[......v..j5.1.Re.S.Z.R...VvM[..F|+h..N.E.o->C...b\a.9..w..L..}.6\.h.pg...&...1d.b..-h.J.&e.X..p.#uA...1..s+..d..>I....-~.n...j...T..Y*AW}.C......R.i.....i6.|=..DJ...T*_.....v.$..'.S.t..T..iz`.<.wE..v..b2......E.k.%.N..G/.\......1w.i.(.....3.s....R...9..T.... B.]Sv....A..j..H...D..&..8......^.@....&.P.6..c.IO.<!g.q...j12.:...w....J4f..&..;..6...+q.....].5w.....'..x......._.8l%.._n...t...k...(.@<m...#qV.Daf.z.....U....s0D....2.t*P.c&P?...9....UM..H...Fc.....,.P....[c#...w...y.;..L.[.g....b!d^{.l......Z...l?.3..

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\times.json

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):316
                                                                                          Entropy (8bit):7.342385259419188
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:kQBLx7k8zyaBIp7uWJhqUmt3blP9NzsRooE7jVjyfmO5ymn:kULxUiJ9NAG934fmmymn
                                                                                          MD5:48729B0740A51613E6849BAFD9F26FEE
                                                                                          SHA1:706FEE27E5EC8A67E4946870596E595315DE6246
                                                                                          SHA-256:15C899813A25ECFDBF3D9B415CCAD0C28226F07F32A92B95D2E549FDB8B8CC46
                                                                                          SHA-512:3ABCCD14FBCA4808344E4FA8AF050FD07699EA79210319BCE4EE751C82409650C7D4C5799393EC94462568B2CEFBED8E0790797686C407A6E9798247FB92E9A9
                                                                                          Malicious:true
                                                                                          Preview:....1...Z|...ZX.......#.....L.........../...m5}]..#i.../....{........u.....j....]..`..R..Q..x..^).!@ I8.\......u.X..@.....B...C.z....P<....m..1..r....J]}1.....l..^...*.n.q'.<h.A...R8.......j~;.Ui...L"&....D=9.-\b...Tv..,Q?.l&g...D>#e....X.v8.HT......m......@[..N...cA...f.K.n.s*.0..yh..).0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):98570
                                                                                          Entropy (8bit):0.6440326137048917
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:UdRe5gs3fOS1HC3i0ufmsrGoQbOMRZT6MlW48eV8snzarp:6ReOob1HC303r7Q6M3iP
                                                                                          MD5:9B0A8FEEC90383B965D0558EB2504F70
                                                                                          SHA1:3927D3DCE77FC74A7322BB6B9A7852AF2D512FE3
                                                                                          SHA-256:39290429B2111867CDAEB494964A9BEE2375C37F81A314A3F432431DEBBF34BD
                                                                                          SHA-512:659D559F93D799246FD94E0572D2AC49FF7F93D6FE2A6B30E85A4B7582270347D550BEBE051680F653A198EF4703150D14EC15FD9257BFC02D2ABD95710BD24C
                                                                                          Malicious:true
                                                                                          Preview:.&s.<'..g.P....G.b!.?.@:..>.;...T.w..z.....^.#.A,...H.d.H.t.Dt.....(...N.L.l.7X.i.Kx....^..R...q....,.&..j....p.t.h.3...:..iz..|....X....<.'aW....U......,.U....h......O...Wz..R[2......@.T.....jI....CH.. c.u.9....U.x.|..j#.t.@<......M&.......DO....&..).....>|.&..d..*..z.3.r.._...;...-..md.jr..x.P..9..u.Z..GT.~...t.r.a..Od<..r...........U....4....&\h.rm...y.....l_~..=...O.n.....G)Cw.f.n5orW..B{.&\Q.5...h....3..$...Mt....-......~.U...).#v7..B.......]^Xu64.I...#.N.Yd.Wp.vx..c@...... .Ld..|..QH..n"....~[....O...Z...l;..d.8..3..\....A......s.o.q..l.^0..dPc ..|.d@..B....AR.1'.....]qCA..>....wL...d3.T'2~$... .-... .w..g........I.*.4...+.F.....4........'.P...'O..3|....Hj....MD..G..&k.w..q m....(.....W.V63Bc..+D..]......q......o.u...^7p..E...h'.:V@-.zF.....i.\].....gh...j...dC{.n.h.H....G.%.U!.=......p.xA...p......i..?@p..lmz."^.`9_......~..n.Ju.\E..:.x..Cw...c.|F...X.<....VX*..v.............Xk....>U_.=..r.......l.....2.3y}.U.uw...]...O.

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-shm

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):33034
                                                                                          Entropy (8bit):1.6100479849225153
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:tUyaPl7NwT93jXKufQE3Vn0wJlCCaDfwEz5PJcuM+pyfdb1A9+:t1aP1OBzKK5jCC0z5PJoZF1AY
                                                                                          MD5:7F4A119BC1DA33362CB10141839FEE68
                                                                                          SHA1:63858C22E420B5BF4FA58202ED6D5290DF59635C
                                                                                          SHA-256:5D3645CF589E2C394575E01291645E7A75F4D94B96EA7CFDBD054152BAE3F499
                                                                                          SHA-512:8A23EA92B8719091B315D41654CB5ADC508E52379BCC73C8098336D28F84A6EB4AF4BD1CAC8FFCC56CA07C157E304DF41558152264000330A630497EB5F28731
                                                                                          Malicious:true
                                                                                          Preview:d.....=..T.S..^..4..X.`.".>..6Ye.q@.Y../q....{..H...P.V..WS..i...R...OYX..^/..o..Q..Fo...T.'l.o.'....s.`...|.......S...B.{.I...R........A.E..V.U...1.(...2%.......F..F.....$...W.Q."..K.l.j..N.....C..:M..6a.P..k..}.`.k.Y..q.,.l.}....S:Z~...q.3.......5......-.....n.u.-.$.....i;'......~1U.....ul...t....}%A.w.....).k+.=.S.'..'Z...xjc..].m.4.........z.n.2?D.5.+...3.,P..]h.....R..tHT\.VG)...G..S<...T...=....S.|jfU.G..z..h..H...[.x....%,......M...h...jH.t.'D.w".kE.@....Vt.....+.6G.../N..=....@8..K.V.s.kL..&C.Z.t.....EM7.)....Q+7.g .(...1.J..yo..c.ud.%...0:..........c.........e~<o...T,'25.'....a.....U..(.O.e:.8..u,|..E-./."..h_D...0..Ww....e~........7..>t.*%.}v.z[.yJi...uf[+i..S.WQ.t..p.....ZY......e.....&...W?K.\..)Is..".. .q......Rc....T......bi..d.2.uW.`.Y....d..G"...m.=...&...+....Us.....Q3]..K.n........)....&G..[)t....Y?.M.[._...8..........t..fA.w.6mS. ....\0.H\.Os......+K.?N.:...`g..{.Ed....%..t....d....L.u.Y@.S..E..*..dD..x[.

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\webappsstore.sqlite-wal.Pwtf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.070289584852314
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:Mxg8ZaD3UwjtF/MnJ+Rf9+V91vXX6luC1/VJQJzlXDDNUkSn:Mm8ZJwjtdMnJ+Z9+VDCluSVJCzJDNUkS
                                                                                          MD5:4135AECB6DEC4176BA67086412C245BB
                                                                                          SHA1:27D93D2C2C8422D54C71788A5B0FA3E92F41AE9C
                                                                                          SHA-256:2897535045593EE4DA61B09E757223EBA6D339A8DB45D2F208E2503DB61CE03D
                                                                                          SHA-512:C958AEDCB0405F677BEB562709F88A0FA107E41C260F0F483B45C7548931DD9D73EE0674985F8000D6427EED540CEEDE155C3242D3871CF5B1B05328A1C777A9
                                                                                          Malicious:true
                                                                                          Preview:...E..W..x.................o\.. +..@u<@).V]...zI..z..r.=81........x..J.,...r..dvd]w.r..l....p....P....{2........x.(.( .o6...9.xK`.[.p.\..V......p...@..}....{e.)kY...A.....q+.....<.y...N...w.|.X.uk.#P.8..z...).e5I......\.....w...V.....l.{U..B0.1../'.*I......;s.r.y...C.....0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\xulstore.json

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:SysEx File -
                                                                                          Category:dropped
                                                                                          Size (bytes):386
                                                                                          Entropy (8bit):7.4659375116536495
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:uo/1efMnsTa92dnjgijkLOICJVLmqb41clmn:ukRsG92dndjTLYclm
                                                                                          MD5:477A7D196E5A3B28FCDB0A6879D90AF6
                                                                                          SHA1:40E3DFC3621FAA8B2FD72C4B199172AE57CDEECD
                                                                                          SHA-256:8113B8B3228D6595C43B318C59B578C8B9D6DDBBED7DC73B3747AC8B57342925
                                                                                          SHA-512:B96E08D1A6043B04049354958C48FF48C5A230BAF2758042506EB54935B10477105CDBF0E5BA0F6A612E6245EA874232227D03CBA576B2805D03DBE3E3770A85
                                                                                          Malicious:true
                                                                                          Preview:.8..H....3}.`..4......c.^&.....Q..}...2.<.%$SD.0%...?n.A.........Ffn....F.9......l.-z.D..u.4.B...'.Q.>..pe":""}}}(..#.v..E?.<r2.".....whA..c.(.W...%.+.x...[2...H.b6Rq....o.{i4.7..`...9a.^z...jm..l......XH.7..I....p...H.........P.`..M...h..........v.3.f...Q\.....9 .Y..$.l...&.........jS.~e.....x.Ji..M/....)d.=.E.......[..O..|.\..A3./...I.#.m...../OP.m.......r0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:true
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\times.json

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):313
                                                                                          Entropy (8bit):7.237825297409305
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:8pkJrX+CrsF3cCBCvJ2PHwroskQXJ+ReQay0670cV+OX4r4niNZFeTANB3jw/mn:AkJiC49XJQMskQ1y0a/X4r4nASkNWmn
                                                                                          MD5:D507D8B8CA0EF68CFB1DF49DE519FCA3
                                                                                          SHA1:5E68638B0C88A3B5793D73AE48A1BDA465925F19
                                                                                          SHA-256:E019792A03C9EF1FF049CEBFFA6453C5186021A54D3A512E4D6D634D931C9C91
                                                                                          SHA-512:0E9A4DFAEA64B43F886BC3DCB4595DEE14F1AD9B7EFCFB3B3E0323FC4CC6DC82B78D1772859DD2CBDB2693E9571DFFF0AB9D39F12F466FC80A2DCAF54A576E8C
                                                                                          Malicious:true
                                                                                          Preview:[.#.h.n.~..(....>...Jt..?.zz.?.stUse": null.}....f_.......R........c.Q.g]p>.....A.~..C..F.=.O....eS"^84?38..R.";...N.h/~.c....i.f........y..4.....x.^.....Up=..g.d...y.C2..q\=R.c......p..&{%....r.....".1.>=...Y..h..............?.d..2..n&............S....T.Y.xvC.'..^@.7.Tc0#.G.....##0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\installs.ini

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):341
                                                                                          Entropy (8bit):7.355796084490292
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:RsZ/5Nbewoi+xFAKVadHHD8sEsVkAcan108fwYKv0n8opYhGE0fM/e8n:Ru5swon/fE18xsJcO11zKv08kYhGFU/D
                                                                                          MD5:693657E56446CBBB270E7BE7F10474B4
                                                                                          SHA1:31206C21D16034D4149C3F9F721BE42C8679BEAD
                                                                                          SHA-256:E1605D603A87CBC4FDABA8B0641DDCA56B8A3BD2E92BE60CCC4EFEB35CD6BA8A
                                                                                          SHA-512:644A8792A05FD00812CFA405DD95E5BD1A1C3E4AA192032BCEFAF65EB4E86BB6847F382F83E162AEF4BFC431F883CB1D823D3F412C2E7793CE86A97796C29D47
                                                                                          Malicious:false
                                                                                          Preview:+..k.........A).}..A...J.E..L.fY..ES.ez.....w.=./..C..(..G.HZ"ocked=1....J^~.U.#..z..U.$....U......./ .>Wu..tby...x.Ig...".. D..J.ds.x.[..<..+..+h.G.....coB<....?.4K.>......&..l.i0.._..hy_........9.F.w..z!..e..}%W.U(F.n.r.%f.e4..+<X.Y.....Tw.fr.$.c.t......~...x.,.+.&std..."..vH........E...hX....>cYSI..-..IE...I.*.M...'.0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:Amiga Workbench
                                                                                          Category:dropped
                                                                                          Size (bytes):571
                                                                                          Entropy (8bit):7.631705946223264
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:P0dTest7eZjXxccEo9zC/L4aERa3+B3AybFk1NM7W33n:kTestaZTxEszM+ACMz33
                                                                                          MD5:FAFA6AA46BCCDABA84B1BD5F0426C58B
                                                                                          SHA1:3525372BBB1F8714D470C7D32FBD725AF0EC3780
                                                                                          SHA-256:91ED4459DCD84AB3D7BF0871746DC22E27A460816F0F5EDBCAEFE9EBC5EC4A39
                                                                                          SHA-512:F8907D35B6128185D3ED96DBE274DEF058BE691ECFCF416DBD73A93E4C016E7FB4775B0CEDB86549CD1E3869FA754B0287683AD25D2F116EB629CD1F8B6834E5
                                                                                          Malicious:true
                                                                                          Preview:...2X3Mx.C.>1X.:9....B./...|.'O.Z.F3..s.i.,.D?..2.x.5p.?.\%.!........;.V.~.AI./.6..[..3..F..r.k.....v...b|.s....J.....!.I.h.*A..J.......[.L...r.f.#.......!?}....mY.6....>/l.m4.....Y)uD.B..`Z....$.U...Q.E.)t@....1.]..7.....10....t....7.#~.0.o......]18#".M....kB.5.vC..77?.a.Q|.....u..m.....n.Y........K..2P..W..~....L..0.M..]Es..w.=$7Z...*7..y...7.Ks........jp...M>.{.y.Z.U^s8.9i.<.`.....n(...Fg.l.U..c.|qX1.=]M....g$.v.........x.....?.D*...sX..S#R..:7...&.9...s`.....*..xq.i[.GQ.m....[Js...o...(+.;.yGb....*..xb.x..~..Kt...jH..P..@k..0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\Skype\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Skype\RootTools\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\Skype\RootTools\roottools.conf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):342
                                                                                          Entropy (8bit):7.374047966993869
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:5zrbiTguNE7RTehW8IOcj8AXxCcHj5MyGg0T6x5et9dXKHV+ivNQQJNRBGBZSN9n:xrbiTguNuRyhW8DygO/GgyOkXK1rJUBW
                                                                                          MD5:11E735A2780785090DCEF5CE66E7E27F
                                                                                          SHA1:5FFE47AF3F9C3600C99146A56BBAE68190CE7542
                                                                                          SHA-256:6050D7E21063A20EDDFAE5311DFF46CFB7BEA351BD4BD8CB8E732FB32F4EC26C
                                                                                          SHA-512:73C84C97590867C43CD79C6443ECC5908539B75D10C0304D10547088D510973583DE81719522C82E288E7DFE69EB81DAF6D223211DC276D5F479F21FCC5C2107
                                                                                          Malicious:false
                                                                                          Preview:0.k\u.4....e...iZT;W...2..3a.?..A7B@...9..a.@qx..R..../.r.....bc62b5dacb4....%Dm}<.W..m.9;..@.......44U.W....x..V....R.U....~5?.irw...d..^..?.~....s/.=.|q..^=... a`v.B...11....z.t+....B...wJ.....f!...T....t......*..z..._....Ts.)....?Ob...D"j.OW.]7.D..y..y.,.cv!......LQ.. {a.?....A..4...1.<P...CE........*..YX,..0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\_curlrc.HqIz

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):266
                                                                                          Entropy (8bit):7.116703454448242
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:GoDUUhJ7EWBAlpynzFRKz/BvK+4DjKemzsHXonv4mn:G2UUDsACBVmK1ssQmn
                                                                                          MD5:4FF892B397AC2ADDED3F3E73F31521FA
                                                                                          SHA1:6A7C8D04BB76588E14DA73C4AAFE9653CB4ADF79
                                                                                          SHA-256:B08DF29D3CB078BD7DFE684178F285A78386DA6654FE9155CA895CBB35800670
                                                                                          SHA-512:E3AF87803750FE1275A9F79BC3A7AECD4A82549BE49794E0F1BC155B8FAC6D9B5E18B008F898F3EE3E1682C2198BF95B511C7E6273D80C4BCF5E13EE5C87FD4D
                                                                                          Malicious:false
                                                                                          Preview: .dF..\\\f..|.........O.8+...5.W...7W..%0....m..v...C..WWU$.>....q.%.E.P..0.L..s8.'O.......C`.5.XB..5HB.6..{...E@C.6..!h*o.*.Y.^.....l.4"..7...<...~'J....|...<.j..C.0]..[.H...c.#WG(..{...-.6M..2+....b.y..Z....D...l/....h..=.m"....8....X7%.a..9yYh..0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\_curlrc.LMwt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.18197798544448
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:pw44/H7S+cN9/M1vO7R4TWbBS4Ec5NmT8KyHs8G3C1mxSn:2LY/dVpbA4Ec5K3AM32cSn
                                                                                          MD5:9FC50CCD036BEA6F71E45623987FDC34
                                                                                          SHA1:A0F408D799FD3974777A1BDD5D68132CC41F010B
                                                                                          SHA-256:8CBB750DCB399CD67DB73E7628AE89376917D89C36F52992A61636B9AC4B183F
                                                                                          SHA-512:660A38AD7EBC45EEAFC2CDB068C97138A275C2647F4670EB1F89031A1BD174B492E4C44ECB67E118606BE301C16A763D283748D5F45C223C13BD2D6C41843891
                                                                                          Malicious:false
                                                                                          Preview:qw|....F..*.............g60....*T|.x.\...y.........E....&.w....^....z./r/.)^.....O~....:..+........'..0xx....@....e..jQ..[.J........|..I.....q.r.(.7h[....#.,M...J.......?....vd...F<.R...@...8.y..K..Y....z.Y..).2.lL..q...-'.....-.a)D<F...aS_.'..<*#...^x..f...j%.....J.E..;.0xABADCABA

                                                                                          C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\com.adobe.dunamis\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Application Data\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms.ldND (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):5898
                                                                                          Entropy (8bit):7.420045826065581
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:8DwiojIfqbBdD359AX+j8B70a/HhC6r7+wZLtmAdRT6KuQYMA:8sDjIf2hCw8B7DI6rHmAd7uQYR
                                                                                          MD5:431D0994743A71E10E67CA4FE10D7470
                                                                                          SHA1:B03B9104531F9CB7D067B81B4B2F7D7D337D052A
                                                                                          SHA-256:BAB5DA0DCCFB2372589245F19999DB13359567E35A51DEC9F8736EE61DCC4AA4
                                                                                          SHA-512:D732B1E102E8ABCA91E857AEE7EF799A0FB8BCB9F988A866068DFB7651229329A173A0EAD30F1AA9EBE52145E08944DB513B3E533C48DC960E58BA6EBBDB8DE4
                                                                                          Malicious:false
                                                                                          Preview:].......l.H....[.J.Jof5..'.6b.....>[.Y"[A.q....e......r......^..r.u\.CF....R.2Z..rl..t.?.:...5..,...4...|..A.....U.SW.X......F....`.^.c..:..o..l.z... .D..."....W6..........4E.5.c!....9.Jf2.qgS..._.35.FN.....%.W....M..CU..!..r.Q~.......By$.......J`cA..US...r......h.G...@.....<..).....S.n.{.....>...g.+....M..a..^:..>.......M....x..J.g....&iU..^S....R^%.)Z...t5j!..4.j..D...tU....7.(..8.D....:..F~<8J.^"..6..c.r. .'>.b..;Q..c$..7.,....j...E*A..R..G...1..I.in..CSpD..>.2.~7...Bq.P.x0..ww...^j..`.@..n....c...kx..x9...F.!4.Z.;.sB.x.1<.p.*=xe*M...XB...x.j..j.E....#...(.I.s...`(.\.2m`..b....U..].......~.;...F....G....................).. ....B.f...P.R..q...-*...h.U..-........U...|....t.9A...Y.-...)........C.,..8..A2L\{..h....bd]O.........z-&..)c...@.......w..R..`....`P..".c....(}.;>........~..U..:....d.x.9.]..#.I.l.0.M5j.....*..3.s..W../.7\.$..q..S...o..i7....g.d8J..w....I>.h...*.V..uO.0.N40".X..w/.....kS..5...#q...3.!... ...;I..np.D....Q.0Z?..

                                                                                          C:\Users\user\Contacts\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Desktop\DTBZGIOOSO.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.866682691325835
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Jqafy2c/1YMGdcfC3VHOGrchF48/RhjWCjWwvMTfQq35kG+Iz2:JqgGGB0I97Ia8SUEzQq3OGU
                                                                                          MD5:4764EAE493B39B423CC1C5A1408936F4
                                                                                          SHA1:5FFC7C408E677F7C0B81CB33B67D13C478B829AB
                                                                                          SHA-256:ADCFDE458CCA544369D9DA64C60432B88E89D0B5D0C08706F21213C6B834FB96
                                                                                          SHA-512:DB1407910942F77D4C87B0E293BFD0DFF7046BCF75BAD84999CA83DB1EBD0AA99BB2DD3096EC6AB9CFBAA79C557922D8E970D1A1CD32F5A0A3356F05AAC71B23
                                                                                          Malicious:false
                                                                                          Preview:.(.~.....Q.'s.qV.2!.>.m.....x.s..)..L0.o..|.c.=...5r.........T........Q.....j.9.5....Z>..\..blb#"$.k...).y5..d...aX...n=B.X.3......V...@..b......8..(M....:.2..!{.3."..+i*...7W&.....9.....'..e).7.%-.o.U.T.>'fzl..W.\4...|.X.....)..W..O./O.....kS.F[...n.$......$w..]ov.H^..)S.<...a]..P..a.N..........&.._5...\f....cB..@.......cx>|...)...0......t.5..t.\.....j. KO...1.Z.!.<..hW..m..'.x.....,......V.(].1..U.... ...S........klE.-g......6.@....q.....c2l.yH............D....j.......h......~..fy.)..g....\..`n.}F.x.....XD2....W..?..U.%......@.. .l.-0....r..UX....K... ..C.M.........O....l.k.v....t0....T.T"...=w9.z.{Y..6.}......&p.#...8..3..I...|.;...H.?s.S(.b-.C.4.Fl......!.xX..u..k........L.p.%...!..Q_.Oa.Gru..Mj..k...'...{....t.....k..X......5..h&......'t.W..,,..:~....mY..cb.7X.l.`....N...~..*..g.bS>...;..0..*znK...v;...i...5.L...;.j..l&......,*2.+...^...Z.}E....{m.....'}...3\..._6L....I2.X.%.\...w.}..&...5U@b...........yV..]W/./.[...i..M@[].....K$.n.

                                                                                          C:\Users\user\Desktop\DTBZGIOOSO.docx.lzMZ (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.866682691325835
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Jqafy2c/1YMGdcfC3VHOGrchF48/RhjWCjWwvMTfQq35kG+Iz2:JqgGGB0I97Ia8SUEzQq3OGU
                                                                                          MD5:4764EAE493B39B423CC1C5A1408936F4
                                                                                          SHA1:5FFC7C408E677F7C0B81CB33B67D13C478B829AB
                                                                                          SHA-256:ADCFDE458CCA544369D9DA64C60432B88E89D0B5D0C08706F21213C6B834FB96
                                                                                          SHA-512:DB1407910942F77D4C87B0E293BFD0DFF7046BCF75BAD84999CA83DB1EBD0AA99BB2DD3096EC6AB9CFBAA79C557922D8E970D1A1CD32F5A0A3356F05AAC71B23
                                                                                          Malicious:false
                                                                                          Preview:.(.~.....Q.'s.qV.2!.>.m.....x.s..)..L0.o..|.c.=...5r.........T........Q.....j.9.5....Z>..\..blb#"$.k...).y5..d...aX...n=B.X.3......V...@..b......8..(M....:.2..!{.3."..+i*...7W&.....9.....'..e).7.%-.o.U.T.>'fzl..W.\4...|.X.....)..W..O./O.....kS.F[...n.$......$w..]ov.H^..)S.<...a]..P..a.N..........&.._5...\f....cB..@.......cx>|...)...0......t.5..t.\.....j. KO...1.Z.!.<..hW..m..'.x.....,......V.(].1..U.... ...S........klE.-g......6.@....q.....c2l.yH............D....j.......h......~..fy.)..g....\..`n.}F.x.....XD2....W..?..U.%......@.. .l.-0....r..UX....K... ..C.M.........O....l.k.v....t0....T.T"...=w9.z.{Y..6.}......&p.#...8..3..I...|.;...H.?s.S(.b-.C.4.Fl......!.xX..u..k........L.p.%...!..Q_.Oa.Gru..Mj..k...'...{....t.....k..X......5..h&......'t.W..,,..:~....mY..cb.7X.l.`....N...~..*..g.bS>...;..0..*znK...v;...i...5.L...;.j..l&......,*2.+...^...Z.}E....{m.....'}...3\..._6L....I2.X.%.\...w.}..&...5U@b...........yV..]W/./.[...i..M@[].....K$.n.

                                                                                          C:\Users\user\Desktop\DTBZGIOOSO\DTBZGIOOSO.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.855482415798298
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:XvXnwHC4Zk9vSoPLAAC6tO5V7qBgX/oFfnhf6t8ZUWNTEGqP3hnH:YiInSLnYkgXWSiNTps5
                                                                                          MD5:531AF8FE557A1AEC4909589B140A6CF0
                                                                                          SHA1:3893ADA1B21DAD3549F7760933CF933050B3D44A
                                                                                          SHA-256:DE8DCDED57D72D615E94D08589E0F1AD4B6B194762CCD1069F041E87F16BB39D
                                                                                          SHA-512:3D6BFCC45BA7AD8BB7ECF11805E7B5CE93DEC590CA8E9AA5381A88282AD081FB4E259EE6FED1A4FC8FD6B60B28298FBBE7B3702F7F05085D50A49E7F5218406C
                                                                                          Malicious:false
                                                                                          Preview:.....SzYC..eY.O:...I.j`....G0.k...^K...m..%i!q>.....h.f.b....t=v.^....^*.....*I.......>..&V.6....;.zq..'...l=C........c0...].d.....G.DD..g..d..r.[s.....jF...c6.f....B.,k.E..<4t.p......FM.<`=...2F.....n.>..K....`.!J.N#O.!K...n..C...l.[(YV.......E..:..T....?.....V.....T....kc...J0....hN.cK..u...g..v.R#]._.$.N+...S..m.....i$BFR.s...b..P..E.....>......9..U..H..u.......4..E...aR.F..fj..7-S....\..[...5..u.0:......._s.D@f-.h.fl..E[.X...@.o?..H.A..I....(...`<......5...D../.....J.9.y.....`#.>V.H......2`.....N.%.gHjK...H:G.ql."0.#.#...U..Nc.{.rz{....,.vDpt......).^.X...../Z......Rc...Ibge...,..z|e....*..d.i'..P........... .qW...3.....M.l=L..-=..3.:.....;A...9..+...`.T.4.....aJ...[..,.~....K.:.`..q2^......"}-....a0........q..}......e.m.....PQ.......p@...o..2.r.. M..........|.#d.2.86@.J.m.I!..I.u........u..?#.....G.$.7..g.!V......c...M..l.+..e.D.n..#....LzUo.iub..K.....^...N.e.;.0.b..k.?...s....=z.h...)...\..}..c.....6.h*..S2.....<c.x.h7.

                                                                                          C:\Users\user\Desktop\DTBZGIOOSO\DTBZGIOOSO.docx.hKSE (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.855482415798298
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:XvXnwHC4Zk9vSoPLAAC6tO5V7qBgX/oFfnhf6t8ZUWNTEGqP3hnH:YiInSLnYkgXWSiNTps5
                                                                                          MD5:531AF8FE557A1AEC4909589B140A6CF0
                                                                                          SHA1:3893ADA1B21DAD3549F7760933CF933050B3D44A
                                                                                          SHA-256:DE8DCDED57D72D615E94D08589E0F1AD4B6B194762CCD1069F041E87F16BB39D
                                                                                          SHA-512:3D6BFCC45BA7AD8BB7ECF11805E7B5CE93DEC590CA8E9AA5381A88282AD081FB4E259EE6FED1A4FC8FD6B60B28298FBBE7B3702F7F05085D50A49E7F5218406C
                                                                                          Malicious:false
                                                                                          Preview:.....SzYC..eY.O:...I.j`....G0.k...^K...m..%i!q>.....h.f.b....t=v.^....^*.....*I.......>..&V.6....;.zq..'...l=C........c0...].d.....G.DD..g..d..r.[s.....jF...c6.f....B.,k.E..<4t.p......FM.<`=...2F.....n.>..K....`.!J.N#O.!K...n..C...l.[(YV.......E..:..T....?.....V.....T....kc...J0....hN.cK..u...g..v.R#]._.$.N+...S..m.....i$BFR.s...b..P..E.....>......9..U..H..u.......4..E...aR.F..fj..7-S....\..[...5..u.0:......._s.D@f-.h.fl..E[.X...@.o?..H.A..I....(...`<......5...D../.....J.9.y.....`#.>V.H......2`.....N.%.gHjK...H:G.ql."0.#.#...U..Nc.{.rz{....,.vDpt......).^.X...../Z......Rc...Ibge...,..z|e....*..d.i'..P........... .qW...3.....M.l=L..-=..3.:.....;A...9..+...`.T.4.....aJ...[..,.~....K.:.`..q2^......"}-....a0........q..}......e.m.....PQ.......p@...o..2.r.. M..........|.#d.2.86@.J.m.I!..I.u........u..?#.....G.$.7..g.!V......c...M..l.+..e.D.n..#....LzUo.iub..K.....^...N.e.;.0.b..k.?...s....=z.h...)...\..}..c.....6.h*..S2.....<c.x.h7.

                                                                                          C:\Users\user\Desktop\DTBZGIOOSO\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Desktop\DTBZGIOOSO\KATAXZVCPS.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.842476316343669
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:PUFCJTvFxQeSrkuog8jh5Pl+iv/XUwKAp1XFl/n95vv:P0CJZOhrogePMi3X7/1VlfHv
                                                                                          MD5:602680A54C07345466835256AF1C709A
                                                                                          SHA1:4C2DAA87001FE33AD298964A74084369C94F9A46
                                                                                          SHA-256:2E5B01674F9D3EB093531FC9A3A4FF475520E2B28F8A9FA70AD61531DF056135
                                                                                          SHA-512:BC2C922F231B355921CF478C3A731742F0F03E57FD0882B00592B972839467ADCB0E7A08F5A99B46D9A891EFD11320E261BB0D77C2B4982D7E946B8C6A6AE37C
                                                                                          Malicious:true
                                                                                          Preview:..ne."...a....Q......... .,...t.s.......C..o}'.,..v./...z.e...!.<r.^.f../7?.~.z....D..,..Kx.`e..Mq....HC.....c.9.i2R.KKC.. $.gXIZ.....~w7..z.AhX.D...~$H...L..I..5._.3.......XH..F,.......7........1ID..O......9c............x.......t.l..M3...5..}N._da..\...WI..E....4.2.B..T....bs.G.,<...1.xD.f..18.h|I)...:z"8/.t.v...1...:..W..f1.yf...3+.h..W.O.9..uq.4........*>..........2...,......m.2C4.Z&)..3I....4..` 3...... ...q.peEs...K..FH.<....K.......\...`m!...[}.3.......:4B..J~..........".;^..#....O.:?....s..j.W..VU.37..;=.J.F+.........}.l.....K..`...]..m.Q........j.#..DL....H..]P......T..J.y.....!.S..E..Q)%.z..X..z......5. B.6@r^{..s.%L...Q).RJ.D.........e..;.oe..?..~]......=BiY.#.6...!$.a...:).....z`...TE<....w..Z.Uy...{.YYfj..w.t.pvw.....J.......V.$@E=..=!Y5.}....3...,{...E..Y.d-.>.).N...]E....o1..._7.H.......8Gs.....z._..W..U..3G F=Uk..\.....A.]N.j.3.H.%U...8....Po.d{~.07..Z. ......fQ....m.&N.S^.9....Qr#...........r.'..AC.......{.-.H..

                                                                                          C:\Users\user\Desktop\DTBZGIOOSO\KATAXZVCPS.mp3.Oveg (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.842476316343669
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:PUFCJTvFxQeSrkuog8jh5Pl+iv/XUwKAp1XFl/n95vv:P0CJZOhrogePMi3X7/1VlfHv
                                                                                          MD5:602680A54C07345466835256AF1C709A
                                                                                          SHA1:4C2DAA87001FE33AD298964A74084369C94F9A46
                                                                                          SHA-256:2E5B01674F9D3EB093531FC9A3A4FF475520E2B28F8A9FA70AD61531DF056135
                                                                                          SHA-512:BC2C922F231B355921CF478C3A731742F0F03E57FD0882B00592B972839467ADCB0E7A08F5A99B46D9A891EFD11320E261BB0D77C2B4982D7E946B8C6A6AE37C
                                                                                          Malicious:false
                                                                                          Preview:..ne."...a....Q......... .,...t.s.......C..o}'.,..v./...z.e...!.<r.^.f../7?.~.z....D..,..Kx.`e..Mq....HC.....c.9.i2R.KKC.. $.gXIZ.....~w7..z.AhX.D...~$H...L..I..5._.3.......XH..F,.......7........1ID..O......9c............x.......t.l..M3...5..}N._da..\...WI..E....4.2.B..T....bs.G.,<...1.xD.f..18.h|I)...:z"8/.t.v...1...:..W..f1.yf...3+.h..W.O.9..uq.4........*>..........2...,......m.2C4.Z&)..3I....4..` 3...... ...q.peEs...K..FH.<....K.......\...`m!...[}.3.......:4B..J~..........".;^..#....O.:?....s..j.W..VU.37..;=.J.F+.........}.l.....K..`...]..m.Q........j.#..DL....H..]P......T..J.y.....!.S..E..Q)%.z..X..z......5. B.6@r^{..s.%L...Q).RJ.D.........e..;.oe..?..~]......=BiY.#.6...!$.a...:).....z`...TE<....w..Z.Uy...{.YYfj..w.t.pvw.....J.......V.$@E=..=!Y5.}....3...,{...E..Y.d-.>.).N...]E....o1..._7.H.......8Gs.....z._..W..U..3G F=Uk..\.....A.]N.j.3.H.%U...8....Po.d{~.07..Z. ......fQ....m.&N.S^.9....Qr#...........r.'..AC.......{.-.H..

                                                                                          C:\Users\user\Desktop\DTBZGIOOSO\ONBQCLYSPU.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.861619648427458
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:AZU0auAPxOUusdJNHnJAPJVrhWgwO4w7LteJOTYmfnPLb3SwlEAk102An2p5nca0:AZ99yA1sdLnAhWgwpOt/Tjb3ng10vO5w
                                                                                          MD5:E2E603667E57203290A1E2C30DF4C8C6
                                                                                          SHA1:A0A7F459C2C5A811CC7B7C76E91AD694D17F3C27
                                                                                          SHA-256:B6A503999E2CA5752BF563D00719D796DD0DEF3B3EC1E16D41362FCF9D19DE65
                                                                                          SHA-512:4A9408EEE3724C20B81FBADA8D38FE54745527DC7197F35F2A1D844923AD50E3CBDA46F41ABA1CE995508729D044F118C29D44860357C8D0BA8B9905D5A39004
                                                                                          Malicious:false
                                                                                          Preview:}.\p.0i.c_....6.-!.Qw.T.b..Id-.H..]..,.....fv#O...f......a.1..N.....)6*.....A5...Fi..... .GS<j.a...w.?...(=9_7V..m...C......sN..y.......B....l.....+~.WO[.....@.{.....d.u...l-g...g...},.H~...S6.)...9....6..7*..+.P...c?...V0......9SY..0.....gW....T..]u..:.b.S>.).@u.B....R?....H7R-........%m].i.f..%.Sa...I.oF...f.h..@.`.J.0...u.m......r...3}...Go.P...I7.;...m9....4.$....Y../....qr....P.4p...v/)..7..37...{y....H^1.Jy[.#...d.25*.Y.X$.Be...Z..S../..$.=.>m.+....2.tj...o.....!.&..\.sB.A.])..]O~}mE.9..!V........t6I......F.h.6_.y:....Y.<.T(..SO...~...At\5..`.O...q~OL..$4H...F.w,.N........Vst...xSc.......s.g*.\....?B..6....Z........"........gE..M.ln.P..."y...Hnl..H.%.f.kQ.z;.....R.t\..nl.......d0...Y....}.d!.s.....H.....e&.....0...<.....r........}.y..z....sM.#IG.>. .U.%.J....b......8u....s..'...I..R...a.@..}..$.v...Z..4u..`....8)....g.H...0.%.X3.I.c..{.t.fV.V.....W..N..'vfMUE.SI....6.eL..er.mO.*.,|v@.*....%.Dv.7..0.E:...^>.....k.O..i.

                                                                                          C:\Users\user\Desktop\DTBZGIOOSO\ONBQCLYSPU.pdf.sFnu (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.861619648427458
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:AZU0auAPxOUusdJNHnJAPJVrhWgwO4w7LteJOTYmfnPLb3SwlEAk102An2p5nca0:AZ99yA1sdLnAhWgwpOt/Tjb3ng10vO5w
                                                                                          MD5:E2E603667E57203290A1E2C30DF4C8C6
                                                                                          SHA1:A0A7F459C2C5A811CC7B7C76E91AD694D17F3C27
                                                                                          SHA-256:B6A503999E2CA5752BF563D00719D796DD0DEF3B3EC1E16D41362FCF9D19DE65
                                                                                          SHA-512:4A9408EEE3724C20B81FBADA8D38FE54745527DC7197F35F2A1D844923AD50E3CBDA46F41ABA1CE995508729D044F118C29D44860357C8D0BA8B9905D5A39004
                                                                                          Malicious:false
                                                                                          Preview:}.\p.0i.c_....6.-!.Qw.T.b..Id-.H..]..,.....fv#O...f......a.1..N.....)6*.....A5...Fi..... .GS<j.a...w.?...(=9_7V..m...C......sN..y.......B....l.....+~.WO[.....@.{.....d.u...l-g...g...},.H~...S6.)...9....6..7*..+.P...c?...V0......9SY..0.....gW....T..]u..:.b.S>.).@u.B....R?....H7R-........%m].i.f..%.Sa...I.oF...f.h..@.`.J.0...u.m......r...3}...Go.P...I7.;...m9....4.$....Y../....qr....P.4p...v/)..7..37...{y....H^1.Jy[.#...d.25*.Y.X$.Be...Z..S../..$.=.>m.+....2.tj...o.....!.&..\.sB.A.])..]O~}mE.9..!V........t6I......F.h.6_.y:....Y.<.T(..SO...~...At\5..`.O...q~OL..$4H...F.w,.N........Vst...xSc.......s.g*.\....?B..6....Z........"........gE..M.ln.P..."y...Hnl..H.%.f.kQ.z;.....R.t\..nl.......d0...Y....}.d!.s.....H.....e&.....0...<.....r........}.y..z....sM.#IG.>. .U.%.J....b......8u....s..'...I..R...a.@..}..$.v...Z..4u..`....8)....g.H...0.%.X3.I.c..{.t.fV.V.....W..N..'vfMUE.SI....6.eL..er.mO.*.,|v@.*....%.Dv.7..0.E:...^>.....k.O..i.

                                                                                          C:\Users\user\Desktop\DTBZGIOOSO\UMMBDNEQBN.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.871169906701737
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:qdN4HswYH9vwHhWDtJZ/b/v1/kVuanuozjnPPYVxr6KBrpykBCff1xAHZMtGV0Y:qIHswNotz/vwuozbIxGgTC4MtGV5
                                                                                          MD5:C8B6E0EF822E600F26CAC06E7FB314FB
                                                                                          SHA1:170F0871696B91309357B289F0EFA5427EA68FE6
                                                                                          SHA-256:E02B5C37C08A9BC8C1DC037C022909C46090210E0B45923CF220C662F457E548
                                                                                          SHA-512:7BBAE884F5F69594BCD33A8A2005FE2D866A8D2923A4DBB927422B0DCAC0AC9C4B731257542CA263D4DE9C4A0B5B9E4FE99C76DDF04EEDEEF63AC1A11D9E20EF
                                                                                          Malicious:false
                                                                                          Preview:.r{i.R.$.......U.Y....N.N.[.....v...........{....I.9.ys-......a..K6J.U..'....`...G`v....e...$.0..7.hx...Bt..f.iTv.`.'.:j......n.(.*..Nya<&..l>...H.[^?.y.....M....G.<.;Y..!rGe...NN.o.........QG...E3xLK.L..V8u.%s..2.1*.oY.w..#.*..?).5....D.v.ea.w.V...4..Sj.W......l..;....9..#t..].,3l....X.....7R.e.g[sG.. r..J.).M..O..@S.. A...?........Y2...l.5.....).C...}...... ..|...C}..6.9..6t..~."6.R..I...P..E_.~.68.]).L4.@.X..{..,......2..it.e...~Gg.1^..>....I.#&..i..0..Yj.T...*.dOe.].e.. ..'WjQ.....)C.p..9-m...CW..mi....$t..nK.e...,T.^FR..zw.L.M..~O}$..q..SU%..so.$...^........Or!0.i.*...J...#....-......D...\f.X..~`H.5...W...S.k./...Pe;..\a.|....................3\.Z.smN.j/#.pG.Q........n...j........t.$.).R..L4.......">..8..D9tt<k.*.By...9.....Y..w......W.....<.....s+.... .T...)=....1..j..Y.'G..O..9..z..............2...X.Y\Q.....2...<.qq...5..a...,A)uO.@..T..M.X../...3.8.........f..)..X...o.....P...;CL..<....&......p.....maK].3Q.3#.hL..t..9t.='....=p.W7..a

                                                                                          C:\Users\user\Desktop\DTBZGIOOSO\UMMBDNEQBN.png.erQk (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.871169906701737
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:qdN4HswYH9vwHhWDtJZ/b/v1/kVuanuozjnPPYVxr6KBrpykBCff1xAHZMtGV0Y:qIHswNotz/vwuozbIxGgTC4MtGV5
                                                                                          MD5:C8B6E0EF822E600F26CAC06E7FB314FB
                                                                                          SHA1:170F0871696B91309357B289F0EFA5427EA68FE6
                                                                                          SHA-256:E02B5C37C08A9BC8C1DC037C022909C46090210E0B45923CF220C662F457E548
                                                                                          SHA-512:7BBAE884F5F69594BCD33A8A2005FE2D866A8D2923A4DBB927422B0DCAC0AC9C4B731257542CA263D4DE9C4A0B5B9E4FE99C76DDF04EEDEEF63AC1A11D9E20EF
                                                                                          Malicious:false
                                                                                          Preview:.r{i.R.$.......U.Y....N.N.[.....v...........{....I.9.ys-......a..K6J.U..'....`...G`v....e...$.0..7.hx...Bt..f.iTv.`.'.:j......n.(.*..Nya<&..l>...H.[^?.y.....M....G.<.;Y..!rGe...NN.o.........QG...E3xLK.L..V8u.%s..2.1*.oY.w..#.*..?).5....D.v.ea.w.V...4..Sj.W......l..;....9..#t..].,3l....X.....7R.e.g[sG.. r..J.).M..O..@S.. A...?........Y2...l.5.....).C...}...... ..|...C}..6.9..6t..~."6.R..I...P..E_.~.68.]).L4.@.X..{..,......2..it.e...~Gg.1^..>....I.#&..i..0..Yj.T...*.dOe.].e.. ..'WjQ.....)C.p..9-m...CW..mi....$t..nK.e...,T.^FR..zw.L.M..~O}$..q..SU%..so.$...^........Or!0.i.*...J...#....-......D...\f.X..~`H.5...W...S.k./...Pe;..\a.|....................3\.Z.smN.j/#.pG.Q........n...j........t.$.).R..L4.......">..8..D9tt<k.*.By...9.....Y..w......W.....<.....s+.... .T...)=....1..j..Y.'G..O..9..z..............2...X.Y\Q.....2...<.qq...5..a...,A)uO.@..T..M.X../...3.8.........f..)..X...o.....P...;CL..<....&......p.....maK].3Q.3#.hL..t..9t.='....=p.W7..a

                                                                                          C:\Users\user\Desktop\DTBZGIOOSO\VLZDGUKUTZ.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.848641798814515
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Ys9t02So5f+QK1dqny3LAHfLs0lujQpZyRjgkR5EQeuYllET4Vg3L:Ys9t02StbAVffeckR5EXCb
                                                                                          MD5:370820D490B86E09E3200FFC8AA5EDCD
                                                                                          SHA1:DEE67182BAEFCA7777E12FDAD6335CB8556533AE
                                                                                          SHA-256:0050EF5E5324938709C5B17CAFBB5C09CCAAE3544CCF65C670728B558F015010
                                                                                          SHA-512:1AD94A0FB91E4C972B14FEAEE60E520089E0A1B0B9467293500A7E12D6827CC36B54539FBEDCDE3304B446174C9B8EB3AA9292640A21C010F01A04E8D415BDB2
                                                                                          Malicious:false
                                                                                          Preview:.....h,.ts).......;...H.x....VM.3.YNO.MT.U1........)...2*...z.....Z....)#Uu.L.P.t.QA..F..x....?I.DEQ...E....(z..~..H...zA'...R.;...2.=..5..;|..:..i/....U9V..C.BX.....f7........+.IsQ.E5f..=....l....|.m..e.E.^..r........6#z...X.....Vr./.dK..o...^|.m..Yx!...L.m..<....\'g7.bn.H.O.%w`.t.#...YR.p.q3.....J. ...Q.-...!..G.b......7wm+.G.......`N.....I....U..4..W..iM.....M.......Wy.sW..Uw.@.\.=...{....d.;v}a.4.tm9J.2.i.bj...>....qY..}'..Ty.q;..x{...=........2.q|...#4.g..|j.c.]..,.`.B.v\.\..5.'.b..U..H"...\.):."....k3..b.t.!....K.'...".B....cyp.c..GW3R.`....4.N.Y..W...,.....Q..vp*O.....P...ks....^..*.. `....><4|..&.;Kp8.<......hW.$....'p....sK.>b....U.q...*..42/.s...f).c.L5...|..x.T..4<....i.R%......m.....d*g....)....l..)B...F.l..f........;.T..Xh........-...O.....Zo.........fd...v.Ju.ez...[..].tg.^1.M..u][Y.a....../......_...8*....;...W"....3...z..9.L.cw.rU...En5..~.0...*....#...Q..M.;.....w..H$T[...B. .bF...p....mb./C(....y>vN.3.m..b..2..5..#.?..l.

                                                                                          C:\Users\user\Desktop\DTBZGIOOSO\VLZDGUKUTZ.jpg.ksUw (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.848641798814515
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Ys9t02So5f+QK1dqny3LAHfLs0lujQpZyRjgkR5EQeuYllET4Vg3L:Ys9t02StbAVffeckR5EXCb
                                                                                          MD5:370820D490B86E09E3200FFC8AA5EDCD
                                                                                          SHA1:DEE67182BAEFCA7777E12FDAD6335CB8556533AE
                                                                                          SHA-256:0050EF5E5324938709C5B17CAFBB5C09CCAAE3544CCF65C670728B558F015010
                                                                                          SHA-512:1AD94A0FB91E4C972B14FEAEE60E520089E0A1B0B9467293500A7E12D6827CC36B54539FBEDCDE3304B446174C9B8EB3AA9292640A21C010F01A04E8D415BDB2
                                                                                          Malicious:false
                                                                                          Preview:.....h,.ts).......;...H.x....VM.3.YNO.MT.U1........)...2*...z.....Z....)#Uu.L.P.t.QA..F..x....?I.DEQ...E....(z..~..H...zA'...R.;...2.=..5..;|..:..i/....U9V..C.BX.....f7........+.IsQ.E5f..=....l....|.m..e.E.^..r........6#z...X.....Vr./.dK..o...^|.m..Yx!...L.m..<....\'g7.bn.H.O.%w`.t.#...YR.p.q3.....J. ...Q.-...!..G.b......7wm+.G.......`N.....I....U..4..W..iM.....M.......Wy.sW..Uw.@.\.=...{....d.;v}a.4.tm9J.2.i.bj...>....qY..}'..Ty.q;..x{...=........2.q|...#4.g..|j.c.]..,.`.B.v\.\..5.'.b..U..H"...\.):."....k3..b.t.!....K.'...".B....cyp.c..GW3R.`....4.N.Y..W...,.....Q..vp*O.....P...ks....^..*.. `....><4|..&.;Kp8.<......hW.$....'p....sK.>b....U.q...*..42/.s...f).c.L5...|..x.T..4<....i.R%......m.....d*g....)....l..)B...F.l..f........;.T..Xh........-...O.....Zo.........fd...v.Ju.ez...[..].tg.^1.M..u][Y.a....../......_...8*....;...W"....3...z..9.L.cw.rU...En5..~.0...*....#...Q..M.;.....w..H$T[...B. .bF...p....mb./C(....y>vN.3.m..b..2..5..#.?..l.

                                                                                          C:\Users\user\Desktop\DTBZGIOOSO\XZXHAVGRAG.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8653242733162445
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Qh52C6PfU+YnwJXgWcOp7fn8mGAwnB8ZfAkkp/R9pJiX+p7XQK3a2zoeRs1p80h/:Qhgd3UnwXgWhpD4AyBHkg/PT2al3nzo9
                                                                                          MD5:97405517346FAF5936D04398E236D056
                                                                                          SHA1:3D59B2FD65CF874660FFF211BCEF8C0805E40DD6
                                                                                          SHA-256:2C324A7A52B82FFE5C1524929870A3FBA7F28D90BBAEBB6745B4378ADA67CB06
                                                                                          SHA-512:1311FB9C675E625DA84C7B54114A08FC0D19B20B802B7283505A012415954506908FEF6A70643EA8704347E6F969D2963ADF9FDB2EA4391F9F0F2F04291DBE7B
                                                                                          Malicious:false
                                                                                          Preview:..../u...u...~f3H..!...H..<..!../..:.?WLP...z.s..ndu..-X.S1.M.6.."....#rzK(..T.....4..ts..t..i..z..9...2...[..s...5...p...T....b.rl...E"...v.$.1TA>..8...m..'...........Y.E....|...C.?..d..c...x.....Vr..%.)../O}.^p....+...C...K]...~.F.#o8.r}T.c.S..L....m.>..]....*./.uB...J.9.sgI.e....{R..B..aW..V....?.,Md..F>....>......1...C...r.u.....Bk.s...J|...}d.....].a.=./....js..L0o[U.#....Y..s.."... P...O.#%.&.[&C...@O..w...[......p..t{Y^.&.....x"......\.U@..7o......CK.-.....L..z......i2...t.....B,.....kk...6 ..Jd.....{*F..'.T[....0T.D...<.X.:{.\;......l58.Q..dg.*......8f.T..IW"...vF.....I.6MO..?.........Q.+{.._.u..._..e8q...}.a..s.u..*..Y....!^X[a..%|U...n'.....Q.............Kv..z..Xi..-Gn.^...~....z..)......U&.j.*.L....zL..Q.....d.1y9.W..>H..m..|2.t8..]}......G*a.$9.?..C.......(...3.$B#....q....)&TM...}.rt.B...B...E.^(....X..y0...6....=..0...].n :...4bW.qC...$.Xb3&..@B.Wf].b....S..$.>.t..$..c.a.3..{.8u&..N...E.N..\6..G<...Dj.....9.7c.....

                                                                                          C:\Users\user\Desktop\DTBZGIOOSO\XZXHAVGRAG.xlsx.AUHp (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8653242733162445
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Qh52C6PfU+YnwJXgWcOp7fn8mGAwnB8ZfAkkp/R9pJiX+p7XQK3a2zoeRs1p80h/:Qhgd3UnwXgWhpD4AyBHkg/PT2al3nzo9
                                                                                          MD5:97405517346FAF5936D04398E236D056
                                                                                          SHA1:3D59B2FD65CF874660FFF211BCEF8C0805E40DD6
                                                                                          SHA-256:2C324A7A52B82FFE5C1524929870A3FBA7F28D90BBAEBB6745B4378ADA67CB06
                                                                                          SHA-512:1311FB9C675E625DA84C7B54114A08FC0D19B20B802B7283505A012415954506908FEF6A70643EA8704347E6F969D2963ADF9FDB2EA4391F9F0F2F04291DBE7B
                                                                                          Malicious:false
                                                                                          Preview:..../u...u...~f3H..!...H..<..!../..:.?WLP...z.s..ndu..-X.S1.M.6.."....#rzK(..T.....4..ts..t..i..z..9...2...[..s...5...p...T....b.rl...E"...v.$.1TA>..8...m..'...........Y.E....|...C.?..d..c...x.....Vr..%.)../O}.^p....+...C...K]...~.F.#o8.r}T.c.S..L....m.>..]....*./.uB...J.9.sgI.e....{R..B..aW..V....?.,Md..F>....>......1...C...r.u.....Bk.s...J|...}d.....].a.=./....js..L0o[U.#....Y..s.."... P...O.#%.&.[&C...@O..w...[......p..t{Y^.&.....x"......\.U@..7o......CK.-.....L..z......i2...t.....B,.....kk...6 ..Jd.....{*F..'.T[....0T.D...<.X.:{.\;......l58.Q..dg.*......8f.T..IW"...vF.....I.6MO..?.........Q.+{.._.u..._..e8q...}.a..s.u..*..Y....!^X[a..%|U...n'.....Q.............Kv..z..Xi..-Gn.^...~....z..)......U&.j.*.L....zL..Q.....d.1y9.W..>H..m..|2.t8..]}......G*a.$9.?..C.......(...3.$B#....q....)&TM...}.rt.B...B...E.^(....X..y0...6....=..0...].n :...4bW.qC...$.Xb3&..@B.Wf].b....S..$.>.t..$..c.a.3..{.8u&..N...E.N..\6..G<...Dj.....9.7c.....

                                                                                          C:\Users\user\Desktop\DVWHKMNFNN.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.816246751422915
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:CBSnc+9mA8it6ohZmpc1A2vcLrpA66Vrp/RfrPboTC7de/:CBkDo6soipFmcfteZfrPbouRe/
                                                                                          MD5:53CCD05490F792754E24286556AA5737
                                                                                          SHA1:EF711194914F7CC0757445078604E56C171F7226
                                                                                          SHA-256:200F965B977B722E53FD6257E9969B5223D4ED57A40760CDC630D165133F1D99
                                                                                          SHA-512:6ADE13A2F5FCFB00109D836DBC4E193891E5A34A66D918B7EB464F627956941AD476210C234D9D583C24600D7A0B17B09238B59C3B6404632E224D57C4DF3210
                                                                                          Malicious:true
                                                                                          Preview:(x..q..~...~.(.8.6.......fR.=..1..!N5f7.-...4..I.k..S.M....,.}.i..F...%..$.$.......l..T.;..{6..)...M.(..U.p.V=.zY.M:....u...EZq.....1>...M..-||.IP..!X!.....%..?<.=p...{%.l..$[.7...,d.[<..|....).?1]z....B.Z.[.e.7....MQ..`).....6....[b....Kjr.....;KS.(..>}.2.L...1.Y..9kwK..u.9I.|.]+Wm....N.....(.A..Ok...?O} cA7.N..........:..p.&...u.S.p............>..@Q.rP/"e....:I7G..lW...w.W3wU.....s.1_r..=...H.q.;.p.DE.=......G....O..K..M.=.n..s...!H..>.w./I0.........oT..+.W....P...w4.6.>R..Y.......ja..<5.yk.&....6..z..'.\=..&..`p........:..j.m ........]..(...$...b..w%.,....S~....!zA....l.38bH!.......~...IQ.}G..q...&...Av.kI....8".{...i.[...^6...e....D..E...........t2.u =...!.=...../.Z..v...!.6.{/.{zaCD...-...G...F..e.X...M.T..4A;........ZQ.s..c...@....Y..2....#..]....5......x..2...Uo.>.+.4.X...^.f.}.X,....p......7...I.......=,...,}..C.]..:VJA"s8+... .n..&+.R}S{.YsN.u.]...E]g.._"4.#.k../..a41.Uk..xS.....m.......ax.{./......E...#....,...2Ef.....X\.?

                                                                                          C:\Users\user\Desktop\DVWHKMNFNN.jpg.gosw (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.816246751422915
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:CBSnc+9mA8it6ohZmpc1A2vcLrpA66Vrp/RfrPboTC7de/:CBkDo6soipFmcfteZfrPbouRe/
                                                                                          MD5:53CCD05490F792754E24286556AA5737
                                                                                          SHA1:EF711194914F7CC0757445078604E56C171F7226
                                                                                          SHA-256:200F965B977B722E53FD6257E9969B5223D4ED57A40760CDC630D165133F1D99
                                                                                          SHA-512:6ADE13A2F5FCFB00109D836DBC4E193891E5A34A66D918B7EB464F627956941AD476210C234D9D583C24600D7A0B17B09238B59C3B6404632E224D57C4DF3210
                                                                                          Malicious:false
                                                                                          Preview:(x..q..~...~.(.8.6.......fR.=..1..!N5f7.-...4..I.k..S.M....,.}.i..F...%..$.$.......l..T.;..{6..)...M.(..U.p.V=.zY.M:....u...EZq.....1>...M..-||.IP..!X!.....%..?<.=p...{%.l..$[.7...,d.[<..|....).?1]z....B.Z.[.e.7....MQ..`).....6....[b....Kjr.....;KS.(..>}.2.L...1.Y..9kwK..u.9I.|.]+Wm....N.....(.A..Ok...?O} cA7.N..........:..p.&...u.S.p............>..@Q.rP/"e....:I7G..lW...w.W3wU.....s.1_r..=...H.q.;.p.DE.=......G....O..K..M.=.n..s...!H..>.w./I0.........oT..+.W....P...w4.6.>R..Y.......ja..<5.yk.&....6..z..'.\=..&..`p........:..j.m ........]..(...$...b..w%.,....S~....!zA....l.38bH!.......~...IQ.}G..q...&...Av.kI....8".{...i.[...^6...e....D..E...........t2.u =...!.=...../.Z..v...!.6.{/.{zaCD...-...G...F..e.X...M.T..4A;........ZQ.s..c...@....Y..2....#..]....5......x..2...Uo.>.+.4.X...^.f.}.X,....p......7...I.......=,...,}..C.]..:VJA"s8+... .n..&+.R}S{.YsN.u.]...E]g.._"4.#.k../..a41.Uk..xS.....m.......ax.{./......E...#....,...2Ef.....X\.?

                                                                                          C:\Users\user\Desktop\DVWHKMNFNN\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Desktop\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Desktop\HTAGVDFUIE\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Desktop\JSDNGYCOWY\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Desktop\KATAXZVCPS.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.841978687910662
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:R/n75ukOUay94OlfhhMvQnP5QE0ieSdkN2FjQtTUcueBAvp9npJ:x5DVzlfhhMvQyYeEpjQBu9vXL
                                                                                          MD5:45E370B22B358CD27127CD0542233FD3
                                                                                          SHA1:AF2A37ED4931A743FA5B36D9D3CE0DEE3FD90F8C
                                                                                          SHA-256:0B0C8E89CD7A8FD08B069A248609C9B0E1810DB0C5937B080A1B50E83DDAA96E
                                                                                          SHA-512:A658750CA8ED8FB658218748CB0977E405D6EA257A3F1F88B672F518F46EA30CDBE29A6734DD5F2C8F5B3DC95E14E0496569AB62F2D795161560A349ED021B16
                                                                                          Malicious:false
                                                                                          Preview:z...Mj..,f.D.t....=......R....p.X.C........h..T:..Q....D.W....)o....;D."%..I.r>......l.....IT..:... .2(.x...-.&.....O.T...F.......1|..~...`6*|.....=./.W.My@B.V.uD)...a>..OX`hz.<..f:.8p~..>.+.v...\.$h.k=.....v. .+m...........L...AU.....%..R...+.4|..A.."...q.n.....sg.U[.#..6~.7W.G..X./..Z.S/..z..F......\.R..pcd.j.-Z.^t..J.6.I^TU/..z... .?,......Zg.cY].ar>Y1.3.C..1.....y.&......x....... .c.\.KWP....kY.i+......lV $oc.b(..Y...s.0..I...Q?T?.........H.k.............-.&1l.l..R8[.....{...s.U.cY3]...u....L2.<!K.y......{e}$..l.+.........%"...C..oz.W0....9.6.z..x).b.....h4.f..u&.Z..!...0}>im.........{K....S...*mH.._q.-nZ.\~7.....\...C....TO..J. ...8...(....g........w22{...D.r.HG'R-8..7i......%d...<.@.V....qO.q...H.s]m.dLq.9.&A1...x.]..0..o;2...:.x...@..Q..T..a.od..5w.`$.|...H*qN../..iB*J,.U.q.....j.xH.'.........!`..n....U.. a.[..k....*5.Ys..4..\P.Q...T.%..n.y4.TqU...Ug.+....8l#A.r../Y..O..@.0.N:..=.7.<Zg....P.. Bk$......].Os/e..>...4...

                                                                                          C:\Users\user\Desktop\KATAXZVCPS.mp3.Yqsp (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.841978687910662
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:R/n75ukOUay94OlfhhMvQnP5QE0ieSdkN2FjQtTUcueBAvp9npJ:x5DVzlfhhMvQyYeEpjQBu9vXL
                                                                                          MD5:45E370B22B358CD27127CD0542233FD3
                                                                                          SHA1:AF2A37ED4931A743FA5B36D9D3CE0DEE3FD90F8C
                                                                                          SHA-256:0B0C8E89CD7A8FD08B069A248609C9B0E1810DB0C5937B080A1B50E83DDAA96E
                                                                                          SHA-512:A658750CA8ED8FB658218748CB0977E405D6EA257A3F1F88B672F518F46EA30CDBE29A6734DD5F2C8F5B3DC95E14E0496569AB62F2D795161560A349ED021B16
                                                                                          Malicious:false
                                                                                          Preview:z...Mj..,f.D.t....=......R....p.X.C........h..T:..Q....D.W....)o....;D."%..I.r>......l.....IT..:... .2(.x...-.&.....O.T...F.......1|..~...`6*|.....=./.W.My@B.V.uD)...a>..OX`hz.<..f:.8p~..>.+.v...\.$h.k=.....v. .+m...........L...AU.....%..R...+.4|..A.."...q.n.....sg.U[.#..6~.7W.G..X./..Z.S/..z..F......\.R..pcd.j.-Z.^t..J.6.I^TU/..z... .?,......Zg.cY].ar>Y1.3.C..1.....y.&......x....... .c.\.KWP....kY.i+......lV $oc.b(..Y...s.0..I...Q?T?.........H.k.............-.&1l.l..R8[.....{...s.U.cY3]...u....L2.<!K.y......{e}$..l.+.........%"...C..oz.W0....9.6.z..x).b.....h4.f..u&.Z..!...0}>im.........{K....S...*mH.._q.-nZ.\~7.....\...C....TO..J. ...8...(....g........w22{...D.r.HG'R-8..7i......%d...<.@.V....qO.q...H.s]m.dLq.9.&A1...x.]..0..o;2...:.x...@..Q..T..a.od..5w.`$.|...H*qN../..iB*J,.U.q.....j.xH.'.........!`..n....U.. a.[..k....*5.Ys..4..\P.Q...T.%..n.y4.TqU...Ug.+....8l#A.r../Y..O..@.0.N:..=.7.<Zg....P.. Bk$......].Os/e..>...4...

                                                                                          C:\Users\user\Desktop\KATAXZVCPS.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8486242661184
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:83jkXZCk4b0tvRKUpozpgypRPXzoc2b7j6dUXtxUOrdXULNyQWryVKhkDVHy:832Ck4bsvRKUpkTzPDoc2L66XrUOuLNM
                                                                                          MD5:E761C2E2ACEB74BB3FC57E2718F4FE8F
                                                                                          SHA1:E0EAF9BF63B4DA900FB306CE70442360B29B03D8
                                                                                          SHA-256:F825C30055AEEB7293350BAB6188B690E0FC0554B53A6E400C53EE0F5FCA4AB9
                                                                                          SHA-512:7209259AAE8CE7D0AED59438D5915516734B82AB55C2DBC4DD4E62687600DB28E6D6FECC2D88177F4A48DF274CB452E415948C267B98AC83899568A2AFCFDAD4
                                                                                          Malicious:false
                                                                                          Preview:G.....WgWUg._/.P....\p...VX._........P......S....l.k#....lkO...,......4........w..;..V..:.)...c.hI..fw.H....$.u..}.n...xr...q....<...@..>....KL....H..+..."$....v..^..Cm.8N..~....:n.&.u."...N....Iw..+=-'.q.NF.f..I."....o.9.....}H..@.'...\.kv..>..a.hX..q.;.o..0...0..B.1.y..S.....#_.Tb..`@v...sz..V..(....2<d......,.n...DNY.n...,J-.7..(D.........#....[Q..dUE....v=....4b.Y.(*."..>.....s.3...|......F.f.c.':L7...j..BA.].<1..X...T%h.Z.w..sGi.q.B......`YK..T.M.pnL...O...;.+....s..9.WV,..R.H.lIoa.fL.fzJ........7...I....U+...*.0...ybSm...Nc...[..l.v.k..^..h..@.........%.....#.}.44./.E..;....sGw.....l.eI|.g.......{...M.....Q..C.}.+Lxa.....Ok..I....1...Bv..\;......@[..-..2.$\Twpb).Tw.......$.N.........m.w.vH.....\.5.tZ.(.L..../.Wx.p..}.5M....D.ZQ....l.;..."`Ea.........0.=.z.;zcf.....m{......t...*.5k....Y..vg.N.v-.j/ ........k.....S..v.G.:.=...B.D.!6......SN>Wu.+.".{Q...dHh...O....=O.Gc.a..{....Z..3{.T"...:U......1\......5.n].....w..x.

                                                                                          C:\Users\user\Desktop\KATAXZVCPS.pdf.krtS (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8486242661184
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:83jkXZCk4b0tvRKUpozpgypRPXzoc2b7j6dUXtxUOrdXULNyQWryVKhkDVHy:832Ck4bsvRKUpkTzPDoc2L66XrUOuLNM
                                                                                          MD5:E761C2E2ACEB74BB3FC57E2718F4FE8F
                                                                                          SHA1:E0EAF9BF63B4DA900FB306CE70442360B29B03D8
                                                                                          SHA-256:F825C30055AEEB7293350BAB6188B690E0FC0554B53A6E400C53EE0F5FCA4AB9
                                                                                          SHA-512:7209259AAE8CE7D0AED59438D5915516734B82AB55C2DBC4DD4E62687600DB28E6D6FECC2D88177F4A48DF274CB452E415948C267B98AC83899568A2AFCFDAD4
                                                                                          Malicious:false
                                                                                          Preview:G.....WgWUg._/.P....\p...VX._........P......S....l.k#....lkO...,......4........w..;..V..:.)...c.hI..fw.H....$.u..}.n...xr...q....<...@..>....KL....H..+..."$....v..^..Cm.8N..~....:n.&.u."...N....Iw..+=-'.q.NF.f..I."....o.9.....}H..@.'...\.kv..>..a.hX..q.;.o..0...0..B.1.y..S.....#_.Tb..`@v...sz..V..(....2<d......,.n...DNY.n...,J-.7..(D.........#....[Q..dUE....v=....4b.Y.(*."..>.....s.3...|......F.f.c.':L7...j..BA.].<1..X...T%h.Z.w..sGi.q.B......`YK..T.M.pnL...O...;.+....s..9.WV,..R.H.lIoa.fL.fzJ........7...I....U+...*.0...ybSm...Nc...[..l.v.k..^..h..@.........%.....#.}.44./.E..;....sGw.....l.eI|.g.......{...M.....Q..C.}.+Lxa.....Ok..I....1...Bv..\;......@[..-..2.$\Twpb).Tw.......$.N.........m.w.vH.....\.5.tZ.(.L..../.Wx.p..}.5M....D.ZQ....l.;..."`Ea.........0.=.z.;zcf.....m{......t...*.5k....Y..vg.N.v-.j/ ........k.....S..v.G.:.=...B.D.!6......SN>Wu.+.".{Q...dHh...O....=O.Gc.a..{....Z..3{.T"...:U......1\......5.n].....w..x.

                                                                                          C:\Users\user\Desktop\KATAXZVCPS.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8480091176358515
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:2nUmzSaJN95cSIO9tATGjZvGTJ52W4pGzX2X/BkDaE25yXjw2:2nVzt9ebOvgGjRYz2fPKD66w2
                                                                                          MD5:8A6B31C2649C80C290E72E00F4946AD0
                                                                                          SHA1:8F9F1CDC684DF48F922D44EC21526ACD51AD1043
                                                                                          SHA-256:5A04662C252F78110EACA14F8F250997F0E964CE1BFB7BD7FCC4EF074FE3F450
                                                                                          SHA-512:ED2C74007C25C8E8EE0C16B2DD1571096F468FCE7BC83C43CFBF3F426C4595C8979E6F9B25AC20482A6225B2A9C2C8A15269D8007D3E9F0220F19F453E4254C2
                                                                                          Malicious:false
                                                                                          Preview:.(m.d...;C....(.i.n..1...Iu..=l...^-h`..`*o.'&..]..:...l.{....{.3=..s.*...]..........\r_;m>!Y<@a.*`....s"B.9"..;.x.,q.<....,.7.$......H~..>...z......0.$..GnXL.....j;s'.o1..-e}...........y:..}U".Q... }...c'....l.>..x$....B../.p=..U.Sn.(R...8.......Q....1......a\.5dV.4.....\.Y.5D.6P/./..._.8.Up.KR.....R]..Y....s/.....1....B.dU6.zD....c....Ip..G.k.2....kM....|]......t!!..7.1.5Q5x..th.4.1.tM...a..C.."WkDT.0.9..v)6.^....B.B.H...."_..`.P..h .0........9.I.............>4...Z7..GW.......N.D.cQm..3^.......({.L;G.......^...H!..@..>..ab..-!.Ka4..[...U..v66l.Dw6..)..o(0..^...IC...&>..T...Z(....)..&...'.*....^K.H..g#I..1..N.E.u...?.....5v.........bn."..)M.c=.}...d.Z........@............?.[*.PqM...)..^:.p.......=,.]..q..!k.t..b.C.....@+../.....t..]m...}%..v<..P&.;hxq..u..p.0.B*AE...4...2....'..$#u..A.H.E....d.]x|4..k..>.P.......`.........=.|rC.~..a..~t........w<].2.<>.6>..`.:/...+.~...^........B.,.S.PV.y...V..k/;.!...zP...n'^Pk..a.<...m#[......4_b.E.........".

                                                                                          C:\Users\user\Desktop\KATAXZVCPS.xlsx.vJor (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8480091176358515
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:2nUmzSaJN95cSIO9tATGjZvGTJ52W4pGzX2X/BkDaE25yXjw2:2nVzt9ebOvgGjRYz2fPKD66w2
                                                                                          MD5:8A6B31C2649C80C290E72E00F4946AD0
                                                                                          SHA1:8F9F1CDC684DF48F922D44EC21526ACD51AD1043
                                                                                          SHA-256:5A04662C252F78110EACA14F8F250997F0E964CE1BFB7BD7FCC4EF074FE3F450
                                                                                          SHA-512:ED2C74007C25C8E8EE0C16B2DD1571096F468FCE7BC83C43CFBF3F426C4595C8979E6F9B25AC20482A6225B2A9C2C8A15269D8007D3E9F0220F19F453E4254C2
                                                                                          Malicious:false
                                                                                          Preview:.(m.d...;C....(.i.n..1...Iu..=l...^-h`..`*o.'&..]..:...l.{....{.3=..s.*...]..........\r_;m>!Y<@a.*`....s"B.9"..;.x.,q.<....,.7.$......H~..>...z......0.$..GnXL.....j;s'.o1..-e}...........y:..}U".Q... }...c'....l.>..x$....B../.p=..U.Sn.(R...8.......Q....1......a\.5dV.4.....\.Y.5D.6P/./..._.8.Up.KR.....R]..Y....s/.....1....B.dU6.zD....c....Ip..G.k.2....kM....|]......t!!..7.1.5Q5x..th.4.1.tM...a..C.."WkDT.0.9..v)6.^....B.B.H...."_..`.P..h .0........9.I.............>4...Z7..GW.......N.D.cQm..3^.......({.L;G.......^...H!..@..>..ab..-!.Ka4..[...U..v66l.Dw6..)..o(0..^...IC...&>..T...Z(....)..&...'.*....^K.H..g#I..1..N.E.u...?.....5v.........bn."..)M.c=.}...d.Z........@............?.[*.PqM...)..^:.p.......=,.]..q..!k.t..b.C.....@+../.....t..]m...}%..v<..P&.;hxq..u..p.0.B*AE...4...2....'..$#u..A.H.E....d.]x|4..k..>.P.......`.........=.|rC.~..a..~t........w<].2.<>.6>..`.:/...+.~...^........B.,.S.PV.y...V..k/;.!...zP...n'^Pk..a.<...m#[......4_b.E.........".

                                                                                          C:\Users\user\Desktop\LTKMYBSEYZ.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.832153207190403
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:nRSNK/1Mh3/Kqq3sSU0IvHlpyhIqqLmB6oaiB3uiFabCL65F2C9Ew:R00+hvKqq3sSEvFpJ00iNXAA6H2+Ew
                                                                                          MD5:E534A9AD6876871121537656B0291393
                                                                                          SHA1:1AFFC9783BBB28D8FB7266075C9E4A44D21AE21D
                                                                                          SHA-256:11B13F3FC2C762608C30D0012F033519A63DFFE1C70CC4882D8B62131000DD97
                                                                                          SHA-512:1FF8B6C53B449E132734F89A15B1F9443A83405A2B1219BA54B027871CFB63D0DDE4539A000916ECBF711A05E847627B72E98B5A35C95C6AD8FF5E7754330BEF
                                                                                          Malicious:false
                                                                                          Preview:.S...~..o.T@.Uj.F..3..O....h../....j6?.:...].4/.7.....4.f..8.../....=v.L{\..1...$....13/..736....%qx.<....^.X7)6Z+....hh..Z^.....8n&......@.......X.....X/.@5.#..*....-..4...;.(.>w.Z.Q...7....6w#.H.....mt...>..1..0Z..B....C..'>..}..G|!....h..D..M.A.... r...&......~Qd..-#kHih*.Z).=c..f...y.....*...E.7.T\....4.......:S.>2..gq.1.lR...$F0.B.$...2k/...dw.|a5..>..!F.$........).m=.<X...P../.P...w.OLm.%V..+..G.p..b{.C......K..m.y.FSB...I..Z..4....){....=.......U..SJZ..<+(....2.g..G..l.....430.j=EN.....p......D..QR....Q3Ytn...\H>N../.:..m|y."..J.#=\......b....S6.....9.d.3.a..YB...C.;1,..s\...LO+..i.L9}......+........2Gk8{h...2.....u..n....o...pV..tV...}$.A.<7'F...n.A..G.D7Y...7..D..a..u..T.....a..&\:.d..ej.hk./x"....PK .z\.!p.>.u..P...|.l..%......^..\...9...Q.W..*......u.D).qP...q.Qlg....t..p........LUta.t...|.p.s....@O^.GwxS."...B...6'D....Tz..B..sv......g.......n..@.Nq..K/p..b.r..5....`....#.z.4j..C|...n(...+Y..&.....'.m BQ...b..Z.T3L`m'.zW.

                                                                                          C:\Users\user\Desktop\LTKMYBSEYZ.pdf.JlME (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.832153207190403
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:nRSNK/1Mh3/Kqq3sSU0IvHlpyhIqqLmB6oaiB3uiFabCL65F2C9Ew:R00+hvKqq3sSEvFpJ00iNXAA6H2+Ew
                                                                                          MD5:E534A9AD6876871121537656B0291393
                                                                                          SHA1:1AFFC9783BBB28D8FB7266075C9E4A44D21AE21D
                                                                                          SHA-256:11B13F3FC2C762608C30D0012F033519A63DFFE1C70CC4882D8B62131000DD97
                                                                                          SHA-512:1FF8B6C53B449E132734F89A15B1F9443A83405A2B1219BA54B027871CFB63D0DDE4539A000916ECBF711A05E847627B72E98B5A35C95C6AD8FF5E7754330BEF
                                                                                          Malicious:false
                                                                                          Preview:.S...~..o.T@.Uj.F..3..O....h../....j6?.:...].4/.7.....4.f..8.../....=v.L{\..1...$....13/..736....%qx.<....^.X7)6Z+....hh..Z^.....8n&......@.......X.....X/.@5.#..*....-..4...;.(.>w.Z.Q...7....6w#.H.....mt...>..1..0Z..B....C..'>..}..G|!....h..D..M.A.... r...&......~Qd..-#kHih*.Z).=c..f...y.....*...E.7.T\....4.......:S.>2..gq.1.lR...$F0.B.$...2k/...dw.|a5..>..!F.$........).m=.<X...P../.P...w.OLm.%V..+..G.p..b{.C......K..m.y.FSB...I..Z..4....){....=.......U..SJZ..<+(....2.g..G..l.....430.j=EN.....p......D..QR....Q3Ytn...\H>N../.:..m|y."..J.#=\......b....S6.....9.d.3.a..YB...C.;1,..s\...LO+..i.L9}......+........2Gk8{h...2.....u..n....o...pV..tV...}$.A.<7'F...n.A..G.D7Y...7..D..a..u..T.....a..&\:.d..ej.hk./x"....PK .z\.!p.>.u..P...|.l..%......^..\...9...Q.W..*......u.D).qP...q.Qlg....t..p........LUta.t...|.p.s....@O^.GwxS."...B...6'D....Tz..B..sv......g.......n..@.Nq..K/p..b.r..5....`....#.z.4j..C|...n(...+Y..&.....'.m BQ...b..Z.T3L`m'.zW.

                                                                                          C:\Users\user\Desktop\NIKHQAIQAU\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Desktop\NWTVCDUMOB.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.863879752925915
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:fMQrufADJc46NOmxB/JTNZMiBQ2mDo64gR87Lyl1oMqsNodpxigxEs9:fMQKfb4oNBhTwim2worgCuNoLxigx59
                                                                                          MD5:95EB4DCA3F27D9427F6DD5C526BA13B0
                                                                                          SHA1:98B72EAD5C984D5937D112E0CE9D19569291AA77
                                                                                          SHA-256:E9FA8193C13C4B0E3F8BA94BDD44DE2B73BFAA447799D8AD7D0CD7C0E42B529C
                                                                                          SHA-512:0E3EF5DB57C23A8050849C7918E3CEE2DDA58502F5C31CC5CB946D5B17457DAE4AEC25C51A01140D048ECB5DD20A5D82E40368DCD3AFA27B0238AE072F66C71A
                                                                                          Malicious:true
                                                                                          Preview:t...U8{rh.}*...1...oe6..\..Z........e.G...v....xH.X4..o..M& 9.......w.....=/FQjEy.....S....8.....51B.h..KT.Y.N.....,.6.g..C.../..H....g.l.;..Bz.dT<. ... ...--&A...S]"k.............A.`qb..K../....f.....2...n.`.....!..h%w.D*..p.2.u...\Y.5...m.dK. ....t....{.^.nZ.:V[.$.K.i..>...R).k-.9....X.-.....w[d.......4.../....f-........5M..0G...Y.I...#O.x.;..~.....<.Q.............e.c...."...g}V.5.\:...el.)E).1...:}.Y.G!........]Wf#m...uk*.<..e..jg.!...R..O.]BKSd6r.1q..u`5.#..e.u.:..7{..o...q...]."..r`[.........c..:..U{;.P...(..]..*q..^$5&..6...5dm....q....i....%.a.R&....p..{~.L...f.{[.....(.......0..q.W&#A......NO.....d-5j...b.._V.......;.^...{........|......7Hx..6..n.Z..N7i.}u^....%...H..8.M..?..mbi.h.....f~.1...2?.y.....uF.D.~....&..$..l...W...`.=..L..3d =..'....i......+G..n7?.=u..v....7.....l.....2[.n?.l.:..8N..}.....oy...U..s.,.E..m?vI..8R.."..<.o....4.m[J,..3.|A....4.].V.n.)...p..E0.].G..po..i.<..b.....tO.p..........h....%..9...L.>.......$`..(V3.H.

                                                                                          C:\Users\user\Desktop\NWTVCDUMOB.png.axLf (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.863879752925915
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:fMQrufADJc46NOmxB/JTNZMiBQ2mDo64gR87Lyl1oMqsNodpxigxEs9:fMQKfb4oNBhTwim2worgCuNoLxigx59
                                                                                          MD5:95EB4DCA3F27D9427F6DD5C526BA13B0
                                                                                          SHA1:98B72EAD5C984D5937D112E0CE9D19569291AA77
                                                                                          SHA-256:E9FA8193C13C4B0E3F8BA94BDD44DE2B73BFAA447799D8AD7D0CD7C0E42B529C
                                                                                          SHA-512:0E3EF5DB57C23A8050849C7918E3CEE2DDA58502F5C31CC5CB946D5B17457DAE4AEC25C51A01140D048ECB5DD20A5D82E40368DCD3AFA27B0238AE072F66C71A
                                                                                          Malicious:false
                                                                                          Preview:t...U8{rh.}*...1...oe6..\..Z........e.G...v....xH.X4..o..M& 9.......w.....=/FQjEy.....S....8.....51B.h..KT.Y.N.....,.6.g..C.../..H....g.l.;..Bz.dT<. ... ...--&A...S]"k.............A.`qb..K../....f.....2...n.`.....!..h%w.D*..p.2.u...\Y.5...m.dK. ....t....{.^.nZ.:V[.$.K.i..>...R).k-.9....X.-.....w[d.......4.../....f-........5M..0G...Y.I...#O.x.;..~.....<.Q.............e.c...."...g}V.5.\:...el.)E).1...:}.Y.G!........]Wf#m...uk*.<..e..jg.!...R..O.]BKSd6r.1q..u`5.#..e.u.:..7{..o...q...]."..r`[.........c..:..U{;.P...(..]..*q..^$5&..6...5dm....q....i....%.a.R&....p..{~.L...f.{[.....(.......0..q.W&#A......NO.....d-5j...b.._V.......;.^...{........|......7Hx..6..n.Z..N7i.}u^....%...H..8.M..?..mbi.h.....f~.1...2?.y.....uF.D.~....&..$..l...W...`.=..L..3d =..'....i......+G..n7?.=u..v....7.....l.....2[.n?.l.:..8N..}.....oy...U..s.,.E..m?vI..8R.."..<.o....4.m[J,..3.|A....4.].V.n.)...p..E0.].G..po..i.<..b.....tO.p..........h....%..9...L.>.......$`..(V3.H.

                                                                                          C:\Users\user\Desktop\ONBQCLYSPU.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8637682848579225
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:aRQdzg8VCvfvVZMf+egDf8Nmw8LoxFGDk0ZDV1t1/5YFDaqDONEkv2as:aRQdzzVNfNko7Z0Z/etvDS9s
                                                                                          MD5:A7EB80126C55F6DD9CED8B08C196EAD2
                                                                                          SHA1:4CF30A0C21FB3FF2E5DDF5A00FA683D18CEA5CCC
                                                                                          SHA-256:4E952A7FBB6B744C826601FD1E39C36911640679632038B5AE3989748F529714
                                                                                          SHA-512:CEEF8442FD4465016F4509C16CA5B5BC0E437D4A132CEEA9BC3F452938963619D2A3F2526C92F177D4504BCF52D3B029C2D32681DFC6A78B8733CA796C075168
                                                                                          Malicious:false
                                                                                          Preview:\j..X..O.b.2$..D..m.(...".!.6."Rt\.q3.M-6..g+....z.......c..6..@v...9h...E..b.....X..T...b.....6.Y..y).+.d)....j.*h(r..;K .i}...8.!$..?........EVeo.H...f.O.4....5.&6\?..H.$..6.#.$.x3...].......-.,.@...(P#.I..Ac......I...ZXv"YN.6.|j...6./..5.|#.K\.T...~..U.h16..*...rMo.a.q...Kj..+..7....x.w.C...C...x.....F.Y."jNI..1....}..dVT...{...2... ..6.=.h*...C.-4.......5.%B%....f...t....X.).[..ET.].d.!)m$..^.Z.kH0/`.0...^b..B......i:....E/....P.O.......{..e..P...a)b.Mg...........+].]...ts_K..0..jqOd.....S..}.Y~_..q..n.Fj.....H..Y y......S....'K[..[..][.O.].."6f.;...@..>..t.L`..V.Ga..!=..|..=..9{.....z..$..+6..B.&J@a....|xW....2.p.f..o...m.|.-....$...J..D..[O.....;0..<a.@q..a.\.P!C+...M...*:..qH..z/&...K..._..ePy..{..W9.+6{.eJ..z.7.L.... .R.p...\j.R..B ..+9gk[..O.d!..+..Q..v..d.E.p...+........'QN....f..F.5.[B\...z#&....../.,8l..G........h\.I..{.w]g.l..B...7Z,g....b)zI? x..bYO......S...[}oi.k.....E.]o&.i......Ok.M.o.v..k..I93.'.p..ol..cV_..

                                                                                          C:\Users\user\Desktop\ONBQCLYSPU.docx.ipbw (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8637682848579225
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:aRQdzg8VCvfvVZMf+egDf8Nmw8LoxFGDk0ZDV1t1/5YFDaqDONEkv2as:aRQdzzVNfNko7Z0Z/etvDS9s
                                                                                          MD5:A7EB80126C55F6DD9CED8B08C196EAD2
                                                                                          SHA1:4CF30A0C21FB3FF2E5DDF5A00FA683D18CEA5CCC
                                                                                          SHA-256:4E952A7FBB6B744C826601FD1E39C36911640679632038B5AE3989748F529714
                                                                                          SHA-512:CEEF8442FD4465016F4509C16CA5B5BC0E437D4A132CEEA9BC3F452938963619D2A3F2526C92F177D4504BCF52D3B029C2D32681DFC6A78B8733CA796C075168
                                                                                          Malicious:false
                                                                                          Preview:\j..X..O.b.2$..D..m.(...".!.6."Rt\.q3.M-6..g+....z.......c..6..@v...9h...E..b.....X..T...b.....6.Y..y).+.d)....j.*h(r..;K .i}...8.!$..?........EVeo.H...f.O.4....5.&6\?..H.$..6.#.$.x3...].......-.,.@...(P#.I..Ac......I...ZXv"YN.6.|j...6./..5.|#.K\.T...~..U.h16..*...rMo.a.q...Kj..+..7....x.w.C...C...x.....F.Y."jNI..1....}..dVT...{...2... ..6.=.h*...C.-4.......5.%B%....f...t....X.).[..ET.].d.!)m$..^.Z.kH0/`.0...^b..B......i:....E/....P.O.......{..e..P...a)b.Mg...........+].]...ts_K..0..jqOd.....S..}.Y~_..q..n.Fj.....H..Y y......S....'K[..[..][.O.].."6f.;...@..>..t.L`..V.Ga..!=..|..=..9{.....z..$..+6..B.&J@a....|xW....2.p.f..o...m.|.-....$...J..D..[O.....;0..<a.@q..a.\.P!C+...M...*:..qH..z/&...K..._..ePy..{..W9.+6{.eJ..z.7.L.... .R.p...\j.R..B ..+9gk[..O.d!..+..Q..v..d.E.p...+........'QN....f..F.5.[B\...z#&....../.,8l..G........h\.I..{.w]g.l..B...7Z,g....b)zI? x..bYO......S...[}oi.k.....E.]o&.i......Ok.M.o.v..k..I93.'.p..ol..cV_..

                                                                                          C:\Users\user\Desktop\ONBQCLYSPU.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.842400093175157
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:H/Ons0ntsYCZkOayJQmbmOWAI0lc9pO0CLd6XkXySumDYupMTguLDtgY:+ntsNJ5PupX46XbSpDYupgzdgY
                                                                                          MD5:846A33A8F24255301BC401E57120104C
                                                                                          SHA1:0A3E2728BA4FB29391DC0BAFDF112EB73BD27D08
                                                                                          SHA-256:FC73E36DDADD505EB5A5A4BB40751E6562F4D1F67F1A6FC061925F83A187FC67
                                                                                          SHA-512:CD6347BCBB9310447711B77CC3C0B1EEB2B44A9CA6692CDB8761494BC3DF049B87121308F71ED1F28BE80ED2258F46BA0B2139E9A07F27B270B8F9F8BEC429BE
                                                                                          Malicious:false
                                                                                          Preview:...k..Sz.NC=<Z'..h.....0J...I....$..&]......5.....I0.(..A.-.V..~..L....AK7g.cn.......`&.?...2b..Z..x)6Y.F[.D.Dk .#;..m..fZ'F...8.n.{).V4.[r.%.....p...[=.|._??..R..p..2V....&7..%Bn>.#18..BR..-.h..KD2....< ....T.....-.-m.....z....<..X.3_.....8..y.e%R....DO..8..8...T&}f.}..O..^.^.tEL..*..r.2.;q.....K'..{../.l....6........./0v...........];M.?1...#.Y...9.t...H.^G._..!....i.*..[.+.....S...\.Q#..tu.|R0..'...,.)l0..].G.-..r..M....*..*....]X.cz.|p...|.....H/....$Z.........hW......B.....^.U.H}...CB..+..._]...Fn.@d.....V....h......l...'.l..I;.({..s.TM..s](...F.g8.....1.@U...+...Jb....X.....l.M.C.U..%.....s.!-1#b...^e...s:..$.......>G.H!..3.......(..`.@.R.v.._....d?...bt.~5N......d&..,..3...1..Otk......PG}.[.O.m_.5.., |E....S..l.VCC.e.e.....Z.~\.a.~..6n.....y...&....B..h.g..]NwX**..*W.~Zw..I.c...$\@.'..W..3i...2+..x..#.B.{...........<..[]?R..K.|....9u^...?.RC...J.....6G.......;L.a.cET|T.B../..*.s........j.a..^@.{RR.<7.#.rJ...W..F.....Hx^...+i

                                                                                          C:\Users\user\Desktop\ONBQCLYSPU.pdf.rYfa (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.842400093175157
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:H/Ons0ntsYCZkOayJQmbmOWAI0lc9pO0CLd6XkXySumDYupMTguLDtgY:+ntsNJ5PupX46XbSpDYupgzdgY
                                                                                          MD5:846A33A8F24255301BC401E57120104C
                                                                                          SHA1:0A3E2728BA4FB29391DC0BAFDF112EB73BD27D08
                                                                                          SHA-256:FC73E36DDADD505EB5A5A4BB40751E6562F4D1F67F1A6FC061925F83A187FC67
                                                                                          SHA-512:CD6347BCBB9310447711B77CC3C0B1EEB2B44A9CA6692CDB8761494BC3DF049B87121308F71ED1F28BE80ED2258F46BA0B2139E9A07F27B270B8F9F8BEC429BE
                                                                                          Malicious:false
                                                                                          Preview:...k..Sz.NC=<Z'..h.....0J...I....$..&]......5.....I0.(..A.-.V..~..L....AK7g.cn.......`&.?...2b..Z..x)6Y.F[.D.Dk .#;..m..fZ'F...8.n.{).V4.[r.%.....p...[=.|._??..R..p..2V....&7..%Bn>.#18..BR..-.h..KD2....< ....T.....-.-m.....z....<..X.3_.....8..y.e%R....DO..8..8...T&}f.}..O..^.^.tEL..*..r.2.;q.....K'..{../.l....6........./0v...........];M.?1...#.Y...9.t...H.^G._..!....i.*..[.+.....S...\.Q#..tu.|R0..'...,.)l0..].G.-..r..M....*..*....]X.cz.|p...|.....H/....$Z.........hW......B.....^.U.H}...CB..+..._]...Fn.@d.....V....h......l...'.l..I;.({..s.TM..s](...F.g8.....1.@U...+...Jb....X.....l.M.C.U..%.....s.!-1#b...^e...s:..$.......>G.H!..3.......(..`.@.R.v.._....d?...bt.~5N......d&..,..3...1..Otk......PG}.[.O.m_.5.., |E....S..l.VCC.e.e.....Z.~\.a.~..6n.....y...&....B..h.g..]NwX**..*W.~Zw..I.c...$\@.'..W..3i...2+..x..#.B.{...........<..[]?R..K.|....9u^...?.RC...J.....6G.......;L.a.cET|T.B../..*.s........j.a..^@.{RR.<7.#.rJ...W..F.....Hx^...+i

                                                                                          C:\Users\user\Desktop\ONBQCLYSPU\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Desktop\ONBQCLYSPU\KATAXZVCPS.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8672894273810785
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:JwcxwY/EEpkpn9SkD8nGF/h2qzaX2wvAlqHzptQhEB4CstVl1wO5FYUVw:SAwzEp8AGFp2tvAlqHzQhim/lPxVw
                                                                                          MD5:ACDE31AE8A0F3411061140B4363A673E
                                                                                          SHA1:3789E2448C2ABE215D3B474113E89BD0EA8C1BE7
                                                                                          SHA-256:4827D6BA77516C85E167A53CC2B5EFA417BAC08A73D0C7B420CB4B036E240BE4
                                                                                          SHA-512:2F32D478EE734FF91CACA275E4858885680C4C7F5642FCD0E6E59167100E3E067188B0E7BD55EB8A6DC4059F4C94E5AEEB394E045307C7988B4B849027DFFC55
                                                                                          Malicious:false
                                                                                          Preview:lx..7|...pw...6+.b.<..2u.c..7C.2....1...Tb.oS...D~.2...K...n.d....{or%/.......Jg..o.em.z....uO..bM...'.4`.^F2n.)7.Z(..0;4..h.dU.m."...`...8<....fm.H+.G.J...*..Ut.....0.!.....B...[....4.ib..X..... ...s..@..t..=...h...w..N.X.......)..._....=h.$.G.O.t.......{..H..^.y...6.Zo".\=.......6...tJ....?...^[...o ..?v..s.Q.i...k*.c....z.\..O.!nG.....c.......]j.p..r...G.R.v.3k...5..............<.jS.[.4:..v.w.M..,./a...).U..F..n*.o3.!.O....(.M.M.@..Y...%E..Wi...>..>..3.P7....._W.q.[..0...J..2...%..fS.xyT.)........*..8\.g.......T/.=u.....-_.K.M._p.-.......8.&..~m..' ^...=FBm.L..2..:d4...Nx...K... ..9.jd`.)...6).y....i4lw.^....gs....9.C...y.$..l.t...q.e.._.2.......tp......I...G...u..%..8....=....n......N.U.ma..aD...6..j1S..8...#0N..o....i....+.....R.cdl.,Q{."..~.i.....?.=q... ...3.Rn....e..3..]!c...m.?..|..X.*..V.{...D.....\.}[.a.E..)...V.!..........V.(......2..4...).X.....}w~..9qdWF...._.}...v.........zUp`q9\...D.X.3...^.GU..H........."...r.u&

                                                                                          C:\Users\user\Desktop\ONBQCLYSPU\KATAXZVCPS.xlsx.qdKR (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8672894273810785
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:JwcxwY/EEpkpn9SkD8nGF/h2qzaX2wvAlqHzptQhEB4CstVl1wO5FYUVw:SAwzEp8AGFp2tvAlqHzQhim/lPxVw
                                                                                          MD5:ACDE31AE8A0F3411061140B4363A673E
                                                                                          SHA1:3789E2448C2ABE215D3B474113E89BD0EA8C1BE7
                                                                                          SHA-256:4827D6BA77516C85E167A53CC2B5EFA417BAC08A73D0C7B420CB4B036E240BE4
                                                                                          SHA-512:2F32D478EE734FF91CACA275E4858885680C4C7F5642FCD0E6E59167100E3E067188B0E7BD55EB8A6DC4059F4C94E5AEEB394E045307C7988B4B849027DFFC55
                                                                                          Malicious:false
                                                                                          Preview:lx..7|...pw...6+.b.<..2u.c..7C.2....1...Tb.oS...D~.2...K...n.d....{or%/.......Jg..o.em.z....uO..bM...'.4`.^F2n.)7.Z(..0;4..h.dU.m."...`...8<....fm.H+.G.J...*..Ut.....0.!.....B...[....4.ib..X..... ...s..@..t..=...h...w..N.X.......)..._....=h.$.G.O.t.......{..H..^.y...6.Zo".\=.......6...tJ....?...^[...o ..?v..s.Q.i...k*.c....z.\..O.!nG.....c.......]j.p..r...G.R.v.3k...5..............<.jS.[.4:..v.w.M..,./a...).U..F..n*.o3.!.O....(.M.M.@..Y...%E..Wi...>..>..3.P7....._W.q.[..0...J..2...%..fS.xyT.)........*..8\.g.......T/.=u.....-_.K.M._p.-.......8.&..~m..' ^...=FBm.L..2..:d4...Nx...K... ..9.jd`.)...6).y....i4lw.^....gs....9.C...y.$..l.t...q.e.._.2.......tp......I...G...u..%..8....=....n......N.U.ma..aD...6..j1S..8...#0N..o....i....+.....R.cdl.,Q{."..~.i.....?.=q... ...3.Rn....e..3..]!c...m.?..|..X.*..V.{...D.....\.}[.a.E..)...V.!..........V.(......2..4...).X.....}w~..9qdWF...._.}...v.........zUp`q9\...D.X.3...^.GU..H........."...r.u&

                                                                                          C:\Users\user\Desktop\ONBQCLYSPU\LTKMYBSEYZ.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.860169623261799
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:r6QJhO/B38IB9x2+p89iHS8HkLeIrvoBufWVj4+srLDLXeUM0d/wVo322iZ6XaP9:2Qu//AEHIrAouylnerm/wg22iZ6XE9
                                                                                          MD5:87EA6B13DB6D3F921795D2F6962C9849
                                                                                          SHA1:7CEB3A2889E529B8F5A70E835B86320C3395B3C5
                                                                                          SHA-256:484E8186A2928432459477422F8016551AD55B323C7C8EA7DE566F5033212DB8
                                                                                          SHA-512:5D570EE2882BDF123F4FE03CDE73C04DAE11FEBF8FDFFE2F05E151B20112B96CBF3A34021425FC3646EB6CD9023FB1A2F562BF928733C517FC8CCF9FF4AFB256
                                                                                          Malicious:false
                                                                                          Preview:K.....'D.t.v..EA..O...ib.."..a&.o7.].*n.Pc{.7w....B\....../X...p:...<..N.........n7h.4...G.k.b...)qx.P.y.....V.U...n.Yu..dQ."...(.&G.=E.^GZ..4..W./...V.8.<6./.|..S..t.....@. ...)~.:.....N..[....Z..&...9.I.\a.v..X...}......v.).!.x@.V^ ..WMZ..o.........[.....W+...*.8.CW*._.4.~.}...{..~...0.1<.#.i....A..KYJ.F....2m..[.|.8.....H....e.)e..x.L.?.i.....f.H...........S....JQ/.{..w..9/3.....c.Wq..t..M<SE.SC...]..O...2.....F....u.....!w..*.8kX.5..J,...T..e.K..4-....F.dQ6..K..dy.p......l..p .P..m....9...1...`E..&..eMu.....t..j+........_.Y>H.>u5A....C.*.4.wG......7.1<...LH...y..Z6.../P.K.]"."j...e..v.qI..HV.cm.b....g<.|.....6..z*..y~...........L!`..@..\t[.naJe. .&........O/8.v..0/.R.n.|.~.!..?Z...a.R^....re.i:U.*.`x.*.tW.f..~M...#..b.....4...#..2...;.w.8...Qd..g3..K.4\..E............a.8O%...+.l|..........[.d.....H.@...\.......`E..q.".....a...s.x.P.'g..........O:...]].v......X;.Uw.lu0V..@.....&...1;...%7,...N......U.....'..F..k..2...<...!.

                                                                                          C:\Users\user\Desktop\ONBQCLYSPU\LTKMYBSEYZ.pdf.yYHl (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.860169623261799
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:r6QJhO/B38IB9x2+p89iHS8HkLeIrvoBufWVj4+srLDLXeUM0d/wVo322iZ6XaP9:2Qu//AEHIrAouylnerm/wg22iZ6XE9
                                                                                          MD5:87EA6B13DB6D3F921795D2F6962C9849
                                                                                          SHA1:7CEB3A2889E529B8F5A70E835B86320C3395B3C5
                                                                                          SHA-256:484E8186A2928432459477422F8016551AD55B323C7C8EA7DE566F5033212DB8
                                                                                          SHA-512:5D570EE2882BDF123F4FE03CDE73C04DAE11FEBF8FDFFE2F05E151B20112B96CBF3A34021425FC3646EB6CD9023FB1A2F562BF928733C517FC8CCF9FF4AFB256
                                                                                          Malicious:false
                                                                                          Preview:K.....'D.t.v..EA..O...ib.."..a&.o7.].*n.Pc{.7w....B\....../X...p:...<..N.........n7h.4...G.k.b...)qx.P.y.....V.U...n.Yu..dQ."...(.&G.=E.^GZ..4..W./...V.8.<6./.|..S..t.....@. ...)~.:.....N..[....Z..&...9.I.\a.v..X...}......v.).!.x@.V^ ..WMZ..o.........[.....W+...*.8.CW*._.4.~.}...{..~...0.1<.#.i....A..KYJ.F....2m..[.|.8.....H....e.)e..x.L.?.i.....f.H...........S....JQ/.{..w..9/3.....c.Wq..t..M<SE.SC...]..O...2.....F....u.....!w..*.8kX.5..J,...T..e.K..4-....F.dQ6..K..dy.p......l..p .P..m....9...1...`E..&..eMu.....t..j+........_.Y>H.>u5A....C.*.4.wG......7.1<...LH...y..Z6.../P.K.]"."j...e..v.qI..HV.cm.b....g<.|.....6..z*..y~...........L!`..@..\t[.naJe. .&........O/8.v..0/.R.n.|.~.!..?Z...a.R^....re.i:U.*.`x.*.tW.f..~M...#..b.....4...#..2...;.w.8...Qd..g3..K.4\..E............a.8O%...+.l|..........[.d.....H.@...\.......`E..q.".....a...s.x.P.'g..........O:...]].v......X;.Uw.lu0V..@.....&...1;...%7,...N......U.....'..F..k..2...<...!.

                                                                                          C:\Users\user\Desktop\ONBQCLYSPU\ONBQCLYSPU.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8664432652429355
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:KWff9FjFGB/EacyjWvlF/qJM0Lj955WxvTf8nq0TC2wQiNb2b3p:NcB/EacyjAl5qJJdCTkKsRbZ
                                                                                          MD5:AC65F08CC8B7F8B2A49B87C78996842F
                                                                                          SHA1:68478C057E76B1C98B28CADDAA296803D1EEE634
                                                                                          SHA-256:35639F942655F4B5658717066BC783AE4163E7151539C3D297272BE5E9718A3C
                                                                                          SHA-512:474DCB837560F91E37AE7577AE1A8957C28BD061CD97CFFF33019FC27E1FA5CAC2CFC792015154E02DF93EA4629EC7060BFD21F7223FA33B167E97684C16BC2A
                                                                                          Malicious:false
                                                                                          Preview:;.D26.. J$O..`.q.....{.STf..M...C/rb.....M.W...h....w.>..Nn.=...R..E#.7.......e..y....S....\*@.+/.....{.w\o...5..Vk{.9....p4`....E....Ko.`..O..........F...)...>..%^.S.&~K..&..K....D@.@..*~0|..x..D8t.......gCJMp.N......+rB/ ..}.]y-.Q......M.......+.,]..pM^(..1F|..'.n}.&.o6%.}.....E....^..l.N..W.G......(MN6.5F...T..Tk.1:&.'.HA......*H.._j.N........z8..4...`....<.u.j3:z5.j.k^=....\..D...se.C....W......A..r..N..!.V....Uk..."uT....K......xq}..U.......F./.8......!y.kX.#~.BR.....`. .z.:z..T....1.hp.ws...F.."d#....Z...(...d-_...t`A...'..`SW..T.G`...H....G..........A"`[.\e.-..q3..u...:..e..N.%...I...w....bS......GPs$.....x?F..`.B.da.......@).E..A".............q.Q.f2M...=b....8..Z..........f......W.....h......I.#...d..G.....Z....9...U...>?..j.?.%.........JE..-^....[.6...2r....(|BWg.s..D.....Q?#H...T..*...=Z.G..l.'d8....F.t...lA.) ...&..KDsL5..D.....XGu.....~..[..._y..k.)ht..3.......EV.{=8.....GI...t)..V.J...,.d6......-...b..)F>.+....<..`@.W.S..;.(3.MqV.

                                                                                          C:\Users\user\Desktop\ONBQCLYSPU\ONBQCLYSPU.docx.gYrc (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8664432652429355
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:KWff9FjFGB/EacyjWvlF/qJM0Lj955WxvTf8nq0TC2wQiNb2b3p:NcB/EacyjAl5qJJdCTkKsRbZ
                                                                                          MD5:AC65F08CC8B7F8B2A49B87C78996842F
                                                                                          SHA1:68478C057E76B1C98B28CADDAA296803D1EEE634
                                                                                          SHA-256:35639F942655F4B5658717066BC783AE4163E7151539C3D297272BE5E9718A3C
                                                                                          SHA-512:474DCB837560F91E37AE7577AE1A8957C28BD061CD97CFFF33019FC27E1FA5CAC2CFC792015154E02DF93EA4629EC7060BFD21F7223FA33B167E97684C16BC2A
                                                                                          Malicious:false
                                                                                          Preview:;.D26.. J$O..`.q.....{.STf..M...C/rb.....M.W...h....w.>..Nn.=...R..E#.7.......e..y....S....\*@.+/.....{.w\o...5..Vk{.9....p4`....E....Ko.`..O..........F...)...>..%^.S.&~K..&..K....D@.@..*~0|..x..D8t.......gCJMp.N......+rB/ ..}.]y-.Q......M.......+.,]..pM^(..1F|..'.n}.&.o6%.}.....E....^..l.N..W.G......(MN6.5F...T..Tk.1:&.'.HA......*H.._j.N........z8..4...`....<.u.j3:z5.j.k^=....\..D...se.C....W......A..r..N..!.V....Uk..."uT....K......xq}..U.......F./.8......!y.kX.#~.BR.....`. .z.:z..T....1.hp.ws...F.."d#....Z...(...d-_...t`A...'..`SW..T.G`...H....G..........A"`[.\e.-..q3..u...:..e..N.%...I...w....bS......GPs$.....x?F..`.B.da.......@).E..A".............q.Q.f2M...=b....8..Z..........f......W.....h......I.#...d..G.....Z....9...U...>?..j.?.%.........JE..-^....[.6...2r....(|BWg.s..D.....Q?#H...T..*...=Z.G..l.'d8....F.t...lA.) ...&..KDsL5..D.....XGu.....~..[..._y..k.)ht..3.......EV.{=8.....GI...t)..V.J...,.d6......-...b..)F>.+....<..`@.W.S..;.(3.MqV.

                                                                                          C:\Users\user\Desktop\ONBQCLYSPU\RAYHIWGKDI.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.826751876704271
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:h3YTQO5gbBn+Qh02Ck90tA/JzbK6OngURcUf2DuE/R6jNGFlD9hG8:t45gBrh02Cqz/JvK6eg8cU1E/gClDnG8
                                                                                          MD5:04B88DB8E9DE4328751E4933F76F4FBF
                                                                                          SHA1:48F43B5ADAF87F29F9D91F98C32BBB7CEE6D794C
                                                                                          SHA-256:C8DD1DCFCEAF8C33AA56F1148026821C57867F41FE248F6A3CF12721D840E8AA
                                                                                          SHA-512:8DE014DBDFD0DB66CC3204B3574AF9EC169F603E32E660BD6721E437D2CBB9F3E02944EB9497C0DA46905D056ED705437F21703916426D84FF934503D67C0C6F
                                                                                          Malicious:false
                                                                                          Preview:...{.:.P.$p....uK..y.K..8.&..c.....,.1.:...ov1.7....TU.E...x4.p.{9!%.&G....Y.k#...o....ji`.ZG2X..hb+...FU.B..K....8-.o....Jo.i.9.+&....\O.HP..sn..-.G..W.u..,....X. ...A..>H3..1x.K.......k<.....Ngd0M.,..z.(.k..../......?...s1<..(..\;p.v...H%.(.._..^Q.[D.o%<^O.g-....j.ct..&....g.'Xm..#....<z.q..|..W.F!v...t.da.\.].V.}-E!.b...=.o..H...W9.U+.......?Z..]...W-N....3..i....yy!....X.9.v..6X...].a.7......lQ`....9...st\`....}.=1...>.y..'.VH.<Q...|.Eg....]#D..?..?...e..,.......s.Y.j..?...H.=...A..o..p......0.l..-.g.:...._&...].%.$.E...?../.....;..2..r....U...X..?d.E..a....\..E.....e.l...F'Y.. .._kA.$.....Z...h.....!..H.A.....g.B.9>>..9..rt.@.3.h.......I.....c.!(.;kQk9Yd.,f.i...y..P...,..u."S.z.6.`b.CO.Z.B]Q@k...@.F...I-~1....-Hb;../m|.8[...W..v...x..#.L8...B...G.k)2...:.9.f....S.k..w_F......)..t[4B...q"s{..=.5W^.a....*".f..Y............\]..........0..-....Lr..z}Ff...,^nN0e...{..(...,...!.i..i...24...\..6..]<..S....p.@.e`.L;.*m.#.*{*..JM.mu..72@.

                                                                                          C:\Users\user\Desktop\ONBQCLYSPU\RAYHIWGKDI.mp3.FxZY (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.826751876704271
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:h3YTQO5gbBn+Qh02Ck90tA/JzbK6OngURcUf2DuE/R6jNGFlD9hG8:t45gBrh02Cqz/JvK6eg8cU1E/gClDnG8
                                                                                          MD5:04B88DB8E9DE4328751E4933F76F4FBF
                                                                                          SHA1:48F43B5ADAF87F29F9D91F98C32BBB7CEE6D794C
                                                                                          SHA-256:C8DD1DCFCEAF8C33AA56F1148026821C57867F41FE248F6A3CF12721D840E8AA
                                                                                          SHA-512:8DE014DBDFD0DB66CC3204B3574AF9EC169F603E32E660BD6721E437D2CBB9F3E02944EB9497C0DA46905D056ED705437F21703916426D84FF934503D67C0C6F
                                                                                          Malicious:false
                                                                                          Preview:...{.:.P.$p....uK..y.K..8.&..c.....,.1.:...ov1.7....TU.E...x4.p.{9!%.&G....Y.k#...o....ji`.ZG2X..hb+...FU.B..K....8-.o....Jo.i.9.+&....\O.HP..sn..-.G..W.u..,....X. ...A..>H3..1x.K.......k<.....Ngd0M.,..z.(.k..../......?...s1<..(..\;p.v...H%.(.._..^Q.[D.o%<^O.g-....j.ct..&....g.'Xm..#....<z.q..|..W.F!v...t.da.\.].V.}-E!.b...=.o..H...W9.U+.......?Z..]...W-N....3..i....yy!....X.9.v..6X...].a.7......lQ`....9...st\`....}.=1...>.y..'.VH.<Q...|.Eg....]#D..?..?...e..,.......s.Y.j..?...H.=...A..o..p......0.l..-.g.:...._&...].%.$.E...?../.....;..2..r....U...X..?d.E..a....\..E.....e.l...F'Y.. .._kA.$.....Z...h.....!..H.A.....g.B.9>>..9..rt.@.3.h.......I.....c.!(.;kQk9Yd.,f.i...y..P...,..u."S.z.6.`b.CO.Z.B]Q@k...@.F...I-~1....-Hb;../m|.8[...W..v...x..#.L8...B...G.k)2...:.9.f....S.k..w_F......)..t[4B...q"s{..=.5W^.a....*".f..Y............\]..........0..-....Lr..z}Ff...,^nN0e...{..(...,...!.i..i...24...\..6..]<..S....p.@.e`.L;.*m.#.*{*..JM.mu..72@.

                                                                                          C:\Users\user\Desktop\ONBQCLYSPU\YPSIACHYXW.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.86477591359906
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:9uK5wS7OnHgjMrNdOZm9/azPmi7W428uCfxLDWSLjABQSylOvDEUniS:sKuS7OHgIrrMWaTm1428uCfN8WSxvIEJ
                                                                                          MD5:6F1F2930FCED158B9DACCD982B9C7DC9
                                                                                          SHA1:23581DA99208637226C201E16A6A5F3ADE9D7141
                                                                                          SHA-256:AFF4DEBEEDF05ED752539408B1A73A4418D7CBE68AA13D2D8B4E87F2D22C14BC
                                                                                          SHA-512:6E5B24522AB86B1F107EE53C47C67CAEA7EDB2E0029BEAAC78E73ADDB4264157428158D3C1CC8D6D0D9CA7D5BAA4F89906702845F18EA6CCD55923F7257D826B
                                                                                          Malicious:false
                                                                                          Preview:[..).Fkt..z5H..85`./.[Q3...._.."cF..?/4.an....Z..]....z()..LQ........4.Z.]h.!3...t......./k_y]....<I 4..q.....=S.v....t.D.....U.....).C.5.o+....f.a....To.eEW..A..x1.9.G.A...E..5../p....w..rQ..^u...<......C...9M.S...b.....c.....0#..C.;..;...j.!......8..WD.<.2}1..Q.-.2...N.+..s.l...z..f..b ..H.j...j........!@]f.Z.iNT9....'...9)...5.......?..Os.A"$..8...z..x.Q....GhD..0F.+[.n.x.C=O.,...Ny.,....b.H...j......J.IX........a.Mu..Vh.|<...'.f...q...i.!.IH..4.%....,{...OXU.}.Y....7.T...=.k...#8.H..T.?w..= `....?\...".Y....?..~..r.K.....l...l%.^...M....#...........+...z{t~s>-....c.".S.....x..>....gP..T....]}t.n....SA..*....^..$#...B.:..%......>.;>.......G...`..Q .7.".j........M....8.s.....U{.S_uYj.C.(......&.".......j...)&.x.-.A./K.?..1h..GE*'!....!k4.g.l9...Z..8y...f.8..\z`.EZ...V.^......ubx{.w...6\.}.....2.[@.1.n...H0.F41..k<.. ..~....%D.v..u...".Xl.w.>ef...J.B....ap..u.2...d.L..K.O....M.\......w..Z?z....(.T.\...N7<V..N<.....Y...Z...Q`...6...(....$.

                                                                                          C:\Users\user\Desktop\ONBQCLYSPU\YPSIACHYXW.jpg.VuWL (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.86477591359906
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:9uK5wS7OnHgjMrNdOZm9/azPmi7W428uCfxLDWSLjABQSylOvDEUniS:sKuS7OHgIrrMWaTm1428uCfN8WSxvIEJ
                                                                                          MD5:6F1F2930FCED158B9DACCD982B9C7DC9
                                                                                          SHA1:23581DA99208637226C201E16A6A5F3ADE9D7141
                                                                                          SHA-256:AFF4DEBEEDF05ED752539408B1A73A4418D7CBE68AA13D2D8B4E87F2D22C14BC
                                                                                          SHA-512:6E5B24522AB86B1F107EE53C47C67CAEA7EDB2E0029BEAAC78E73ADDB4264157428158D3C1CC8D6D0D9CA7D5BAA4F89906702845F18EA6CCD55923F7257D826B
                                                                                          Malicious:false
                                                                                          Preview:[..).Fkt..z5H..85`./.[Q3...._.."cF..?/4.an....Z..]....z()..LQ........4.Z.]h.!3...t......./k_y]....<I 4..q.....=S.v....t.D.....U.....).C.5.o+....f.a....To.eEW..A..x1.9.G.A...E..5../p....w..rQ..^u...<......C...9M.S...b.....c.....0#..C.;..;...j.!......8..WD.<.2}1..Q.-.2...N.+..s.l...z..f..b ..H.j...j........!@]f.Z.iNT9....'...9)...5.......?..Os.A"$..8...z..x.Q....GhD..0F.+[.n.x.C=O.,...Ny.,....b.H...j......J.IX........a.Mu..Vh.|<...'.f...q...i.!.IH..4.%....,{...OXU.}.Y....7.T...=.k...#8.H..T.?w..= `....?\...".Y....?..~..r.K.....l...l%.^...M....#...........+...z{t~s>-....c.".S.....x..>....gP..T....]}t.n....SA..*....^..$#...B.:..%......>.;>.......G...`..Q .7.".j........M....8.s.....U{.S_uYj.C.(......&.".......j...)&.x.-.A./K.?..1h..GE*'!....!k4.g.l9...Z..8y...f.8..\z`.EZ...V.^......ubx{.w...6\.}.....2.[@.1.n...H0.F41..k<.. ..~....%D.v..u...".Xl.w.>ef...J.B....ap..u.2...d.L..K.O....M.\......w..Z?z....(.T.\...N7<V..N<.....Y...Z...Q`...6...(....$.

                                                                                          C:\Users\user\Desktop\ONBQCLYSPU\ZBEDCJPBEY.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.862040125236737
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:381T2cjXbiK0T88pcWOVF4ORiK9oZZlvno2MZXt0GKHGMB18Uf:gqcbbidT7cWW4miBrlvYXt03HGo
                                                                                          MD5:A96BF61E5978E00F4463923B46357A30
                                                                                          SHA1:157367AB39EC574E0E5BC2B6FFDB3A4084641D9D
                                                                                          SHA-256:1E65756EEACCF87B16704C3D303EABF71B60FE823C8C0B9AD2D0E70A38B9AAA7
                                                                                          SHA-512:3C8DDDE13E1B8DB47FA5B262CD43D2581C5AD539F72A468FA8C457149774C5C7C26135BA64C40037EE5708880C4D18D9BFA9EE7966401662546D3D9D60283F1F
                                                                                          Malicious:false
                                                                                          Preview:.......x....~.#x.M.7/_...Vg.|...T?]kQ.....L%..z.{..n...uF.(..2J-@.v..j.C:.&...\....+.Q....aa.....c.o._...!.G.<\.lh..Ir.{B9...?../2a.".wQ...!T.{A..q..]....[..v.C.._8&..|[)..9...A^k`..~.F.LDi..#?$..u{'z......p@..}...6o..e...E.RJ......LJ.F4.#.yn..~....{.....f..vw...R/F..6..b.i..j.J...Go{......h....;5.s.......G.F.J.ziW(WXs=p...........[.t.e..>..i...?u.>...D.VJ.....L......'k...H...z.u....)>YD.i....E.C.....Y]~.G.....t...s*..p.B...It._...~m.j.-.;zE.!....3...].....D....G...b.S.ryj=............._QQ........-....qK.Ulo.#.])..+.CK..>....}....L..=dx..!..w.Xej....hK.>..[.k.Z.0...>......M./M.O..7...5.(!g.C<..E. M..x[.` A7.....cw.g.>z...O.!.g...gq......D.."...@{....;..t0.....s..+..y..Gv..j..f..~M...v..!J.*..~.O....*...-.B..j..do.[=5T.....>...s363\.zD..J..9.pd.../pvN.@O8k..1$,6.b...G.;(Y...UW.|c..P......r...r...>V..+.}b.)..=..I..d$.<f..R...s.0\...R3.....a....S........1..2y.5G.*E....s. f.x.<....\2.....m.6......~YX.]/.Q&....v........:H{.V=..(..

                                                                                          C:\Users\user\Desktop\ONBQCLYSPU\ZBEDCJPBEY.png.sbxV (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.862040125236737
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:381T2cjXbiK0T88pcWOVF4ORiK9oZZlvno2MZXt0GKHGMB18Uf:gqcbbidT7cWW4miBrlvYXt03HGo
                                                                                          MD5:A96BF61E5978E00F4463923B46357A30
                                                                                          SHA1:157367AB39EC574E0E5BC2B6FFDB3A4084641D9D
                                                                                          SHA-256:1E65756EEACCF87B16704C3D303EABF71B60FE823C8C0B9AD2D0E70A38B9AAA7
                                                                                          SHA-512:3C8DDDE13E1B8DB47FA5B262CD43D2581C5AD539F72A468FA8C457149774C5C7C26135BA64C40037EE5708880C4D18D9BFA9EE7966401662546D3D9D60283F1F
                                                                                          Malicious:false
                                                                                          Preview:.......x....~.#x.M.7/_...Vg.|...T?]kQ.....L%..z.{..n...uF.(..2J-@.v..j.C:.&...\....+.Q....aa.....c.o._...!.G.<\.lh..Ir.{B9...?../2a.".wQ...!T.{A..q..]....[..v.C.._8&..|[)..9...A^k`..~.F.LDi..#?$..u{'z......p@..}...6o..e...E.RJ......LJ.F4.#.yn..~....{.....f..vw...R/F..6..b.i..j.J...Go{......h....;5.s.......G.F.J.ziW(WXs=p...........[.t.e..>..i...?u.>...D.VJ.....L......'k...H...z.u....)>YD.i....E.C.....Y]~.G.....t...s*..p.B...It._...~m.j.-.;zE.!....3...].....D....G...b.S.ryj=............._QQ........-....qK.Ulo.#.])..+.CK..>....}....L..=dx..!..w.Xej....hK.>..[.k.Z.0...>......M./M.O..7...5.(!g.C<..E. M..x[.` A7.....cw.g.>z...O.!.g...gq......D.."...@{....;..t0.....s..+..y..Gv..j..f..~M...v..!J.*..~.O....*...-.B..j..do.[=5T.....>...s363\.zD..J..9.pd.../pvN.@O8k..1$,6.b...G.;(Y...UW.|c..P......r...r...>V..+.}b.)..=..I..d$.<f..R...s.0\...R3.....a....S........1..2y.5G.*E....s. f.x.<....\2.....m.6......~YX.]/.Q&....v........:H{.V=..(..

                                                                                          C:\Users\user\Desktop\RAYHIWGKDI.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.854524354020448
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:qOKRpJiXZVjQffRpPwQpfZtPNoVmR3SNcpg2sqnrN8Q:qDgXZJ+Z/oVauJ2sqnrKQ
                                                                                          MD5:5FF0085DA959C1D12E17ACB40994A0E4
                                                                                          SHA1:12099F3A00320A9EB10B68127623C6D194683238
                                                                                          SHA-256:3DD78C4EF1245C2CB3F62997A0072A36888E960AA61DB591FC3628CFDC5BF91D
                                                                                          SHA-512:DDFCE852E1D28D6CE8000BD9BBE41F1E3E886BB76B1D714CF9506D696093EDBD2B5F461F42F2DCF5E546007FBBD8D94921758CD207811CCD9129E5A45436E12E
                                                                                          Malicious:false
                                                                                          Preview:Th.i..n982.'.%......u...nz..,#..7....A$.9..UQU.9.*j..........g*D)wU.......%...L..Q....E.'l_2oy..T..-...or.n......MO.u..5l.D.E.."&...r..f.b..{...P0...Q&..7..2..&.......7..6.....#....3?...=.0.x.R.tS..19...>..).A^HN... .."....MH...n!.........."..5...wB...(......XK..9z).<...`.e...y.f".......U|.j.[.qR.LhJ.........\.g#..}..)NB..f/.....@@B*9zn.2I.O.(..j.P.0.......,?6..5Ub....\.qhI...#....d...y..p.q..].f...93..&.D$'Kk.X...4...p...d^.......+...nb........K..TUW...n....F....4.....i......A...dm....G..Bi.)...2.Jnd..."...~U4..}..,..W.P...:.b.1=<e.?.TYfTq....'$.....|....-Bl...;..1....V..O!QM..V.N.LW...p.h{.....j>|.....U..f]....}..l*.(Nw..W..v$..=|`a..2_.u.]D*.".y.s....v.-...v.N.t.0..4.|N+..^o........]..dSa..F..O.....i......PXb$<....{....$.......QY.{Js1m...'~.%lJ#..O....B.+&.n..I....b..|&....qG2..M....U.....g9.H.0..u..o.....d6.o..s>.O.....a.&..2Z.y...o.,Z..A-...Z.D)1..0...6./_p06.4...(...N....1..v..q...j......e.q.......9gY...f......y...nq.

                                                                                          C:\Users\user\Desktop\RAYHIWGKDI.mp3.bfXK (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.854524354020448
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:qOKRpJiXZVjQffRpPwQpfZtPNoVmR3SNcpg2sqnrN8Q:qDgXZJ+Z/oVauJ2sqnrKQ
                                                                                          MD5:5FF0085DA959C1D12E17ACB40994A0E4
                                                                                          SHA1:12099F3A00320A9EB10B68127623C6D194683238
                                                                                          SHA-256:3DD78C4EF1245C2CB3F62997A0072A36888E960AA61DB591FC3628CFDC5BF91D
                                                                                          SHA-512:DDFCE852E1D28D6CE8000BD9BBE41F1E3E886BB76B1D714CF9506D696093EDBD2B5F461F42F2DCF5E546007FBBD8D94921758CD207811CCD9129E5A45436E12E
                                                                                          Malicious:false
                                                                                          Preview:Th.i..n982.'.%......u...nz..,#..7....A$.9..UQU.9.*j..........g*D)wU.......%...L..Q....E.'l_2oy..T..-...or.n......MO.u..5l.D.E.."&...r..f.b..{...P0...Q&..7..2..&.......7..6.....#....3?...=.0.x.R.tS..19...>..).A^HN... .."....MH...n!.........."..5...wB...(......XK..9z).<...`.e...y.f".......U|.j.[.qR.LhJ.........\.g#..}..)NB..f/.....@@B*9zn.2I.O.(..j.P.0.......,?6..5Ub....\.qhI...#....d...y..p.q..].f...93..&.D$'Kk.X...4...p...d^.......+...nb........K..TUW...n....F....4.....i......A...dm....G..Bi.)...2.Jnd..."...~U4..}..,..W.P...:.b.1=<e.?.TYfTq....'$.....|....-Bl...;..1....V..O!QM..V.N.LW...p.h{.....j>|.....U..f]....}..l*.(Nw..W..v$..=|`a..2_.u.]D*.".y.s....v.-...v.N.t.0..4.|N+..^o........]..dSa..F..O.....i......PXb$<....{....$.......QY.{Js1m...'~.%lJ#..O....B.+&.n..I....b..|&....qG2..M....U.....g9.H.0..u..o.....d6.o..s>.O.....a.&..2Z.y...o.,Z..A-...Z.D)1..0...6./_p06.4...(...N....1..v..q...j......e.q.......9gY...f......y...nq.

                                                                                          C:\Users\user\Desktop\SQRKHNBNYN\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Desktop\UMMBDNEQBN.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.842035062985428
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Gh8b9aeqBSn7v65WRBnWUoiGvh1+qwSKV7oJ35/qlL7j8QVaOhqJh:Gh8b4NKUa0vi0fYV7SgL7/Icqh
                                                                                          MD5:8470D0C666764D5A09EA7F54ABF89832
                                                                                          SHA1:20100AF1A01575910793C72FB167BC92AAA3085A
                                                                                          SHA-256:E5B4557716D95FA4AEAC7FD6A2F05ECCB75B2CF506069584D58146D80E624BA1
                                                                                          SHA-512:2DC314AA764DC035EBC94CF2F8F51F68B93BB9FE8DCA538BCAA73ED4BEA0F03C126AF5184D3D3B25922807014D7FE08C4BD4B97427F523A78EB2E3D9832ABE0B
                                                                                          Malicious:false
                                                                                          Preview:o...\@:"...(...b....#(9.u`...r.H..`...A 9..v"..]B..[+.+....V..a..1..^.s3.w.fj........'.u?6...MC...^P..B.....8....1...\..jB\...2..j..n5.).&3...e.m..../h.V....-q.....<..{.}.<o...1.$.>OL....}.c..'Ay^......J.p..w..c.([sG.;J..p..J.d..V.3;...`...7.......7O.7"..|...>42..R.J.C...o.i!...6......Q..p}..R..R..%[.s....&...Y..f...T{bj..|..&.".].....qQ....5..b..0...kq;....rP...G.;."..e_.8...".)..;*..\r.w+....>.o._....x.F...w-....K.!_.gb.;..|n......H]....g...,{..\TG.I$>:s....Cw....31..V8.m..b'f.L..g..qq.~. >]....Z,...U9..G.<a.`..J.x.....@....X:.k.1*%....n..o.7.g.z...j.p..V.b%.....^j.C..H.a..oVz......#.|,......1....7v .......Rf,Tx].\e........Pdl..W...:....qp._..E...7.y.........,.D....'.......J..n..$<....5...D AS.V...?...:.....,s.S..,.5.. _.....K..K.L:2.).yz...Fb.."(..lc..........J.5..^"..)....xz..8.7)R,.|..C...c...j..._,..........3T..G.1S.Wt.......[.}.].....V.m....s.c.|B-..#.y...b...........H......D8..@jx..LH..#..\#._...:..G.q..8Gu.|.$y.Q.a...(.(H

                                                                                          C:\Users\user\Desktop\UMMBDNEQBN.png.hylv (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.842035062985428
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Gh8b9aeqBSn7v65WRBnWUoiGvh1+qwSKV7oJ35/qlL7j8QVaOhqJh:Gh8b4NKUa0vi0fYV7SgL7/Icqh
                                                                                          MD5:8470D0C666764D5A09EA7F54ABF89832
                                                                                          SHA1:20100AF1A01575910793C72FB167BC92AAA3085A
                                                                                          SHA-256:E5B4557716D95FA4AEAC7FD6A2F05ECCB75B2CF506069584D58146D80E624BA1
                                                                                          SHA-512:2DC314AA764DC035EBC94CF2F8F51F68B93BB9FE8DCA538BCAA73ED4BEA0F03C126AF5184D3D3B25922807014D7FE08C4BD4B97427F523A78EB2E3D9832ABE0B
                                                                                          Malicious:false
                                                                                          Preview:o...\@:"...(...b....#(9.u`...r.H..`...A 9..v"..]B..[+.+....V..a..1..^.s3.w.fj........'.u?6...MC...^P..B.....8....1...\..jB\...2..j..n5.).&3...e.m..../h.V....-q.....<..{.}.<o...1.$.>OL....}.c..'Ay^......J.p..w..c.([sG.;J..p..J.d..V.3;...`...7.......7O.7"..|...>42..R.J.C...o.i!...6......Q..p}..R..R..%[.s....&...Y..f...T{bj..|..&.".].....qQ....5..b..0...kq;....rP...G.;."..e_.8...".)..;*..\r.w+....>.o._....x.F...w-....K.!_.gb.;..|n......H]....g...,{..\TG.I$>:s....Cw....31..V8.m..b'f.L..g..qq.~. >]....Z,...U9..G.<a.`..J.x.....@....X:.k.1*%....n..o.7.g.z...j.p..V.b%.....^j.C..H.a..oVz......#.|,......1....7v .......Rf,Tx].\e........Pdl..W...:....qp._..E...7.y.........,.D....'.......J..n..$<....5...D AS.V...?...:.....,s.S..,.5.. _.....K..K.L:2.).yz...Fb.."(..lc..........J.5..^"..)....xz..8.7)R,.|..C...c...j..._,..........3T..G.1S.Wt.......[.}.].....V.m....s.c.|B-..#.y...b...........H......D8..@jx..LH..#..\#._...:..G.q..8Gu.|.$y.Q.a...(.(H

                                                                                          C:\Users\user\Desktop\VLZDGUKUTZ.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.836488265427975
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:WVwgJXm430eJ1C5n3I8j4abx9BiYdzGnI+ClzirKUcR1DChY9q/fO:WVwg13hgnDbD4UGAz5Ue1DCDO
                                                                                          MD5:FF10C2240CFA13CB5A0A6A4D2D946BC8
                                                                                          SHA1:FD34E28F7164FAC31E5126A9C6ECAB426B8A8502
                                                                                          SHA-256:AA4D6476F33D8D0AD6BE97E0F3E34D3FC0C301B659B6551037C7312DA8A52EF7
                                                                                          SHA-512:E25ACDA60A2B441D0DC56BB2B08DB1F87F08BA9278D9627639652576C68948A0FC6C42578E24953B9B160F03C6EE46D3B4141B7156290A510BCAFBD8F93E4458
                                                                                          Malicious:false
                                                                                          Preview:...|j..A. .7.X....b.(....Q....x./..U.|...g....B.....Xv,t@y....8...d_.d.&..8...IA..[....5..._...#:...~....cX2..C.}<qRJ..J.P..<....~H.2j...o.......w...?.....nv..x.G..c..A.76...[..o.3...a.dS.5B.j8.aqb..SU.h..ZTqW.!~...nVT/...j..g....P.0U....>. ...._.9..B.r..!79$.K>..?.B....|..E...T..x..'.qS6.v...../L.u...Sh..CI'..."..L.5..3..iJ.*c....B....t,.r]..=k%.:S4.../....^..E..~p1..=`...>.8. $"...z5(...~.r......./J.Qs...v.M(4..A`<.*9..B..[.......-........|.R.%B...4!P..s....{!4.).$..ly.K.W.?..7z.8;e.....b..o......s.v.u.aZz7.]T.s.G3x\....P.C....S..\.........m........'...V.S.x/.U.b.e.|.K..V..w?.....w...>...G..l.......MS.$xo.k.0.b.+.>..n.I..C.v?i.X.....e.H.T-..&.....C2.9c..# ..ad.x.L.\|0d....d...-8....`)x.~.Q.....s..R..w.d3j..A.$FA..._e`qj,...~...G..r2....../JO....".#......m..~4...p......$.\.T.l9.>...m<......1..E.6~rH..&\....P{....cx.,.fy...0)m.......hl.\ >.!.f.Y2.uz...o...../.......qVb.p....~...p[`....nH..cw...[t-?kXd...|m.K...,...U._.e%J.....7..<.

                                                                                          C:\Users\user\Desktop\VLZDGUKUTZ.jpg.sirJ (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.836488265427975
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:WVwgJXm430eJ1C5n3I8j4abx9BiYdzGnI+ClzirKUcR1DChY9q/fO:WVwg13hgnDbD4UGAz5Ue1DCDO
                                                                                          MD5:FF10C2240CFA13CB5A0A6A4D2D946BC8
                                                                                          SHA1:FD34E28F7164FAC31E5126A9C6ECAB426B8A8502
                                                                                          SHA-256:AA4D6476F33D8D0AD6BE97E0F3E34D3FC0C301B659B6551037C7312DA8A52EF7
                                                                                          SHA-512:E25ACDA60A2B441D0DC56BB2B08DB1F87F08BA9278D9627639652576C68948A0FC6C42578E24953B9B160F03C6EE46D3B4141B7156290A510BCAFBD8F93E4458
                                                                                          Malicious:false
                                                                                          Preview:...|j..A. .7.X....b.(....Q....x./..U.|...g....B.....Xv,t@y....8...d_.d.&..8...IA..[....5..._...#:...~....cX2..C.}<qRJ..J.P..<....~H.2j...o.......w...?.....nv..x.G..c..A.76...[..o.3...a.dS.5B.j8.aqb..SU.h..ZTqW.!~...nVT/...j..g....P.0U....>. ...._.9..B.r..!79$.K>..?.B....|..E...T..x..'.qS6.v...../L.u...Sh..CI'..."..L.5..3..iJ.*c....B....t,.r]..=k%.:S4.../....^..E..~p1..=`...>.8. $"...z5(...~.r......./J.Qs...v.M(4..A`<.*9..B..[.......-........|.R.%B...4!P..s....{!4.).$..ly.K.W.?..7z.8;e.....b..o......s.v.u.aZz7.]T.s.G3x\....P.C....S..\.........m........'...V.S.x/.U.b.e.|.K..V..w?.....w...>...G..l.......MS.$xo.k.0.b.+.>..n.I..C.v?i.X.....e.H.T-..&.....C2.9c..# ..ad.x.L.\|0d....d...-8....`)x.~.Q.....s..R..w.d3j..A.$FA..._e`qj,...~...G..r2....../JO....".#......m..~4...p......$.\.T.l9.>...m<......1..E.6~rH..&\....P{....cx.,.fy...0)m.......hl.\ >.!.f.Y2.uz...o...../.......qVb.p....~...p[`....nH..cw...[t-?kXd...|m.K...,...U._.e%J.....7..<.

                                                                                          C:\Users\user\Desktop\VLZDGUKUTZ.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8641862424800175
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:whYiBUXJ5yVYhOXSDXtpcyGH6N12Mp/kjJ0u9pHP4mxVtZ6RuSzGNWbdhF:wFBU/KXSzt+yGi2Mp/EaAPrVZAuSSgb5
                                                                                          MD5:F771FFC48E839D01380588D9AA079F20
                                                                                          SHA1:8F10B789AB5A9E499CCA040026A8409FB012F3FA
                                                                                          SHA-256:D80EF17BBBF88E3FF721878D1C16592B59379F2F58B9AA330B7DA7C51FA6CD7F
                                                                                          SHA-512:4E0A7FAC33F412390B26E30B1BE57A2D65B0EEB18848A7C1B122DA5581826BC04D0077A438DF70686467D1BE3072C5CE6F5ABF3CD96A0F6ACEDC16C516DDAD9E
                                                                                          Malicious:false
                                                                                          Preview:#@H.&. ......M%..B2Tf.){..8....0./.5z`..4p......;.Gr.Bt...!...........yvT})...l-..O.Wi_..../O...&..r...@E../.].z)-.82......}....|.....On:..u..7...8\p3FU5.....!CAs..+../.I......W$....WY...)..B..k.-.:.4<..Fx....9.....Lo.....(.).....0H.......yS.....6..@.....n......)...s:i....%...S.dJi.[...,.tfw.....89iI...f.P .....{.N.m.#c.!.*Ffr)/u.... ,.^@...gO.\.....S....P.T"V.......R[.m..ru....[../.?....u|..H....qW~.85.R...U.E`.".q.$..Jb.....P....$^w... R.9T.N.p.M.....yK.U../......v..S.z.....}h.=....ow+..?}.5..5: ....>..M.V(.}.W.....\.}..3....4.6,.......3.E........,.bQ.;..s.......c.L.J..."\..C.....W...zBE..:.NBa...G.......).......oK...g...>.!.*A...6..s..arhGH..i%..m.X$......UV.<..~'<Y.6.-{>...d<.em....)m..c......6.....}.|...4"..W.'...9...t.b..=..K.D.R.BO..)e..a!%#e.(.^g@.\...`......K.4.........#./w..g ..^.K..Cy.....\.?...yc@(.1.2.k.A9..........O.<...F.?PO6X..KY".H./.5-.*;|B.....d.%Y....A...r.&...~.H,.>.^.q.........9'.\+fn.]...th...S.piq<...9tuc3.

                                                                                          C:\Users\user\Desktop\VLZDGUKUTZ.xlsx.IEzr (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8641862424800175
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:whYiBUXJ5yVYhOXSDXtpcyGH6N12Mp/kjJ0u9pHP4mxVtZ6RuSzGNWbdhF:wFBU/KXSzt+yGi2Mp/EaAPrVZAuSSgb5
                                                                                          MD5:F771FFC48E839D01380588D9AA079F20
                                                                                          SHA1:8F10B789AB5A9E499CCA040026A8409FB012F3FA
                                                                                          SHA-256:D80EF17BBBF88E3FF721878D1C16592B59379F2F58B9AA330B7DA7C51FA6CD7F
                                                                                          SHA-512:4E0A7FAC33F412390B26E30B1BE57A2D65B0EEB18848A7C1B122DA5581826BC04D0077A438DF70686467D1BE3072C5CE6F5ABF3CD96A0F6ACEDC16C516DDAD9E
                                                                                          Malicious:false
                                                                                          Preview:#@H.&. ......M%..B2Tf.){..8....0./.5z`..4p......;.Gr.Bt...!...........yvT})...l-..O.Wi_..../O...&..r...@E../.].z)-.82......}....|.....On:..u..7...8\p3FU5.....!CAs..+../.I......W$....WY...)..B..k.-.:.4<..Fx....9.....Lo.....(.).....0H.......yS.....6..@.....n......)...s:i....%...S.dJi.[...,.tfw.....89iI...f.P .....{.N.m.#c.!.*Ffr)/u.... ,.^@...gO.\.....S....P.T"V.......R[.m..ru....[../.?....u|..H....qW~.85.R...U.E`.".q.$..Jb.....P....$^w... R.9T.N.p.M.....yK.U../......v..S.z.....}h.=....ow+..?}.5..5: ....>..M.V(.}.W.....\.}..3....4.6,.......3.E........,.bQ.;..s.......c.L.J..."\..C.....W...zBE..:.NBa...G.......).......oK...g...>.!.*A...6..s..arhGH..i%..m.X$......UV.<..~'<Y.6.-{>...d<.em....)m..c......6.....}.|...4"..W.'...9...t.b..=..K.D.R.BO..)e..a!%#e.(.^g@.\...`......K.4.........#./w..g ..^.K..Cy.....\.?...yc@(.1.2.k.A9..........O.<...F.?PO6X..KY".H./.5-.*;|B.....d.%Y....A...r.&...~.H,.>.^.q.........9'.\+fn.]...th...S.piq<...9tuc3.

                                                                                          C:\Users\user\Desktop\WKXEWIOTXI\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Desktop\XZXHAVGRAG.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.860948647196178
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:EcxgjqOb/M8SS7H0ExUEjTZuKV/qMcX4pjBECubELg8qFdWrAfiKhezQ/BemAS:EAgm0M8SS7H0ExUEvhqMcopjB/uYOF0I
                                                                                          MD5:AB446F6F2136D9DA3B0F15D83C12670A
                                                                                          SHA1:B67AEE106D4E2BC6C66750A48C5E98D16CDF1319
                                                                                          SHA-256:A52940327D5333622A12D322E44E5410C9EEB8A008ACC1FFD67B549F2202286E
                                                                                          SHA-512:B02CF1797672416AC502D997877E75776BC21890F1A21D8EC8F7A4F838E9DF28E7FB8F65EB214EED0EF5BCA0DFDD11B0789D4C8126AF8662300ACECDCB9A8760
                                                                                          Malicious:false
                                                                                          Preview:a...0T .W.$......J...?].i./..F....'WR....V...t.l.....*$..;. ..A..3...3F..."..]..t.`.....&...v..j.-p.~(.%.*fI.<....K..O>.... .s....!...-......7b0W.HP....)g...&?d.......fW...|..%0......Ev.4 .=...J.u........yu^.0.....(...n}..._C.O..z`...].X!C/V...l....h<..z.K.N.b0`.......B`OD..UNf.......z......C..".....OM;9.z;k:..b.?......L..>|......2..|K....?A..m..h.lV.I...M..+.j...m.U..WpH|5e.!.5.....rT!.V...E...>G...Y....e!+..km...<......z/J..e1...xL..'.<6..O.].....]T.........-+..>.E.Q^..J...k5.G.#..FsYn....N.R.".N.h......M.b(....t..k.0....Y...so.......grf.......5......^_..W1pV....Kj)@..M ._JF.5./.........Q...s.GM..z..l...9....yh.f1..U1.d..R.+2.....,. .su2...N.y..8...F...dz'..a.d.).P.W~..y.....Hr..D..K3.'C.Q.VF..R....>?...C.....-.....6...(../...I1x....[+.M.p...Aw.K_.B.*...6r......[Ht..^c.I..V.."MVy..*..@.h.......%C..S.E.OFU}Q...dG.b.\..).\..\.5...Z..c.T....{.. &....x..b.(..|...<.#.(S.Q^l.F*%.^G.N.a =...S..?6...}%.....>.1"'..f....)..5a.....3.Je..p

                                                                                          C:\Users\user\Desktop\XZXHAVGRAG.docx.JOwn (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.860948647196178
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:EcxgjqOb/M8SS7H0ExUEjTZuKV/qMcX4pjBECubELg8qFdWrAfiKhezQ/BemAS:EAgm0M8SS7H0ExUEvhqMcopjB/uYOF0I
                                                                                          MD5:AB446F6F2136D9DA3B0F15D83C12670A
                                                                                          SHA1:B67AEE106D4E2BC6C66750A48C5E98D16CDF1319
                                                                                          SHA-256:A52940327D5333622A12D322E44E5410C9EEB8A008ACC1FFD67B549F2202286E
                                                                                          SHA-512:B02CF1797672416AC502D997877E75776BC21890F1A21D8EC8F7A4F838E9DF28E7FB8F65EB214EED0EF5BCA0DFDD11B0789D4C8126AF8662300ACECDCB9A8760
                                                                                          Malicious:false
                                                                                          Preview:a...0T .W.$......J...?].i./..F....'WR....V...t.l.....*$..;. ..A..3...3F..."..]..t.`.....&...v..j.-p.~(.%.*fI.<....K..O>.... .s....!...-......7b0W.HP....)g...&?d.......fW...|..%0......Ev.4 .=...J.u........yu^.0.....(...n}..._C.O..z`...].X!C/V...l....h<..z.K.N.b0`.......B`OD..UNf.......z......C..".....OM;9.z;k:..b.?......L..>|......2..|K....?A..m..h.lV.I...M..+.j...m.U..WpH|5e.!.5.....rT!.V...E...>G...Y....e!+..km...<......z/J..e1...xL..'.<6..O.].....]T.........-+..>.E.Q^..J...k5.G.#..FsYn....N.R.".N.h......M.b(....t..k.0....Y...so.......grf.......5......^_..W1pV....Kj)@..M ._JF.5./.........Q...s.GM..z..l...9....yh.f1..U1.d..R.+2.....,. .su2...N.y..8...F...dz'..a.d.).P.W~..y.....Hr..D..K3.'C.Q.VF..R....>?...C.....-.....6...(../...I1x....[+.M.p...Aw.K_.B.*...6r......[Ht..^c.I..V.."MVy..*..@.h.......%C..S.E.OFU}Q...dG.b.\..).\..\.5...Z..c.T....{.. &....x..b.(..|...<.#.(S.Q^l.F*%.^G.N.a =...S..?6...}%.....>.1"'..f....)..5a.....3.Je..p

                                                                                          C:\Users\user\Desktop\XZXHAVGRAG.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.833089813806335
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:X3LfRoopISMYUcLIhdOd4E+VpcX7JbERqJgdlwkbHwPBEZPVFmd8thkO3:Lf+opIOIhdOd4E+ViX7JFipbHwiVFM8n
                                                                                          MD5:F23AAC50DCF779EE7ECC5EEBC1759B5F
                                                                                          SHA1:F25802085ED4822E4BA525E8706BD0E672014E05
                                                                                          SHA-256:3AC3BEA34C6F01D706788C0104E14BD8067E14D89CDFCE655581C9D8DEC02425
                                                                                          SHA-512:A9DD5BB2BAB8AB35D7F3EC45D86AA66039FE78D72D05DC13E941773D664E57D16E77040D13DAD2E3AC64B90033CC7D5DEF755018AE9D540FAEA3149158AFBB49
                                                                                          Malicious:false
                                                                                          Preview:7;B,.4.s^..v-..o..H..M.......j....z.n.g..!..Q.B......7s2..J.^Y...?.N`....g.L...6.n...z,.!.A.&..8C.L.b"'.K].9.P<.a.....c.M...q1s...<ZNh7...^.JE.S......E...\~......7..!..k.YS.zP..?2.Pt.g...O.R9Rn-(.x.i.e.....V......c:$....P...|8x...1"..~...h..,K.3...f....xL0..>............/..m.UP..Z...W...-z"....*..3..PJ.w=......6..%%....?......^....&....=._7.:.......<T>y..+...@2B7#..Q...N+).9b......Y.f.k..J.>[g..4#......G3Z./.....=s`O.;.u..7....c....u6..(..n........B..P..8.6:.(.C.....X....!;.Y.,...>._...]..D.....^.n.....B.....V.i.B{:m......n.!.&/.R./lNZ..7..'.u.d......AB..%..8.....t_."..`._dB.O..N?.....`... .....#9.*|...r,.....P......+.9bc.Bi...?._@M...E..2..\..en..gD.iu.Op....L.Y..r(}..Zj1e..<.H%........-m2&.H........Y....e...8.".....+.....rC.......P~......FIE.G.....7..k/...b........+.,..q$.OB.45S.N../..d..I..V.O..o].....#&.nI.d....R.a)..GA.L<{.....T........V.n..C.[m._...^|....v...~:,..|...<...Va.F.....3.TS.5s...?.........7N,........!;..ue.U...,...Q|A]

                                                                                          C:\Users\user\Desktop\XZXHAVGRAG.xlsx.LOvS (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.833089813806335
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:X3LfRoopISMYUcLIhdOd4E+VpcX7JbERqJgdlwkbHwPBEZPVFmd8thkO3:Lf+opIOIhdOd4E+ViX7JFipbHwiVFM8n
                                                                                          MD5:F23AAC50DCF779EE7ECC5EEBC1759B5F
                                                                                          SHA1:F25802085ED4822E4BA525E8706BD0E672014E05
                                                                                          SHA-256:3AC3BEA34C6F01D706788C0104E14BD8067E14D89CDFCE655581C9D8DEC02425
                                                                                          SHA-512:A9DD5BB2BAB8AB35D7F3EC45D86AA66039FE78D72D05DC13E941773D664E57D16E77040D13DAD2E3AC64B90033CC7D5DEF755018AE9D540FAEA3149158AFBB49
                                                                                          Malicious:false
                                                                                          Preview:7;B,.4.s^..v-..o..H..M.......j....z.n.g..!..Q.B......7s2..J.^Y...?.N`....g.L...6.n...z,.!.A.&..8C.L.b"'.K].9.P<.a.....c.M...q1s...<ZNh7...^.JE.S......E...\~......7..!..k.YS.zP..?2.Pt.g...O.R9Rn-(.x.i.e.....V......c:$....P...|8x...1"..~...h..,K.3...f....xL0..>............/..m.UP..Z...W...-z"....*..3..PJ.w=......6..%%....?......^....&....=._7.:.......<T>y..+...@2B7#..Q...N+).9b......Y.f.k..J.>[g..4#......G3Z./.....=s`O.;.u..7....c....u6..(..n........B..P..8.6:.(.C.....X....!;.Y.,...>._...]..D.....^.n.....B.....V.i.B{:m......n.!.&/.R./lNZ..7..'.u.d......AB..%..8.....t_."..`._dB.O..N?.....`... .....#9.*|...r,.....P......+.9bc.Bi...?._@M...E..2..\..en..gD.iu.Op....L.Y..r(}..Zj1e..<.H%........-m2&.H........Y....e...8.".....+.....rC.......P~......FIE.G.....7..k/...b........+.,..q$.OB.45S.N../..d..I..V.O..o].....#&.nI.d....R.a)..GA.L<{.....T........V.n..C.[m._...^|....v...~:,..|...<...Va.F.....3.TS.5s...?.........7N,........!;..ue.U...,...Q|A]

                                                                                          C:\Users\user\Desktop\XZXHAVGRAG\DVWHKMNFNN.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.81772468862071
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:nsA+BlPzSu4oENYI/TPO4YWrDgNqrD5D/4BKJ7ayMQhiMJXalL7+:nsrTPWuD2/TmsEMx/4gdWQhiWqs
                                                                                          MD5:24EF3CCE2D67E98437C0BCFA15697403
                                                                                          SHA1:A3377065F2AEA07417B5664584214CEE41607CC6
                                                                                          SHA-256:22A37C44F447D47D302D63E2B9E7660E255EE6F4030D4DBCF328783DB040167B
                                                                                          SHA-512:41DF27C7AFE30D017825EACD279B1E488E06E31BACA4636AC564DE2A10A680782DFBBC0BBEFA1496840E283B9D75971072574FF41A89CD88188ED1C1BA92C564
                                                                                          Malicious:false
                                                                                          Preview:..f.i..:.).....A..%......^.y...y.SHc.3G.p'>.J%a+.qj......L........i.o..>-.....%...:1..on.x...=U~.'>tnN........-v1....w.k.l...6....(Q....~...S|.>e.........A.i..6y2..:g...r.m.k..M.i..t.D. .i_pb.,u.ZB.2.........-.n}...~.l....|....v._.BK ..[yz4Y.d..8>#8......^....i..V-...L.1F..WDI+....r..K.j........`e.._...~...."...........6..WB]NX.)V.......K._Y7.....o.<i..F..7...J>....N?Ul...(..P..C......GbN..=..._.%.....gI......:?.... .1)...!.......5.....{.....l..^+S.2.m...........q....-w\.I=.7..m.0.........e...P..a4.=...~...Co.....}...D.?+.gi^...M<......@.N..4.....r+#...tdb~.C>.G&..9..[0.iQ.4.-.`&.....O.%!./......M......+.....o.r8-.&.. ..G.r.F..J.:t....=p.`..2...f.....?....(...........2.`.T....v...D,Mz.e.......|<.PJW..^0\0...y.'.........c...1[.[.m3.G...Z...m.h.B#S..p.)l...~Z@....U8&.....G.....'p.s...@....o.a.e_P4#M.D...Y..Y....?.F.........|..9..!..i.......p..xq.c....LFaz0..<..F.Rd\..Z~R.....2...^c80..y..].R/...I.y.m.5.....X.D....O,.......q..i..O.S.C

                                                                                          C:\Users\user\Desktop\XZXHAVGRAG\DVWHKMNFNN.jpg.pFCN (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.81772468862071
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:nsA+BlPzSu4oENYI/TPO4YWrDgNqrD5D/4BKJ7ayMQhiMJXalL7+:nsrTPWuD2/TmsEMx/4gdWQhiWqs
                                                                                          MD5:24EF3CCE2D67E98437C0BCFA15697403
                                                                                          SHA1:A3377065F2AEA07417B5664584214CEE41607CC6
                                                                                          SHA-256:22A37C44F447D47D302D63E2B9E7660E255EE6F4030D4DBCF328783DB040167B
                                                                                          SHA-512:41DF27C7AFE30D017825EACD279B1E488E06E31BACA4636AC564DE2A10A680782DFBBC0BBEFA1496840E283B9D75971072574FF41A89CD88188ED1C1BA92C564
                                                                                          Malicious:false
                                                                                          Preview:..f.i..:.).....A..%......^.y...y.SHc.3G.p'>.J%a+.qj......L........i.o..>-.....%...:1..on.x...=U~.'>tnN........-v1....w.k.l...6....(Q....~...S|.>e.........A.i..6y2..:g...r.m.k..M.i..t.D. .i_pb.,u.ZB.2.........-.n}...~.l....|....v._.BK ..[yz4Y.d..8>#8......^....i..V-...L.1F..WDI+....r..K.j........`e.._...~...."...........6..WB]NX.)V.......K._Y7.....o.<i..F..7...J>....N?Ul...(..P..C......GbN..=..._.%.....gI......:?.... .1)...!.......5.....{.....l..^+S.2.m...........q....-w\.I=.7..m.0.........e...P..a4.=...~...Co.....}...D.?+.gi^...M<......@.N..4.....r+#...tdb~.C>.G&..9..[0.iQ.4.-.`&.....O.%!./......M......+.....o.r8-.&.. ..G.r.F..J.:t....=p.`..2...f.....?....(...........2.`.T....v...D,Mz.e.......|<.PJW..^0\0...y.'.........c...1[.[.m3.G...Z...m.h.B#S..p.)l...~Z@....U8&.....G.....'p.s...@....o.a.e_P4#M.D...Y..Y....?.F.........|..9..!..i.......p..xq.c....LFaz0..<..F.Rd\..Z~R.....2...^c80..y..].R/...I.y.m.5.....X.D....O,.......q..i..O.S.C

                                                                                          C:\Users\user\Desktop\XZXHAVGRAG\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Desktop\XZXHAVGRAG\KATAXZVCPS.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.825718172791949
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:N3x0FqcPdbjq25MWDT+DSKc1vLlBkZBuiKBJFFtn5zhsgBKuoJHK1EjEuJj:yBlPqbDSzvLlgKBJnhsgsuoJHKuR
                                                                                          MD5:10FDE5E3A4982E2D07E04F91C99843F2
                                                                                          SHA1:977E3E4B54AA21F2885CC14BA5862A5AE3939FCE
                                                                                          SHA-256:9FDD404F27DE2E66BF068B0FCBF01D18150D9C4FAE45A46C056B020F512B93BE
                                                                                          SHA-512:50CE85839C4D0BC7B79A3E8EA8975F2B654D9156CF2FF240069BF1BF7208F336E1A72B26177267E7AF0BC156E6B13A8C097749D7D7552665F78485B5CD0F23D4
                                                                                          Malicious:false
                                                                                          Preview:....F..)..u.e.....Ax]wo>..;...8.q$..6.54.J.~......U.s...<c.a.....~...M......\....4....^.2..qU..F....d."c..4.C.SW...`.r`EB.n.K;...z...Q..l..{..qx...f.j...xk....W.R..`.HN..Lm..3.*.y.<a..S.s.......Z(.u.......d.@?}-..e..T:.f$.mF.AXDB..\..j(.z.qY.wY;.%.i..k.._......(..w.D....u..l/..<<(.. q.o...+...-..t$t6.P.u.j...#.j...!i...6.C.#..^[...x.$......p.z..X...ez..a.<P.G.(.r..}r..%..h.O:'......5...F.{...C....2.z....E..\&.N|'.../......7Pg...'C.....u.^a.f1...0|......B.<.G..]l.zG..Qn...e.gN.M.Z......F"-.U..(.../J.o...u..-Yp....._j..M..R(.+R:......|M....d...V....;...`.w....;q..... Y...aUA....}...?.X...E.ZG....q@..y..'.?}.<.]40b.T..-d....<....Xz...XyUB8.......[.kty>...lH.................I....j.8".bS......w..7Z ..7I.z...7.B....Id.$...'g.`..k...o|&.E....DV`3...-L..$...m.....;N!...M.-+..d.|E...:.VyA3zd/.y.{QJ.m.......4^.iq"c.o.qJ7e. h0P}P...*wo...d..7..B........TU.w...`jKW.55.w_.5o.K&.s(&!<.....+R.2.V.P..G)..5...u4...H0....KK....*..Y.{Z`.*

                                                                                          C:\Users\user\Desktop\XZXHAVGRAG\KATAXZVCPS.pdf.Csvh (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.825718172791949
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:N3x0FqcPdbjq25MWDT+DSKc1vLlBkZBuiKBJFFtn5zhsgBKuoJHK1EjEuJj:yBlPqbDSzvLlgKBJnhsgsuoJHKuR
                                                                                          MD5:10FDE5E3A4982E2D07E04F91C99843F2
                                                                                          SHA1:977E3E4B54AA21F2885CC14BA5862A5AE3939FCE
                                                                                          SHA-256:9FDD404F27DE2E66BF068B0FCBF01D18150D9C4FAE45A46C056B020F512B93BE
                                                                                          SHA-512:50CE85839C4D0BC7B79A3E8EA8975F2B654D9156CF2FF240069BF1BF7208F336E1A72B26177267E7AF0BC156E6B13A8C097749D7D7552665F78485B5CD0F23D4
                                                                                          Malicious:false
                                                                                          Preview:....F..)..u.e.....Ax]wo>..;...8.q$..6.54.J.~......U.s...<c.a.....~...M......\....4....^.2..qU..F....d."c..4.C.SW...`.r`EB.n.K;...z...Q..l..{..qx...f.j...xk....W.R..`.HN..Lm..3.*.y.<a..S.s.......Z(.u.......d.@?}-..e..T:.f$.mF.AXDB..\..j(.z.qY.wY;.%.i..k.._......(..w.D....u..l/..<<(.. q.o...+...-..t$t6.P.u.j...#.j...!i...6.C.#..^[...x.$......p.z..X...ez..a.<P.G.(.r..}r..%..h.O:'......5...F.{...C....2.z....E..\&.N|'.../......7Pg...'C.....u.^a.f1...0|......B.<.G..]l.zG..Qn...e.gN.M.Z......F"-.U..(.../J.o...u..-Yp....._j..M..R(.+R:......|M....d...V....;...`.w....;q..... Y...aUA....}...?.X...E.ZG....q@..y..'.?}.<.]40b.T..-d....<....Xz...XyUB8.......[.kty>...lH.................I....j.8".bS......w..7Z ..7I.z...7.B....Id.$...'g.`..k...o|&.E....DV`3...-L..$...m.....;N!...M.-+..d.|E...:.VyA3zd/.y.{QJ.m.......4^.iq"c.o.qJ7e. h0P}P...*wo...d..7..B........TU.w...`jKW.55.w_.5o.K&.s(&!<.....+R.2.V.P..G)..5...u4...H0....KK....*..Y.{Z`.*

                                                                                          C:\Users\user\Desktop\XZXHAVGRAG\NWTVCDUMOB.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8497850625865615
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:xCAU048h6M9prSixzEBRO1qlUMwW+5O7d8lhPklRZbB+U9pK6xu2:pv/djWiaBz+r5Op8HPkDZbUUfZF
                                                                                          MD5:D0341D3557851B3882EB72A292C06253
                                                                                          SHA1:5C728E5A68B5CBEB695370E73EA886C208BAF8B6
                                                                                          SHA-256:1C21F5EF8250F0005B43FE8B33D2B5228311CA0C053E0B2575E4A06626B16C90
                                                                                          SHA-512:506E810B0F5076870A154F7E79BE081DB78DC1D8B986C7910FCBDCEF3ED062F79AE204BD3D6250E8AE2A6A92C65631544D63E00B9597EDDF3B8242E028EBF415
                                                                                          Malicious:false
                                                                                          Preview:.|..yks..U..P..N..#[d..k.4.l...mu.-..bQ.@Y..Q\....Vj.1.(..[W6m2p?Q.........(.@H._.f..w.Y..D._.Y....).i.%..UH_.~...`.M.3....D....KsX.r ..G.6..........T....Sa......8..U.NI...W..3...Wb@`.i..C.+.(.2.>1$. .#......`-T.o...^H5..VS..U..S.....o._...H...xF..FU...Yb.Q\.J.;...an.18....#.j=...*..]..3}G..o=f...Ru.. K...@.H>...e'.,.E.0...1X..{S....-j4._...m7.89i...*.......+r.QDEH.).A..p..?....=.....0.8F......r...E.~.6.......B.$.(.F....,.U.....-..l_...P..8.R.C(...9...@......w.R.3.#...s....+....E....iGK..t...0..{'V....<..O<kL^.q&C./w....w..t..Z.|..nO.P.'..F3+..GG.R.F......i.......d...K.../.n..@T..%P...h...fD..R?......"...Q........G..c.X...)"..UL.....p.{.9..G.......}.<.!a0.%.%*.'aT..^V.pj;..[..Z._.n....D!.O.})>.g.w.r.s.vd...Du..\..-.0 .~...x.c....y..h.._.!........$#|...V........-Q......#=.8y..o.#..v.X.].... in.Hp.R.._a.{....S.H.........Pi:.{0D....5e.5s.`.....$......y...-.ig..;...c.Tf.....qtr[r..`C.....S.[,l..1[...5vI.N.l.C6]...B..]..pauA3.#]I.D..#....J.....)

                                                                                          C:\Users\user\Desktop\XZXHAVGRAG\NWTVCDUMOB.png.KBLp (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8497850625865615
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:xCAU048h6M9prSixzEBRO1qlUMwW+5O7d8lhPklRZbB+U9pK6xu2:pv/djWiaBz+r5Op8HPkDZbUUfZF
                                                                                          MD5:D0341D3557851B3882EB72A292C06253
                                                                                          SHA1:5C728E5A68B5CBEB695370E73EA886C208BAF8B6
                                                                                          SHA-256:1C21F5EF8250F0005B43FE8B33D2B5228311CA0C053E0B2575E4A06626B16C90
                                                                                          SHA-512:506E810B0F5076870A154F7E79BE081DB78DC1D8B986C7910FCBDCEF3ED062F79AE204BD3D6250E8AE2A6A92C65631544D63E00B9597EDDF3B8242E028EBF415
                                                                                          Malicious:false
                                                                                          Preview:.|..yks..U..P..N..#[d..k.4.l...mu.-..bQ.@Y..Q\....Vj.1.(..[W6m2p?Q.........(.@H._.f..w.Y..D._.Y....).i.%..UH_.~...`.M.3....D....KsX.r ..G.6..........T....Sa......8..U.NI...W..3...Wb@`.i..C.+.(.2.>1$. .#......`-T.o...^H5..VS..U..S.....o._...H...xF..FU...Yb.Q\.J.;...an.18....#.j=...*..]..3}G..o=f...Ru.. K...@.H>...e'.,.E.0...1X..{S....-j4._...m7.89i...*.......+r.QDEH.).A..p..?....=.....0.8F......r...E.~.6.......B.$.(.F....,.U.....-..l_...P..8.R.C(...9...@......w.R.3.#...s....+....E....iGK..t...0..{'V....<..O<kL^.q&C./w....w..t..Z.|..nO.P.'..F3+..GG.R.F......i.......d...K.../.n..@T..%P...h...fD..R?......"...Q........G..c.X...)"..UL.....p.{.9..G.......}.<.!a0.%.%*.'aT..^V.pj;..[..Z._.n....D!.O.})>.g.w.r.s.vd...Du..\..-.0 .~...x.c....y..h.._.!........$#|...V........-Q......#=.8y..o.#..v.X.].... in.Hp.R.._a.{....S.H.........Pi:.{0D....5e.5s.`.....$......y...-.ig..;...c.Tf.....qtr[r..`C.....S.[,l..1[...5vI.N.l.C6]...B..]..pauA3.#]I.D..#....J.....)

                                                                                          C:\Users\user\Desktop\XZXHAVGRAG\VLZDGUKUTZ.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.82326770556599
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:0WK5MEJthGjFrKI0FmWNh7KVt7XD/KV0YWJbE47Bf1dZqFuD2+7d/OPrH:0WKWOgjFEFfz7A7XDKI9E4lXZ+u6+7du
                                                                                          MD5:6B62CF0B8AB4E891D213A49F9718DE7D
                                                                                          SHA1:9D866A6CEC89A65FE8093EE590D1A8642CEFECE8
                                                                                          SHA-256:DE959AB4FBFF806C92655C42F3D2CAFC5F1EE674FCE9DC4787200EE9C2574EB0
                                                                                          SHA-512:0B5EE13B58840B051AA2473AB685AC9E63344B57069346EFC9E3D2887807B3BF77573A0CDE4B21AAD7C395C06EEE86FC393C02B433259FBEE0515017EBE2613D
                                                                                          Malicious:false
                                                                                          Preview:..oK+...mA.....\.L.....p......4.i.D..(...0..s..>.........3.'C.L4.s.m|...5_..\.P..O.B[U'-.=..P.".}...y.z..J.B{..jt.U..^.H.Yg.]L.(....^dL....i...9.....qs...K...)..|...J6....n%...5..\ G..O..[{..]H.yJM...U..0E4..!....X.(:......r.?....m.....W.....A......L...y...S....a.b..~..V....\.7....M....w...;f.G.b.A....?C..'.j.W....Mf...U;!..6.dZ..2.{..s@..tW. .l........B9..S5.}EB..N..t...].i.e.%*!c.h.....q..p..b....P..v...{.sCN.U.U...s....tX...x..~.)S.Ns.........,g....&.....5..1.'.U.A.XA+d..M.......q.^c....=.....B..GVss.V..*j#......)......A..O..c......U64z.d.'....v..1.m$0.U.....L]..f...A_2C.W.v.A.......bP... .Y.o.e..1...Q.\,.x.N5..6......F..W.W.&T[.v......r..N....+.g,.7........3.@....=....L......j..$F....C.HU..x......Gi.;....}.dP.#.._...........Um..... .01..w...1..S.i.1YK..]..o..q._..:.k.\R}0..%.(sJ9g..V.p..p...B..wz.Us16 l.Z9..#..b.....o....n.Q...g&...?.Y..-f.....1-|8.....7...>i....h...:.......G...f....M.,!....Afw.|.<.T..C|.G..(..H..%=O?..yb`.......

                                                                                          C:\Users\user\Desktop\XZXHAVGRAG\VLZDGUKUTZ.xlsx.XvNB (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.82326770556599
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:0WK5MEJthGjFrKI0FmWNh7KVt7XD/KV0YWJbE47Bf1dZqFuD2+7d/OPrH:0WKWOgjFEFfz7A7XDKI9E4lXZ+u6+7du
                                                                                          MD5:6B62CF0B8AB4E891D213A49F9718DE7D
                                                                                          SHA1:9D866A6CEC89A65FE8093EE590D1A8642CEFECE8
                                                                                          SHA-256:DE959AB4FBFF806C92655C42F3D2CAFC5F1EE674FCE9DC4787200EE9C2574EB0
                                                                                          SHA-512:0B5EE13B58840B051AA2473AB685AC9E63344B57069346EFC9E3D2887807B3BF77573A0CDE4B21AAD7C395C06EEE86FC393C02B433259FBEE0515017EBE2613D
                                                                                          Malicious:false
                                                                                          Preview:..oK+...mA.....\.L.....p......4.i.D..(...0..s..>.........3.'C.L4.s.m|...5_..\.P..O.B[U'-.=..P.".}...y.z..J.B{..jt.U..^.H.Yg.]L.(....^dL....i...9.....qs...K...)..|...J6....n%...5..\ G..O..[{..]H.yJM...U..0E4..!....X.(:......r.?....m.....W.....A......L...y...S....a.b..~..V....\.7....M....w...;f.G.b.A....?C..'.j.W....Mf...U;!..6.dZ..2.{..s@..tW. .l........B9..S5.}EB..N..t...].i.e.%*!c.h.....q..p..b....P..v...{.sCN.U.U...s....tX...x..~.)S.Ns.........,g....&.....5..1.'.U.A.XA+d..M.......q.^c....=.....B..GVss.V..*j#......)......A..O..c......U64z.d.'....v..1.m$0.U.....L]..f...A_2C.W.v.A.......bP... .Y.o.e..1...Q.\,.x.N5..6......F..W.W.&T[.v......r..N....+.g,.7........3.@....=....L......j..$F....C.HU..x......Gi.;....}.dP.#.._...........Um..... .01..w...1..S.i.1YK..]..o..q._..:.k.\R}0..%.(sJ9g..V.p..p...B..wz.Us16 l.Z9..#..b.....o....n.Q...g&...?.Y..-f.....1-|8.....7...>i....h...:.......G...f....M.,!....Afw.|.<.T..C|.G..(..H..%=O?..yb`.......

                                                                                          C:\Users\user\Desktop\XZXHAVGRAG\XZXHAVGRAG.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.864528230526494
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1sDK5GIZ4eOus94sKEnBEE6AYL2v8TTk8u9Buwcq/r9NWrHGIptI8RI8x8a5/j0E:1+6GIZT9s9BNYav8TTktYwnrcHZpbK8D
                                                                                          MD5:4CB96CB1C61040F71450D258282DDE96
                                                                                          SHA1:36AADAFF7A97B11D6238BB66C74FDB85E1F65731
                                                                                          SHA-256:C8EC97EDE1B996B844E7B96F657D86061B2D9FDCDA3BF6A8496A539FB985BB1F
                                                                                          SHA-512:08074E63169670B5B6173130B8BAF76FEB2BBC0ECCF8DD5A64FA576612BB9EC2DC6BFD779E1A936DBFB464840B35249ED8C46C6292D512624B304A3F9448A32D
                                                                                          Malicious:false
                                                                                          Preview:...lz.x.t..)..-.:..k...=...p.,.....N.J.R.a....3.j^>.D.v.....v.r\..l0....0a..I..... ".....+e.M...O....V.../.1.&h..i..J./..b......F.n..|.'y...G)/..L.6.x.6....=..N9.%.4rF.G..j-r...D...)...G..iu9.g~..z.f!8|.5.]....|..-.....;..=.....o....V...i...<_!.WF....'u.-...#.&}..q.Vx.....o.E...e....9FJ.F/..L...].....ST@....C"E..s.*....|.p...z.K....E.....w2u..\k.i..u'..=$.22?+...l.(..yX.G..L.<R.i.....4....[..\4........T.........c........&.h+...c..P..#bd.^....P#...`.].s.../..~p..H@....A....N..eR.C/Y..+.#&/fK."..d.*aC~>...\.T..[s.4...Lu....wG.|...At...u@\....F.H..K..n.m..XAZ8..b..S......X...]2..Y.I.j...s.6.;.2G|.?N.o.....G8....g.@...../.o^..F.......^$!.g.NKhfH.&...~.l..P.N.^'RnW .....N..l.....w@.\.&n <..6....F.~4...5..]&:...=..v..AE....jT..O.AM.]...]2>...Eo.......{..*c.:....{...I....B@...y`....Q`..{..e..(...X......`l.t....^P.<...(.D......ax0.E...s...*y.V=.o".N..)!.Q").<h.......*.=..2e.A..42j..&.u.u.|.o".!.._U.A..B.r.v.R).O..6p}8..(..&....-z...E.DS.

                                                                                          C:\Users\user\Desktop\XZXHAVGRAG\XZXHAVGRAG.docx.xkAb (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.864528230526494
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1sDK5GIZ4eOus94sKEnBEE6AYL2v8TTk8u9Buwcq/r9NWrHGIptI8RI8x8a5/j0E:1+6GIZT9s9BNYav8TTktYwnrcHZpbK8D
                                                                                          MD5:4CB96CB1C61040F71450D258282DDE96
                                                                                          SHA1:36AADAFF7A97B11D6238BB66C74FDB85E1F65731
                                                                                          SHA-256:C8EC97EDE1B996B844E7B96F657D86061B2D9FDCDA3BF6A8496A539FB985BB1F
                                                                                          SHA-512:08074E63169670B5B6173130B8BAF76FEB2BBC0ECCF8DD5A64FA576612BB9EC2DC6BFD779E1A936DBFB464840B35249ED8C46C6292D512624B304A3F9448A32D
                                                                                          Malicious:false
                                                                                          Preview:...lz.x.t..)..-.:..k...=...p.,.....N.J.R.a....3.j^>.D.v.....v.r\..l0....0a..I..... ".....+e.M...O....V.../.1.&h..i..J./..b......F.n..|.'y...G)/..L.6.x.6....=..N9.%.4rF.G..j-r...D...)...G..iu9.g~..z.f!8|.5.]....|..-.....;..=.....o....V...i...<_!.WF....'u.-...#.&}..q.Vx.....o.E...e....9FJ.F/..L...].....ST@....C"E..s.*....|.p...z.K....E.....w2u..\k.i..u'..=$.22?+...l.(..yX.G..L.<R.i.....4....[..\4........T.........c........&.h+...c..P..#bd.^....P#...`.].s.../..~p..H@....A....N..eR.C/Y..+.#&/fK."..d.*aC~>...\.T..[s.4...Lu....wG.|...At...u@\....F.H..K..n.m..XAZ8..b..S......X...]2..Y.I.j...s.6.;.2G|.?N.o.....G8....g.@...../.o^..F.......^$!.g.NKhfH.&...~.l..P.N.^'RnW .....N..l.....w@.\.&n <..6....F.~4...5..]&:...=..v..AE....jT..O.AM.]...]2>...Eo.......{..*c.:....{...I....B@...y`....Q`..{..e..(...X......`l.t....^P.<...(.D......ax0.E...s...*y.V=.o".N..)!.Q").<h.......*.=..2e.A..42j..&.u.u.|.o".!.._U.A..B.r.v.R).O..6p}8..(..&....-z...E.DS.

                                                                                          C:\Users\user\Desktop\XZXHAVGRAG\YPSIACHYXW.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.860349363695174
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:yBhxt+ylnXjJBcJJ3eN0Il2vbIt0ACD1bp+dylWD/lB6Itm1zrwVru:6bZBXjPgzIxbCdAdyYH6o4wRu
                                                                                          MD5:6D7588C16E5E0F5E3B14C09860BA86EC
                                                                                          SHA1:A81D870186D7AE22677C07466D40E2D2921F2C12
                                                                                          SHA-256:54C51402D622E61E7B2A26CE8D563DBD6E0E6A2ABE6FB4248011CFF019D1BFB1
                                                                                          SHA-512:FB564EFEB4BBABA5D85CAF174F63624DC17D1F49C63184CF58777E06A6D43863CFB3B046279C83B3959206C478048CDB8BAB69B92D6F07CE7581ED697E23ED74
                                                                                          Malicious:false
                                                                                          Preview:..,...t.......=g.IF...g.* ...T...6...B)v...W..J..UL6.;.....,{.......(....SJ...1S....\@.O.j_.d...~G..;..../.:p..'..q#X..c.m...dbN............LH....P...B....L.8.x.mk.5...A".Y..7....4.t.4V.t..iE/..p0.1.c.b.\U..f..3..+^..@....K...?..NM..5.;g0uel.......f...fD..3r...Z.Fu..A...w......7.........H..~..p..:.....@..".....:.F.V_k'.o......u....VZ...Y'..Y...'5.......x.I......5.{.i...(..G{..X.G}....../.l.e...vr..O.........3ok.+.A.f...)..s..?u.I.D....Pl.V.B..B.}?}p...Y4..h........p.>..i.i..-F.bQJ...d*9M.+......0.._.k....k..!xK.6.H......5..Ne-C............&Qd.?.;...^ .5...=K...h2....{.&.>.Wa..,...k).8So..[..5.......Vy...K..3|p...e..[.b7.......M....z...]EAT.o..8O......1...x....d......*AU...M.3Z/J.......k&&..R...!&..-....I.\...R....{Z..fH3....W.y#......L..v.8.$?.^8..c`o.$o.M..A.........3.^~.\.>b.....k.F.2^...zzm.~.Dx..I..#j6...2......q..f.,.6......... ..P.....F..k+.Xp..I..!....!{>mMtU.b.....F.!@....x.Jr!ZP....TW.I}v6...SH........xLZ.-.#B.w6.V..d.Bg.

                                                                                          C:\Users\user\Desktop\XZXHAVGRAG\YPSIACHYXW.mp3.VfLX (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.860349363695174
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:yBhxt+ylnXjJBcJJ3eN0Il2vbIt0ACD1bp+dylWD/lB6Itm1zrwVru:6bZBXjPgzIxbCdAdyYH6o4wRu
                                                                                          MD5:6D7588C16E5E0F5E3B14C09860BA86EC
                                                                                          SHA1:A81D870186D7AE22677C07466D40E2D2921F2C12
                                                                                          SHA-256:54C51402D622E61E7B2A26CE8D563DBD6E0E6A2ABE6FB4248011CFF019D1BFB1
                                                                                          SHA-512:FB564EFEB4BBABA5D85CAF174F63624DC17D1F49C63184CF58777E06A6D43863CFB3B046279C83B3959206C478048CDB8BAB69B92D6F07CE7581ED697E23ED74
                                                                                          Malicious:false
                                                                                          Preview:..,...t.......=g.IF...g.* ...T...6...B)v...W..J..UL6.;.....,{.......(....SJ...1S....\@.O.j_.d...~G..;..../.:p..'..q#X..c.m...dbN............LH....P...B....L.8.x.mk.5...A".Y..7....4.t.4V.t..iE/..p0.1.c.b.\U..f..3..+^..@....K...?..NM..5.;g0uel.......f...fD..3r...Z.Fu..A...w......7.........H..~..p..:.....@..".....:.F.V_k'.o......u....VZ...Y'..Y...'5.......x.I......5.{.i...(..G{..X.G}....../.l.e...vr..O.........3ok.+.A.f...)..s..?u.I.D....Pl.V.B..B.}?}p...Y4..h........p.>..i.i..-F.bQJ...d*9M.+......0.._.k....k..!xK.6.H......5..Ne-C............&Qd.?.;...^ .5...=K...h2....{.&.>.Wa..,...k).8So..[..5.......Vy...K..3|p...e..[.b7.......M....z...]EAT.o..8O......1...x....d......*AU...M.3Z/J.......k&&..R...!&..-....I.\...R....{Z..fH3....W.y#......L..v.8.$?.^8..c`o.$o.M..A.........3.^~.\.>b.....k.F.2^...zzm.~.Dx..I..#j6...2......q..f.,.6......... ..P.....F..k+.Xp..I..!....!{>mMtU.b.....F.!@....x.Jr!ZP....TW.I}v6...SH........xLZ.-.#B.w6.V..d.Bg.

                                                                                          C:\Users\user\Desktop\YPSIACHYXW.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.846836241610119
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:nuyHcQ+jPEpiSExLIFOVZhvscD7Eem0R3dOA01unONm480+aluBSwAv:nRzpifxoeDx3Eo8L1LX+uOSwAv
                                                                                          MD5:7ED33C1DF050EB45444C74D3770356ED
                                                                                          SHA1:162A3F6A37F3451A5189299C105CCB85F291561C
                                                                                          SHA-256:7189DD9315CF151B33F62D7E3D580A46B286578B5044630ED05B270F469EFC65
                                                                                          SHA-512:5D4FC64BCD9FD45C5ABDDAC03C14687356FCD735A028746C70958C163AD89B43FF220FE57E6EC9494C5982D6518942DAA98E33E3ACB88B682A6C65DD0C346DAD
                                                                                          Malicious:false
                                                                                          Preview:w..b...Q.w...N.....D..I.4g.....+.m.. .|.3[uP.q.j.F|cKk.....R..5..0.Q.=._#...qG..R.....+M.}s!.<.nD..F...i.j.....d!..{..d:.X..A.M.y..#.....h.^.F.W...........u..^..k..j.T.p..$M$ [..s....f...U662T.....o.M.fa.k.C...@z!.........p.L......nL......q3.'. ..;.C......9....@&.....Q......A....2..W...............n.7..../*.e.h....E...z+z........=.d....}R...:....d.Q..:...]..U..*1.0.%L...LV...<.<.nl....A.OXD+...H......_.Z).*.W.8JN?.....`F..../....;...[!...L.y.B.......a...H.\.....Zt.W....&...O...n.R.-..e.b..Y..o....8..........B.t......{..9....Yp..v(0.......F._v.j.K1.2..5....d...X..Kl.w...z.`q$.miV.#i.o..|.yY....|..8.._v.0..F..eX.&J..'=d#..n..@u... 9....(:.........K3.i!...~9....U9...K.....c.R.....j..cV.B.'-..`..Bk$..3..2...8J.Uc....j..F....^.Z.....=....F09.{[..h6O'.*~0......iP.y..nC.Y5...x.h...L.......i.Jh...b.....(.z....4.0....p...?q2..{......v. ...#..Ua...cZ..U..U...:...hf.-..1..........2n.\......@D]j.y.c..O.!...`...>R.A5.H...v.....xc:..........

                                                                                          C:\Users\user\Desktop\YPSIACHYXW.jpg.jzDq (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.846836241610119
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:nuyHcQ+jPEpiSExLIFOVZhvscD7Eem0R3dOA01unONm480+aluBSwAv:nRzpifxoeDx3Eo8L1LX+uOSwAv
                                                                                          MD5:7ED33C1DF050EB45444C74D3770356ED
                                                                                          SHA1:162A3F6A37F3451A5189299C105CCB85F291561C
                                                                                          SHA-256:7189DD9315CF151B33F62D7E3D580A46B286578B5044630ED05B270F469EFC65
                                                                                          SHA-512:5D4FC64BCD9FD45C5ABDDAC03C14687356FCD735A028746C70958C163AD89B43FF220FE57E6EC9494C5982D6518942DAA98E33E3ACB88B682A6C65DD0C346DAD
                                                                                          Malicious:false
                                                                                          Preview:w..b...Q.w...N.....D..I.4g.....+.m.. .|.3[uP.q.j.F|cKk.....R..5..0.Q.=._#...qG..R.....+M.}s!.<.nD..F...i.j.....d!..{..d:.X..A.M.y..#.....h.^.F.W...........u..^..k..j.T.p..$M$ [..s....f...U662T.....o.M.fa.k.C...@z!.........p.L......nL......q3.'. ..;.C......9....@&.....Q......A....2..W...............n.7..../*.e.h....E...z+z........=.d....}R...:....d.Q..:...]..U..*1.0.%L...LV...<.<.nl....A.OXD+...H......_.Z).*.W.8JN?.....`F..../....;...[!...L.y.B.......a...H.\.....Zt.W....&...O...n.R.-..e.b..Y..o....8..........B.t......{..9....Yp..v(0.......F._v.j.K1.2..5....d...X..Kl.w...z.`q$.miV.#i.o..|.yY....|..8.._v.0..F..eX.&J..'=d#..n..@u... 9....(:.........K3.i!...~9....U9...K.....c.R.....j..cV.B.'-..`..Bk$..3..2...8J.Uc....j..F....^.Z.....=....F09.{[..h6O'.*~0......iP.y..nC.Y5...x.h...L.......i.Jh...b.....(.z....4.0....p...?q2..{......v. ...#..Ua...cZ..U..U...:...hf.-..1..........2n.\......@D]j.y.c..O.!...`...>R.A5.H...v.....xc:..........

                                                                                          C:\Users\user\Desktop\YPSIACHYXW.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.825656151864795
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:OXepoAgixQZPt6i3gS1qv84yNlode20H+y3M2ITPWsAbfoKAeYbWS:/gixwPtb3zqvH0H+y3Iz8NAeYJ
                                                                                          MD5:27EDC22FCA16814ACD4635159A6CAEA9
                                                                                          SHA1:6A741CE2987C5621386B287C89BD756AE443AF17
                                                                                          SHA-256:4BBFD9288C6E3A651B718D9A708781FAC7162F3943D5D8395BC55E8F935B7673
                                                                                          SHA-512:65068DE227F5D8BB7539D18FDC10651754761EF5FD4CE021AE740797D41E62EF0F73277DE19C69216A8E3F5BC6B363FF01AF23546E400D04626826DD7A815DB2
                                                                                          Malicious:false
                                                                                          Preview:Ku.~....(...c..?.4.QO.Jk.==`.I...........Z...s.1.7......8.i.. n.y.*..z..t.l.1.<....OS.q......9..M~....I^.|]?*.....V....M..R./4.....J.3.....7.m....Y..P.#..A.=9"R....x...R.....80.....,....nz.>.......i.BR...$..Aa.o..&..vZ......+`/^.Sz...w..7........sN....u....V.A......,O...">N(.....4........t..Y.lW.Y(p.>.D.q..#9...?pB.0.%..n......&8'1...x50...W.Y~.o...9.@.&x.3.....v1a[..ca......i~..8~..L.=h."&?dI]I~....n.4B.).~.....(..A.s].U|X.....*.Y3#tD...2..+(V[.B.M..s...S.s.....B .Z.\..<n.M....,{3..~.N.....K...2*=.>y.....ld.m...z..Gz4.#./.D/....-$.....P..z........ .$........4YU.....wEuX.J..!.@k.G.8..H..5.s.li.t.y.Rh}X..q..P/..Q.d..o....1s=.^0..v..\(bD..<.......7...O....r.{.2.+...V....!.*gc.{.(.>xy/....in;.o.|4y$#0...........0'..Y..1..6.|.2./|....H..-./....?p.B.G#.j.. ..[b\..z.J+..w..k....Y;...g..<}.Hn.......t.ST....T.._.O.L}..(...........}+.E/.O.:OK.u(..5.....iB..9.{..i.'.N...[...&.R9D..a.I.m..Y.#.'.ApQ*....{T..M....................0>S...Q

                                                                                          C:\Users\user\Desktop\YPSIACHYXW.mp3.eJVH (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.825656151864795
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:OXepoAgixQZPt6i3gS1qv84yNlode20H+y3M2ITPWsAbfoKAeYbWS:/gixwPtb3zqvH0H+y3Iz8NAeYJ
                                                                                          MD5:27EDC22FCA16814ACD4635159A6CAEA9
                                                                                          SHA1:6A741CE2987C5621386B287C89BD756AE443AF17
                                                                                          SHA-256:4BBFD9288C6E3A651B718D9A708781FAC7162F3943D5D8395BC55E8F935B7673
                                                                                          SHA-512:65068DE227F5D8BB7539D18FDC10651754761EF5FD4CE021AE740797D41E62EF0F73277DE19C69216A8E3F5BC6B363FF01AF23546E400D04626826DD7A815DB2
                                                                                          Malicious:false
                                                                                          Preview:Ku.~....(...c..?.4.QO.Jk.==`.I...........Z...s.1.7......8.i.. n.y.*..z..t.l.1.<....OS.q......9..M~....I^.|]?*.....V....M..R./4.....J.3.....7.m....Y..P.#..A.=9"R....x...R.....80.....,....nz.>.......i.BR...$..Aa.o..&..vZ......+`/^.Sz...w..7........sN....u....V.A......,O...">N(.....4........t..Y.lW.Y(p.>.D.q..#9...?pB.0.%..n......&8'1...x50...W.Y~.o...9.@.&x.3.....v1a[..ca......i~..8~..L.=h."&?dI]I~....n.4B.).~.....(..A.s].U|X.....*.Y3#tD...2..+(V[.B.M..s...S.s.....B .Z.\..<n.M....,{3..~.N.....K...2*=.>y.....ld.m...z..Gz4.#./.D/....-$.....P..z........ .$........4YU.....wEuX.J..!.@k.G.8..H..5.s.li.t.y.Rh}X..q..P/..Q.d..o....1s=.^0..v..\(bD..<.......7...O....r.{.2.+...V....!.*gc.{.(.>xy/....in;.o.|4y$#0...........0'..Y..1..6.|.2./|....H..-./....?p.B.G#.j.. ..[b\..z.J+..w..k....Y;...g..<}.Hn.......t.ST....T.._.O.L}..(...........}+.E/.O.:OK.u(..5.....iB..9.{..i.'.N...[...&.R9D..a.I.m..Y.#.'.ApQ*....{T..M....................0>S...Q

                                                                                          C:\Users\user\Desktop\ZBEDCJPBEY.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.854052042736547
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:szePFHyh7tWhHY69SEWNqAyXYiimbXdVkAzqDkKNtmMJV7iZyRmSfz2s0r2:szetHyh5046ZqfMRVkk+kuYjys7r2
                                                                                          MD5:864204DD6086E0B8C9ED363AAF829FD3
                                                                                          SHA1:3C430CC8A43A3E7B734338FC700C597F99E5D23B
                                                                                          SHA-256:10DCF3BD54C4B5A417BBA196EB0470E48331965589777D466482F3EB366E845B
                                                                                          SHA-512:30973C28F86019AD4849A3363D3BEA9B3355F361EAA6E4377760F20FA88A127600B80569575E58BBA62D138169F1DE944A0AF78719C08D7B72A804F0ABB91FCB
                                                                                          Malicious:false
                                                                                          Preview:......R.P$]......A..;3MI.VM..\.8...~l..v..'.....oN......8.5....W...Gw.*..b..I.!....n>..Ub.dx.O........../.L[...Z\.......K.hY.h..\.0.............8..=..0......|.s...g.Q.....-..b.8.........E..z.6..d....]..Y?..Y...u.H...r.z3....R.........H5k..)..E...8.....D....w[...Kr...$.....]...q....cl...Z.-.S....YNv...=.Q4.-..f.g...5..g=..VO.%..uD.........sn1LSz..d8p.. ZGH...e..O...........^.gqO2..`bPd..D.F.>Bo..=..}a.Y#`..4.G...E.]....".)..{.|...e...E.f.,...9...O...'..iJ...Ym<..{.w1N..u..p......2.......V...5.....4.]u.u._`.G..............G..;. ,. .(.H....O.('..L;.@...)X..w......E.:..`sOF.W...]..e.{......[..a.L..i.I.!....=A...........C.!9.\.)4...p.U..\.9&.[......S..I....'.:.&.%.....E..6G4....^.-..(..|wm.9V...e....."y_j1'.XJv..b......(D......}.:..aU.}i..,..S..S#........Q....D..E.%....<..qf..N...q...O...~8....d.x...P.......{...X7..E....4p;....*.-,.UH....\!.U..Ue.H6D./.......PQH..kw..i#....EE.,8.N."'.w...5.ml{`.Cbv..{\Bp...P...},.N;...DT*..< .9...a... .

                                                                                          C:\Users\user\Desktop\ZBEDCJPBEY.png.OdTl (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.854052042736547
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:szePFHyh7tWhHY69SEWNqAyXYiimbXdVkAzqDkKNtmMJV7iZyRmSfz2s0r2:szetHyh5046ZqfMRVkk+kuYjys7r2
                                                                                          MD5:864204DD6086E0B8C9ED363AAF829FD3
                                                                                          SHA1:3C430CC8A43A3E7B734338FC700C597F99E5D23B
                                                                                          SHA-256:10DCF3BD54C4B5A417BBA196EB0470E48331965589777D466482F3EB366E845B
                                                                                          SHA-512:30973C28F86019AD4849A3363D3BEA9B3355F361EAA6E4377760F20FA88A127600B80569575E58BBA62D138169F1DE944A0AF78719C08D7B72A804F0ABB91FCB
                                                                                          Malicious:false
                                                                                          Preview:......R.P$]......A..;3MI.VM..\.8...~l..v..'.....oN......8.5....W...Gw.*..b..I.!....n>..Ub.dx.O........../.L[...Z\.......K.hY.h..\.0.............8..=..0......|.s...g.Q.....-..b.8.........E..z.6..d....]..Y?..Y...u.H...r.z3....R.........H5k..)..E...8.....D....w[...Kr...$.....]...q....cl...Z.-.S....YNv...=.Q4.-..f.g...5..g=..VO.%..uD.........sn1LSz..d8p.. ZGH...e..O...........^.gqO2..`bPd..D.F.>Bo..=..}a.Y#`..4.G...E.]....".)..{.|...e...E.f.,...9...O...'..iJ...Ym<..{.w1N..u..p......2.......V...5.....4.]u.u._`.G..............G..;. ,. .(.H....O.('..L;.@...)X..w......E.:..`sOF.W...]..e.{......[..a.L..i.I.!....=A...........C.!9.\.)4...p.U..\.9&.[......S..I....'.:.&.%.....E..6G4....^.-..(..|wm.9V...e....."y_j1'.XJv..b......(D......}.:..aU.}i..,..S..S#........Q....D..E.%....<..qf..N...q...O...~8....d.x...P.......{...X7..E....4p;....*.-,.UH....\!.U..Ue.H6D./.......PQH..kw..i#....EE.,8.N."'.w...5.ml{`.Cbv..{\Bp...P...},.N;...DT*..< .9...a... .

                                                                                          C:\Users\user\Documents\DTBZGIOOSO.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8472874068572045
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:HIJwp5Tx88zqKkrK+MX2/ndKpagqSMfvmLQ7uZo0WCP0w6ysGLngBtgF:HIJwpFPzqJK+P/nAkh0MuZo0WC8w6ys2
                                                                                          MD5:56D609C11CB3A6DD0D5099BCBCD063D8
                                                                                          SHA1:DDFD8D47A7AE49B81DD9124693EA4F5812D0D78F
                                                                                          SHA-256:8D5AE3371681D74D89FE0CBBC31E4F2DC0B5AD4CD8317119A8A344DF51D95864
                                                                                          SHA-512:2E3F1DDF1B7BD355ADE6F6FF3A5B34DF6E6D1739FBA4DB0CC01448CE5B42EB7CB06581306674505B7985E5B24E5E56796CCCD71F9C32BEA093BC659064431928
                                                                                          Malicious:false
                                                                                          Preview:.....)Q.y68....8."Q..l0f...8r.*...B...^.v....R.{..C..#6..Co<..%.@$y.;.]_.A..._.S[.....;.M...D%...qA.$ny...:.y)......}...wL4A......../..L83....Y.e..G}....~e,.7......T.RoF..}l..2&r...U\....USL.&6.."y.&.+y.U....-.e%..b8.|.I.....^.*.D..!..z..G..@.]i7(.yE.i.$H....B.f....w.v.l/e........s..)xk.~.@.x.....T.DD>...!F .h.%z..7...~.A..Z-6..m.im.7..(..vu..#4w%4p.O..<.$....... ;.K............w..m...U.%X.Az.ZAF.....m.R2....i..P..".G.rc.u-3.......*.m.....w..:=k.(.....~...a...C9.......J...w1....j.. ...l..=..O>..)7......9......D.f.Ww....b(.A..vlH.......p.Rt....c..|e|....H.%}Y.....`.f./.:.):,G...[."....F..JlH6...>.V.zj.).....u......b..0.V...-.sn.!v..]..m..V...J...d..Oh...ul<eQlPjZ....a@&..z5...8..n.m.WA.L.t.H.~.....{p)..u5[.x.3.U..\.s.+....Olp.vB.P:..1....EG(XN......Wx..=...w&*...b.V.*....t.s....Gg!.}jz..h.K...O./..w..1.......{.x.4k.~~.....[d."@.q.@......lK..r.(.w....5.n. \....+?..N.7 .. .IS..j4jw&..N...S........h...m....)_..]......)..H>.'...%.......y.K......

                                                                                          C:\Users\user\Documents\DTBZGIOOSO.docx.abTn (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8472874068572045
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:HIJwp5Tx88zqKkrK+MX2/ndKpagqSMfvmLQ7uZo0WCP0w6ysGLngBtgF:HIJwpFPzqJK+P/nAkh0MuZo0WC8w6ys2
                                                                                          MD5:56D609C11CB3A6DD0D5099BCBCD063D8
                                                                                          SHA1:DDFD8D47A7AE49B81DD9124693EA4F5812D0D78F
                                                                                          SHA-256:8D5AE3371681D74D89FE0CBBC31E4F2DC0B5AD4CD8317119A8A344DF51D95864
                                                                                          SHA-512:2E3F1DDF1B7BD355ADE6F6FF3A5B34DF6E6D1739FBA4DB0CC01448CE5B42EB7CB06581306674505B7985E5B24E5E56796CCCD71F9C32BEA093BC659064431928
                                                                                          Malicious:false
                                                                                          Preview:.....)Q.y68....8."Q..l0f...8r.*...B...^.v....R.{..C..#6..Co<..%.@$y.;.]_.A..._.S[.....;.M...D%...qA.$ny...:.y)......}...wL4A......../..L83....Y.e..G}....~e,.7......T.RoF..}l..2&r...U\....USL.&6.."y.&.+y.U....-.e%..b8.|.I.....^.*.D..!..z..G..@.]i7(.yE.i.$H....B.f....w.v.l/e........s..)xk.~.@.x.....T.DD>...!F .h.%z..7...~.A..Z-6..m.im.7..(..vu..#4w%4p.O..<.$....... ;.K............w..m...U.%X.Az.ZAF.....m.R2....i..P..".G.rc.u-3.......*.m.....w..:=k.(.....~...a...C9.......J...w1....j.. ...l..=..O>..)7......9......D.f.Ww....b(.A..vlH.......p.Rt....c..|e|....H.%}Y.....`.f./.:.):,G...[."....F..JlH6...>.V.zj.).....u......b..0.V...-.sn.!v..]..m..V...J...d..Oh...ul<eQlPjZ....a@&..z5...8..n.m.WA.L.t.H.~.....{p)..u5[.x.3.U..\.s.+....Olp.vB.P:..1....EG(XN......Wx..=...w&*...b.V.*....t.s....Gg!.}jz..h.K...O./..w..1.......{.x.4k.~~.....[d."@.q.@......lK..r.(.w....5.n. \....+?..N.7 .. .IS..j4jw&..N...S........h...m....)_..]......)..H>.'...%.......y.K......

                                                                                          C:\Users\user\Documents\DTBZGIOOSO\DTBZGIOOSO.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.831179537676975
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:q1bjSCxAUFqn90++kHVbAnE0Bbb0ensPYPkYx9+IqMHLjng3HFstORE6eDQvPj0P:ObFFr++ksPbjnbPkmHXGLpgwi
                                                                                          MD5:04D34A53D2F1EA2F2B4F005293DF75D7
                                                                                          SHA1:790A3003AE6B25A32178D7EF77A8D8D23E531A82
                                                                                          SHA-256:4BC94C30634E79037CA12500C713C50E6393640DC91A09EDD29C23872961AAF8
                                                                                          SHA-512:B3AF8EBB026B99C723F53E41D5ACAC822483AA663BF17FFCBEBADA1731D9BEDF96D02C8934AE5933D4D45E77F1C099B03E70F68CCF27DB2C1585394451C41140
                                                                                          Malicious:false
                                                                                          Preview:..`...?.....-QQ..0....3..1..i.....a....4..:.a..!...G.......]<8.SB.^.2b......J.g...>.B...?H..K....O.n...0.0..j>..R3.Vw.k..O.1.....i..4Z..U|1.>Y.O"qK.v..h2.....o....v........c....4..*25....|EP1iL....Tz.6.P....Z.4......G. ..O...3H...sF.f`"4.`ob.m.7.`5...YR.1....oOy..x.]....^.......Xo.GZ..f....{bfc..R.ou ..T<)..?....O ...J..Q.B.$3iVs8....?.o~(C..&]...do'.s&$.f..LX....g.. ..v...*=....g..+Z.h.;...l..t.9._5.YA.v.5..7.....o...1l..(.].Id....f0.|&mTw....Q.X...Y.....L......EM.x.]..M...4V.8{...L...<..,...s.,J..b..y2.....y..D..#o.r.. #+c.7*~.....S......D3.L."w.........(&....'.D.....4..L..:23..J.....*.T6.Lt....b.@@....q..\.#..Pl2.(0.........K.D.`.Bd..Q..J...aa....D....5.?.7...~..Y.H.d.W.....4..).b0.......;.......M.&..g...Vi...|....Y,v.bf.~.?.g....I..0....(e....V../!.-....6l ....\.j..r$4......J.....eq..b....l.D.gYup..*7.edv.!.(<.t}...&.%.@.........6.e..xP..3?>uz....}.HB..y,i...l.V/..Z.0..0....4.....-..5B..4dX-...y...]Su....!..i.b.dGy...(..w..UU..i[d

                                                                                          C:\Users\user\Documents\DTBZGIOOSO\DTBZGIOOSO.docx.EpxU (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.831179537676975
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:q1bjSCxAUFqn90++kHVbAnE0Bbb0ensPYPkYx9+IqMHLjng3HFstORE6eDQvPj0P:ObFFr++ksPbjnbPkmHXGLpgwi
                                                                                          MD5:04D34A53D2F1EA2F2B4F005293DF75D7
                                                                                          SHA1:790A3003AE6B25A32178D7EF77A8D8D23E531A82
                                                                                          SHA-256:4BC94C30634E79037CA12500C713C50E6393640DC91A09EDD29C23872961AAF8
                                                                                          SHA-512:B3AF8EBB026B99C723F53E41D5ACAC822483AA663BF17FFCBEBADA1731D9BEDF96D02C8934AE5933D4D45E77F1C099B03E70F68CCF27DB2C1585394451C41140
                                                                                          Malicious:false
                                                                                          Preview:..`...?.....-QQ..0....3..1..i.....a....4..:.a..!...G.......]<8.SB.^.2b......J.g...>.B...?H..K....O.n...0.0..j>..R3.Vw.k..O.1.....i..4Z..U|1.>Y.O"qK.v..h2.....o....v........c....4..*25....|EP1iL....Tz.6.P....Z.4......G. ..O...3H...sF.f`"4.`ob.m.7.`5...YR.1....oOy..x.]....^.......Xo.GZ..f....{bfc..R.ou ..T<)..?....O ...J..Q.B.$3iVs8....?.o~(C..&]...do'.s&$.f..LX....g.. ..v...*=....g..+Z.h.;...l..t.9._5.YA.v.5..7.....o...1l..(.].Id....f0.|&mTw....Q.X...Y.....L......EM.x.]..M...4V.8{...L...<..,...s.,J..b..y2.....y..D..#o.r.. #+c.7*~.....S......D3.L."w.........(&....'.D.....4..L..:23..J.....*.T6.Lt....b.@@....q..\.#..Pl2.(0.........K.D.`.Bd..Q..J...aa....D....5.?.7...~..Y.H.d.W.....4..).b0.......;.......M.&..g...Vi...|....Y,v.bf.~.?.g....I..0....(e....V../!.-....6l ....\.j..r$4......J.....eq..b....l.D.gYup..*7.edv.!.(<.t}...&.%.@.........6.e..xP..3?>uz....}.HB..y,i...l.V/..Z.0..0....4.....-..5B..4dX-...y...]Su....!..i.b.dGy...(..w..UU..i[d

                                                                                          C:\Users\user\Documents\DTBZGIOOSO\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Documents\DTBZGIOOSO\KATAXZVCPS.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.827195183267954
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1XxY1CvUi2ljJHq+nClh05LJEhwprKzkzzo9xQxoVI0VjPokVcOhiEJ:ZV8Clh059drKz8rougoycep
                                                                                          MD5:3BE81DF189DDA2BCA5F9359831729677
                                                                                          SHA1:86DF87512A29B06E41EEDE82BB51DEE6E876BC52
                                                                                          SHA-256:68CAFEC6F4BCDCAC4B61B61C6F875CA9FF5278A809B58F3364C3F77D5ABE6499
                                                                                          SHA-512:37EF1AA5F0C003F314151A6861BA794483185977E6CA2C3C014D4B4DBB971B0E13675006BEA0409082EE59DDC1D8A7F6A888CECCFB03730DFCB8793DE37E7105
                                                                                          Malicious:false
                                                                                          Preview:...^..j.,...X.S.....=E\G.+..P. w........`!.NR].a.._...I.&V[.e....B...$...(].nW(K|k...w......|..../......*.tj....c....t.....>...g.....W7.4=Bs...3.1L...^.I.R...=hu`...".e..gd..KU.de|hf....nU.z....U......5.z...4M'..\{..8.k.k....Hm.zb}+H.{<Aj...R..d.>0....`T.^.I..4..WU....,....../..jj.3a.3...?.hTHA........`F..&....JG$.H.2..k.......=.t.`f&.A-.......?.....uo...@..[o}..vb......$....6.Q...{r1..-H....O.B....H.^...]...X.^....l......:.*.....i.........O.0..Q...-....t...i.N..@B.'......1../...i.9..X.D. .i}..'. .F3........8..!`..m...f.R/.g..4.d...H..4...,.U.....LLW..|.Z)$.0?.)..... ..&1.Z.g..".Y..........*e.....]......o.SY=......pT`_..{p~}e+..3..JI....L...!..j.b.....ZS.uM.w..Rl..3..X<....LM.=*3.G..{..h..s..(..!....*.%+[f.[r.2..=...L..-.!*uc8@.a9..T.xc6....Jl..#...D.z.p.Lvvg..-..a ..t..k...R.E...."=.#&/if2...0K1eC.#.^.!.p.">_...<..a..(.8@.*D"XE.....t@.........;....d.0..|....u/3..E.......L.C(..p.8.._vP.$..ak.e.z..&..^.1.@..gwP..y@../....r..8...WF...8.

                                                                                          C:\Users\user\Documents\DTBZGIOOSO\KATAXZVCPS.mp3.Fvaz (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.827195183267954
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:1XxY1CvUi2ljJHq+nClh05LJEhwprKzkzzo9xQxoVI0VjPokVcOhiEJ:ZV8Clh059drKz8rougoycep
                                                                                          MD5:3BE81DF189DDA2BCA5F9359831729677
                                                                                          SHA1:86DF87512A29B06E41EEDE82BB51DEE6E876BC52
                                                                                          SHA-256:68CAFEC6F4BCDCAC4B61B61C6F875CA9FF5278A809B58F3364C3F77D5ABE6499
                                                                                          SHA-512:37EF1AA5F0C003F314151A6861BA794483185977E6CA2C3C014D4B4DBB971B0E13675006BEA0409082EE59DDC1D8A7F6A888CECCFB03730DFCB8793DE37E7105
                                                                                          Malicious:false
                                                                                          Preview:...^..j.,...X.S.....=E\G.+..P. w........`!.NR].a.._...I.&V[.e....B...$...(].nW(K|k...w......|..../......*.tj....c....t.....>...g.....W7.4=Bs...3.1L...^.I.R...=hu`...".e..gd..KU.de|hf....nU.z....U......5.z...4M'..\{..8.k.k....Hm.zb}+H.{<Aj...R..d.>0....`T.^.I..4..WU....,....../..jj.3a.3...?.hTHA........`F..&....JG$.H.2..k.......=.t.`f&.A-.......?.....uo...@..[o}..vb......$....6.Q...{r1..-H....O.B....H.^...]...X.^....l......:.*.....i.........O.0..Q...-....t...i.N..@B.'......1../...i.9..X.D. .i}..'. .F3........8..!`..m...f.R/.g..4.d...H..4...,.U.....LLW..|.Z)$.0?.)..... ..&1.Z.g..".Y..........*e.....]......o.SY=......pT`_..{p~}e+..3..JI....L...!..j.b.....ZS.uM.w..Rl..3..X<....LM.=*3.G..{..h..s..(..!....*.%+[f.[r.2..=...L..-.!*uc8@.a9..T.xc6....Jl..#...D.z.p.Lvvg..-..a ..t..k...R.E...."=.#&/if2...0K1eC.#.^.!.p.">_...<..a..(.8@.*D"XE.....t@.........;....d.0..|....u/3..E.......L.C(..p.8.._vP.$..ak.e.z..&..^.1.@..gwP..y@../....r..8...WF...8.

                                                                                          C:\Users\user\Documents\DTBZGIOOSO\ONBQCLYSPU.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.854538743582748
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:amg6A52o1dM1gc88vlmsfcwcMD/hMUppjh690xpL0dlezcsva+VpmWSnRWG9u+Ze:/g6c1dylm+TcMfjh6Kxi0va+VprSnRWZ
                                                                                          MD5:163FB3CF486E4FE0CC9991A1E66EF133
                                                                                          SHA1:7E48C88A30075373FA00797A7A49253DC20AE815
                                                                                          SHA-256:C13497C4C6F1CE1E3B0F13DCC3DEAA65DC588924C77D6FDC767584A8AA2FE066
                                                                                          SHA-512:4AC6859626A5036E106A0D2AB4182B74983237A9BF10D27E1809B55E0FF95F452B6F3A3BCFF785BC7E40D9A6A4FDE299656A8D5D5D65956E00A8C617BE46C2D7
                                                                                          Malicious:false
                                                                                          Preview:l.e..#....[..'i.$4.d...b. Q..V...0...:....d....<`2Y,.'..M.....v.4C.0!c%.I0p.u......^...C.....0.....qW,9F Xy.........@..f.....w.~w..{.BIh.b.@.G.K..ZU._.Z`@:|*..k..^~<..C...r......=.......b..........V....g..T.~.........tL>..d@.n...0m~..\k.P$L.F.H..2w.f...2DX.....Hy..d.K*/.....`..]..(....F...hB.>Z.1.4.F..d........^.T...b{.DSc..d.q..m....n.'z......K.S....}{.u.Ls..@.&uQ.piT.......n.....?.....>..fx.kmC,}..#Z..>U!n..'.Z@....g=...........St..8.H..H?]...Jz...G.f5NE..U..xU.}-....^.0.........L..L.....Q..=.:_G...7r..6.. ....oZ..4....[..w4TU. .`!....{......BT.%.c.J.P.$.....,...\n......R..F...F..,.m....c..%l.....bP..0X..V....`...g..?...,..)$.2.U.=Mz{}..~.. ....LQ{.B.<...Y..r..B.]k.n-.0 B.[..l.A..O.>.......+.I......%..&.e...../.q....Y..`.g.).........O9J...&...-.......l?.8.%...$>..{/..O.......J..KUE.yK.....L.v.n...?..r.x.vl.d~/.,1..m....^......7r\...o....&...1.P..z.{ft..@ .g.l..-.o{....>.c. ..l...L$.....\t.......v...!..}u..~.6...<.#..e..%E....B.

                                                                                          C:\Users\user\Documents\DTBZGIOOSO\ONBQCLYSPU.pdf.hRGY (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.854538743582748
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:amg6A52o1dM1gc88vlmsfcwcMD/hMUppjh690xpL0dlezcsva+VpmWSnRWG9u+Ze:/g6c1dylm+TcMfjh6Kxi0va+VprSnRWZ
                                                                                          MD5:163FB3CF486E4FE0CC9991A1E66EF133
                                                                                          SHA1:7E48C88A30075373FA00797A7A49253DC20AE815
                                                                                          SHA-256:C13497C4C6F1CE1E3B0F13DCC3DEAA65DC588924C77D6FDC767584A8AA2FE066
                                                                                          SHA-512:4AC6859626A5036E106A0D2AB4182B74983237A9BF10D27E1809B55E0FF95F452B6F3A3BCFF785BC7E40D9A6A4FDE299656A8D5D5D65956E00A8C617BE46C2D7
                                                                                          Malicious:false
                                                                                          Preview:l.e..#....[..'i.$4.d...b. Q..V...0...:....d....<`2Y,.'..M.....v.4C.0!c%.I0p.u......^...C.....0.....qW,9F Xy.........@..f.....w.~w..{.BIh.b.@.G.K..ZU._.Z`@:|*..k..^~<..C...r......=.......b..........V....g..T.~.........tL>..d@.n...0m~..\k.P$L.F.H..2w.f...2DX.....Hy..d.K*/.....`..]..(....F...hB.>Z.1.4.F..d........^.T...b{.DSc..d.q..m....n.'z......K.S....}{.u.Ls..@.&uQ.piT.......n.....?.....>..fx.kmC,}..#Z..>U!n..'.Z@....g=...........St..8.H..H?]...Jz...G.f5NE..U..xU.}-....^.0.........L..L.....Q..=.:_G...7r..6.. ....oZ..4....[..w4TU. .`!....{......BT.%.c.J.P.$.....,...\n......R..F...F..,.m....c..%l.....bP..0X..V....`...g..?...,..)$.2.U.=Mz{}..~.. ....LQ{.B.<...Y..r..B.]k.n-.0 B.[..l.A..O.>.......+.I......%..&.e...../.q....Y..`.g.).........O9J...&...-.......l?.8.%...$>..{/..O.......J..KUE.yK.....L.v.n...?..r.x.vl.d~/.,1..m....^......7r\...o....&...1.P..z.{ft..@ .g.l..-.o{....>.c. ..l...L$.....\t.......v...!..}u..~.6...<.#..e..%E....B.

                                                                                          C:\Users\user\Documents\DTBZGIOOSO\UMMBDNEQBN.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8537837097588
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Dq006NWOLuWFJk4KJG9Cl5X5+zMw+7XiTv6m+flvpqqWjvkaHxi8:+N6zFq1Hl5X5smiT7+f9pqqWomx7
                                                                                          MD5:19243AFE2D9E6BD0AD99FBDB507AD0E9
                                                                                          SHA1:378ABCE769A31F9A6E4906AF5063D2CD5F684AA9
                                                                                          SHA-256:ADBC66C03428E5134DB9E8BD0EE15147BD67F256565DE89D7083BE8B4CD27583
                                                                                          SHA-512:305BD35F457F05B59992C94CA0971C6842C664C77B0FD3E5EA2006820FBF09280BDBB732EC04135945ECAD1A8B60A2CE81E98A666AB54EBF94006C72A3333256
                                                                                          Malicious:false
                                                                                          Preview:....M..t..kz:/>....$.L..1.e]+`-.^R.1..m...;~.L.<...m..&../.....F*....F....4*F...L.,k+....&...:s(.&w..A.?".~.cm......7i.%.Sb...l..A....[..d.5.....v. ..Q..(.!?...=.o;.)....f.....D.B.E".vE....R.........;vq.....xw...?.._....?...V...?1......y....~]z)..^!...Et..ll.,.7(.yeG.R..St.I....G.:u..D..XI+....~M...h....tS.WCe.....F..N'..}.........y..1.,.@..g..#..Y....&..i.t..X..d....J..s..|.....!.+....nKzo]..Z.,3.:.w.J.9..;M..0E..9k.../...."%}X|.5C.u2...;.m%H.m..3b.-.{.\tG...C.U.%.........}ww'b.y.....AkDZK...v....r.......z3`....Z.:-}...V.;+.s.3......c.=.|V\bh.t......e...5:.a.-[d....(M...T/"...^G.....h.._....V.#..<...A6.mW2..a#...oh..GC..N.....Y..bW^(...f'....#...r......fIsa.eeo?.....0B.0.'vs....q.p....$...$..3._I.y.C.I!.n..CY.0Jd+,Zt..%..n....T..1h..;..G..._..1Zl..a[..=..x.......W.XL}W..yJ..Z....J..]........{...J.<.....\.y.....JLP.X.k..V...?..2N..)...*...#..ACjb]./T.....W%.<1....R[. .-.....~6.`2..R....3D'R3.....K....q...w..E.^....[.-.>..J.('y..

                                                                                          C:\Users\user\Documents\DTBZGIOOSO\UMMBDNEQBN.png.YXwE (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8537837097588
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Dq006NWOLuWFJk4KJG9Cl5X5+zMw+7XiTv6m+flvpqqWjvkaHxi8:+N6zFq1Hl5X5smiT7+f9pqqWomx7
                                                                                          MD5:19243AFE2D9E6BD0AD99FBDB507AD0E9
                                                                                          SHA1:378ABCE769A31F9A6E4906AF5063D2CD5F684AA9
                                                                                          SHA-256:ADBC66C03428E5134DB9E8BD0EE15147BD67F256565DE89D7083BE8B4CD27583
                                                                                          SHA-512:305BD35F457F05B59992C94CA0971C6842C664C77B0FD3E5EA2006820FBF09280BDBB732EC04135945ECAD1A8B60A2CE81E98A666AB54EBF94006C72A3333256
                                                                                          Malicious:false
                                                                                          Preview:....M..t..kz:/>....$.L..1.e]+`-.^R.1..m...;~.L.<...m..&../.....F*....F....4*F...L.,k+....&...:s(.&w..A.?".~.cm......7i.%.Sb...l..A....[..d.5.....v. ..Q..(.!?...=.o;.)....f.....D.B.E".vE....R.........;vq.....xw...?.._....?...V...?1......y....~]z)..^!...Et..ll.,.7(.yeG.R..St.I....G.:u..D..XI+....~M...h....tS.WCe.....F..N'..}.........y..1.,.@..g..#..Y....&..i.t..X..d....J..s..|.....!.+....nKzo]..Z.,3.:.w.J.9..;M..0E..9k.../...."%}X|.5C.u2...;.m%H.m..3b.-.{.\tG...C.U.%.........}ww'b.y.....AkDZK...v....r.......z3`....Z.:-}...V.;+.s.3......c.=.|V\bh.t......e...5:.a.-[d....(M...T/"...^G.....h.._....V.#..<...A6.mW2..a#...oh..GC..N.....Y..bW^(...f'....#...r......fIsa.eeo?.....0B.0.'vs....q.p....$...$..3._I.y.C.I!.n..CY.0Jd+,Zt..%..n....T..1h..;..G..._..1Zl..a[..=..x.......W.XL}W..yJ..Z....J..]........{...J.<.....\.y.....JLP.X.k..V...?..2N..)...*...#..ACjb]./T.....W%.<1....R[. .-.....~6.`2..R....3D'R3.....K....q...w..E.^....[.-.>..J.('y..

                                                                                          C:\Users\user\Documents\DTBZGIOOSO\VLZDGUKUTZ.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.852992198057613
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:B5dF65ByKYAXbn251k5ZCwf0Aqb4N5LTZK30/T0lk4JaNS9:Bh65Bhn285Zt0hb4vk0bTNS9
                                                                                          MD5:FC3F2F384B5BC0781E98C3D461937BB5
                                                                                          SHA1:D5441C65430F34162B0BECD5B73CC01ED12D093F
                                                                                          SHA-256:B591380B1C39C7AC6257390BC285A856D169F9A3810F74A0AB94ADEB66F8D368
                                                                                          SHA-512:F886C07FA5944965DF7A6693DA7AC0C746D089FB73D2BB8E21AC2F255C4DBAAF051E87140C1CE75E24132B9FDDBA53C5E01C991286DBA9B658A1B1CF24E44430
                                                                                          Malicious:false
                                                                                          Preview:.$.5..q|..n....<....+6..N.<....P.1|T............et.3kj..jF%.B.v..]L...9.Se..D.....y.rk.\......J#.k......z.......1...mN...C2......M.cx.v..O....K...H.......xE.......C].l.c.I.e.6.Z).?..h......w.&(..J....}.....Y.._Y.......7.@Wl..;#..C.(.....H...H=6..?.#.7L.....4Q\....aV.........L,H..I...`...GTl.n8_8.....*i.....x.e.....14hF..o.?Wj.......Ce...@. f.....C)."..dyB!.Q+...]u.._...D..M.8&F.O.f5....!q..WR....%.......Q%..z...O..Q....n.....t...n.>.wj*..0..g.P.7}2w....S-...y@...&B.....u...C..I.C>.=K.<.....'Lx........}0.C..).&X..Z.C.....3...7.'.....Q#.9j5.\uY...*..m".....h^.......Fiji.ph..N..#...WW......S..x..q.m.'..x..TI.GO.L...F..#.fMJ...+.ij.5H./..:....^1...... . .~.'.Fp@,....n.:u....W...f..}....m.e_ .o.i|R..%=..L.krM.i2&!...]...:>9U$"..u...Z..J..N.I... .Z.^cP...qRQ... .....+4....y.%!...W......`M.L....&.^...\...}..8..$.[.!.........&o..~.]p....N...4.`i9.*..Q6A.6[.....b..i...jB[.\|q....=.&..9.&..85=..?..0..c%.......5...IP.....k..e..........2.....M.....

                                                                                          C:\Users\user\Documents\DTBZGIOOSO\VLZDGUKUTZ.jpg.oyRx (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.852992198057613
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:B5dF65ByKYAXbn251k5ZCwf0Aqb4N5LTZK30/T0lk4JaNS9:Bh65Bhn285Zt0hb4vk0bTNS9
                                                                                          MD5:FC3F2F384B5BC0781E98C3D461937BB5
                                                                                          SHA1:D5441C65430F34162B0BECD5B73CC01ED12D093F
                                                                                          SHA-256:B591380B1C39C7AC6257390BC285A856D169F9A3810F74A0AB94ADEB66F8D368
                                                                                          SHA-512:F886C07FA5944965DF7A6693DA7AC0C746D089FB73D2BB8E21AC2F255C4DBAAF051E87140C1CE75E24132B9FDDBA53C5E01C991286DBA9B658A1B1CF24E44430
                                                                                          Malicious:false
                                                                                          Preview:.$.5..q|..n....<....+6..N.<....P.1|T............et.3kj..jF%.B.v..]L...9.Se..D.....y.rk.\......J#.k......z.......1...mN...C2......M.cx.v..O....K...H.......xE.......C].l.c.I.e.6.Z).?..h......w.&(..J....}.....Y.._Y.......7.@Wl..;#..C.(.....H...H=6..?.#.7L.....4Q\....aV.........L,H..I...`...GTl.n8_8.....*i.....x.e.....14hF..o.?Wj.......Ce...@. f.....C)."..dyB!.Q+...]u.._...D..M.8&F.O.f5....!q..WR....%.......Q%..z...O..Q....n.....t...n.>.wj*..0..g.P.7}2w....S-...y@...&B.....u...C..I.C>.=K.<.....'Lx........}0.C..).&X..Z.C.....3...7.'.....Q#.9j5.\uY...*..m".....h^.......Fiji.ph..N..#...WW......S..x..q.m.'..x..TI.GO.L...F..#.fMJ...+.ij.5H./..:....^1...... . .~.'.Fp@,....n.:u....W...f..}....m.e_ .o.i|R..%=..L.krM.i2&!...]...:>9U$"..u...Z..J..N.I... .Z.^cP...qRQ... .....+4....y.%!...W......`M.L....&.^...\...}..8..$.[.!.........&o..~.]p....N...4.`i9.*..Q6A.6[.....b..i...jB[.\|q....=.&..9.&..85=..?..0..c%.......5...IP.....k..e..........2.....M.....

                                                                                          C:\Users\user\Documents\DTBZGIOOSO\XZXHAVGRAG.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.87362047805826
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:gHkjP/+PMiYONwf4XDsu4d2SFI5LULc8R2ospTU4YdVh51AzCmdtDQ1:Ykje+4XIu4dFFI5LUA8fwUfUzCeS
                                                                                          MD5:045CA80E98F8C7FBB0CDE1C529E536D4
                                                                                          SHA1:8BF493628C0176F44468E52D3E949108D4578725
                                                                                          SHA-256:262431404C792F1785788D47F6E2E415353D3D7465A7DA629C1F9AF5383A7CE3
                                                                                          SHA-512:49BFE17B0529B1EFCC59AC30DE38B425080541AE0F5C30B31C582A91AEB725F6154BD8FCB6EE2FC06C6921DDCA63713BE1A8C2D8AFDBDFCD5F1E3D10C977DC09
                                                                                          Malicious:false
                                                                                          Preview:..&d..^k.[..P...98t......B.t..M.-..]B....O....:...U[x.q.eR.....z.3.E.m.7/......]..}..&.*.@.@....}.&..Rj.S...pCU......G#..dM.GL.!m,+'.Q6C.BM.P...@|xS.A..~8-...........P.sxj>8.._.d..}\T..V...~..XxZ.....\..O.4j.Kf.8.h.*. ..Z4..g....m%V.....T....w...~.=.J.Z.#[.....S.r.'l.+j.}j.u...:\3.$..%.:6.....i.).Pv..]..0;....#Du-...T......+....4.nTr...P....R.....`..9.......L....%.~.%.Lr<D.?..i>..q..S,p..M....`.b.\...D....c6.g..3.U1j5...i6.x4.L..$.a.....U...E>........g..O.-.........q.&.H5.~{..T...E....D`.)......w..5.E7.F?..k=.6F.g..9..[.....e...q..kTm.E....(..x.k..N..t.<............#u...2.K |.E6.N..!.I.E..^..|...{.q..].*.?`.../=...U....E.m.:e.k.K.M...m.s......!..,......N..'....5..t.....P.OC.#j*....Ur.)..*.M\j.2...)C+.^Z....@.....h.y.....kI..6}x%Q...... u.h:'.....TOQ...0.....uD?......u.=[.{.Ec.....#.^j..L..{.XR.-.....6p..v.9.. .l..T.....9....p.28..<o].V.&.^".c...u.P.!.w.l91."X...Xq....G.,b{.......phDI.....u.w....q...UO...U./...,DX.[c.J=....6viI..f.

                                                                                          C:\Users\user\Documents\DTBZGIOOSO\XZXHAVGRAG.xlsx.xjZb (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.87362047805826
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:gHkjP/+PMiYONwf4XDsu4d2SFI5LULc8R2ospTU4YdVh51AzCmdtDQ1:Ykje+4XIu4dFFI5LUA8fwUfUzCeS
                                                                                          MD5:045CA80E98F8C7FBB0CDE1C529E536D4
                                                                                          SHA1:8BF493628C0176F44468E52D3E949108D4578725
                                                                                          SHA-256:262431404C792F1785788D47F6E2E415353D3D7465A7DA629C1F9AF5383A7CE3
                                                                                          SHA-512:49BFE17B0529B1EFCC59AC30DE38B425080541AE0F5C30B31C582A91AEB725F6154BD8FCB6EE2FC06C6921DDCA63713BE1A8C2D8AFDBDFCD5F1E3D10C977DC09
                                                                                          Malicious:false
                                                                                          Preview:..&d..^k.[..P...98t......B.t..M.-..]B....O....:...U[x.q.eR.....z.3.E.m.7/......]..}..&.*.@.@....}.&..Rj.S...pCU......G#..dM.GL.!m,+'.Q6C.BM.P...@|xS.A..~8-...........P.sxj>8.._.d..}\T..V...~..XxZ.....\..O.4j.Kf.8.h.*. ..Z4..g....m%V.....T....w...~.=.J.Z.#[.....S.r.'l.+j.}j.u...:\3.$..%.:6.....i.).Pv..]..0;....#Du-...T......+....4.nTr...P....R.....`..9.......L....%.~.%.Lr<D.?..i>..q..S,p..M....`.b.\...D....c6.g..3.U1j5...i6.x4.L..$.a.....U...E>........g..O.-.........q.&.H5.~{..T...E....D`.)......w..5.E7.F?..k=.6F.g..9..[.....e...q..kTm.E....(..x.k..N..t.<............#u...2.K |.E6.N..!.I.E..^..|...{.q..].*.?`.../=...U....E.m.:e.k.K.M...m.s......!..,......N..'....5..t.....P.OC.#j*....Ur.)..*.M\j.2...)C+.^Z....@.....h.y.....kI..6}x%Q...... u.h:'.....TOQ...0.....uD?......u.=[.{.Ec.....#.^j..L..{.XR.-.....6p..v.9.. .l..T.....9....p.28..<o].V.&.^".c...u.P.!.w.l91."X...Xq....G.,b{.......phDI.....u.w....q...UO...U./...,DX.[c.J=....6viI..f.

                                                                                          C:\Users\user\Documents\DVWHKMNFNN.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8769408359195525
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:+qY5CpfHouNdDaLpJQ2sxS2kxkp3upIFisesNPXd8qDcFKIYN8EzM:TfHouNIQDskRupIErs9HcFKIYNE
                                                                                          MD5:A254BDFB0203A38875781BF8A8C8C855
                                                                                          SHA1:5563DABC1A9C4717707550BCB0EFBE107E8FF4B7
                                                                                          SHA-256:4BB72E3110F5EDD7118D51E25547917CFA0A857FC904A1E0BF2DFAA59313F325
                                                                                          SHA-512:598F62C2F219D053E90A38AF4082435AFA4AE5A53EC63262C0C2A47B3623284B1D29A922665F31ACB7281FA9C17E7F2DB8E47A5EC752C06FFC956D0C8EC9C90D
                                                                                          Malicious:false
                                                                                          Preview:.#...l.&t.Z.:.|;..\..>......q...".....@..A.J.&.w..4..+u6.b^:W..:..jS.......N7.'.N......|.P........f.. ...?o9...Y7...VY...[..4...8.b.6.Jk..:....w3.{.`.......O1*.K.Q.~(C..L.|....7.N.\Z.)]..G[#.dI..E....FK..3..D.!..3.\.f..*.<Bi4..ie.@g...lk..d|.)I!.Qt!...0..m......~K..)..uV3-@......-.lAL..^u.*.h...E...c.,....L....ym..!;0l.9.xu.9....6P...o..'d.$e~n'(E.W.v.F.4.=..5.<......_.I..Ve0..WI..`.|.@.R...B.........ZU._.....u.GNS1.)l^.l.XP..^.jN.:5..u.wN...cn...].u'.i...'......M...m}?.0...._...<L.R.. ......D...M.$.yi.n......>.....9...i.g.-..\.../......."._..H.Gy.B?....r...c....f.4..X.[...@..`M.8.j.".....l..92k...N/..eG...p.+.vO0.......G..^T".S.8.T.3...J,....l.v..vj...P....;...y.J....?jP..2..3..p..U...K.m.s....#.EB;.$9R.T....Cw,.;.....R..o..^.Dz.]e.r..g8..&../.z.....do...2..<..c.|.B...?>.....w..fs[....{....C..EH......=...("....s...7./.;.u...@...G4...iK9$)nK*a&..$.....&....L... ..K....z...DC4K.q.,7XS[e......I.../.v+....xm..h.M.#....r.....&yt..

                                                                                          C:\Users\user\Documents\DVWHKMNFNN.jpg.TRKx (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8769408359195525
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:+qY5CpfHouNdDaLpJQ2sxS2kxkp3upIFisesNPXd8qDcFKIYN8EzM:TfHouNIQDskRupIErs9HcFKIYNE
                                                                                          MD5:A254BDFB0203A38875781BF8A8C8C855
                                                                                          SHA1:5563DABC1A9C4717707550BCB0EFBE107E8FF4B7
                                                                                          SHA-256:4BB72E3110F5EDD7118D51E25547917CFA0A857FC904A1E0BF2DFAA59313F325
                                                                                          SHA-512:598F62C2F219D053E90A38AF4082435AFA4AE5A53EC63262C0C2A47B3623284B1D29A922665F31ACB7281FA9C17E7F2DB8E47A5EC752C06FFC956D0C8EC9C90D
                                                                                          Malicious:false
                                                                                          Preview:.#...l.&t.Z.:.|;..\..>......q...".....@..A.J.&.w..4..+u6.b^:W..:..jS.......N7.'.N......|.P........f.. ...?o9...Y7...VY...[..4...8.b.6.Jk..:....w3.{.`.......O1*.K.Q.~(C..L.|....7.N.\Z.)]..G[#.dI..E....FK..3..D.!..3.\.f..*.<Bi4..ie.@g...lk..d|.)I!.Qt!...0..m......~K..)..uV3-@......-.lAL..^u.*.h...E...c.,....L....ym..!;0l.9.xu.9....6P...o..'d.$e~n'(E.W.v.F.4.=..5.<......_.I..Ve0..WI..`.|.@.R...B.........ZU._.....u.GNS1.)l^.l.XP..^.jN.:5..u.wN...cn...].u'.i...'......M...m}?.0...._...<L.R.. ......D...M.$.yi.n......>.....9...i.g.-..\.../......."._..H.Gy.B?....r...c....f.4..X.[...@..`M.8.j.".....l..92k...N/..eG...p.+.vO0.......G..^T".S.8.T.3...J,....l.v..vj...P....;...y.J....?jP..2..3..p..U...K.m.s....#.EB;.$9R.T....Cw,.;.....R..o..^.Dz.]e.r..g8..&../.z.....do...2..<..c.|.B...?>.....w..fs[....{....C..EH......=...("....s...7./.;.u...@...G4...iK9$)nK*a&..$.....&....L... ..K....z...DC4K.q.,7XS[e......I.../.v+....xm..h.M.#....r.....&yt..

                                                                                          C:\Users\user\Documents\DVWHKMNFNN\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Documents\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Documents\HTAGVDFUIE\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Documents\JSDNGYCOWY\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Documents\KATAXZVCPS.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.83148842827377
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:/UyJNu94++dDdy85+PPtlX4uxGNYnz9z2n4qIvI56M2:/UyJW+dP5+PPX4uxGEz964qIvG2
                                                                                          MD5:D026143CE0CDA2879E301DCEC491D590
                                                                                          SHA1:88E2D551515B0470331D80AAFA0C1863ECA11CA3
                                                                                          SHA-256:28F1FC866FF0F9B2BA73B37FF8ACF78745F9F65148C5174FBD65304A5FD7FFFF
                                                                                          SHA-512:584CD6B3347F939B468AA5DD8503586F7F24D73B5A3D6650ABBAB1E25471119827C8A983AA4446EF7F8B131C56B4BA3D831FAAC9C22FFCB0F97F7CC63A678A0C
                                                                                          Malicious:false
                                                                                          Preview:Y..+.@i..MB....Y$....v...owZ#Q....+mh..U^v.v.G`.z{..|MHIVl.8.M.#x....qf.p#".....\...bP/.(....9.Vi'..r..x)...wKN.K2On.u.e..i...nf.|...N.....T[P..n.......L.....HeK..H.O..,.]&.)...t.......m..%......m...21..1:+.AT.....=..BO...N...J........s.$.Z.v@.y.|.d.sM..`.....0.l.v..V?.:.].@O.....I1C..T....*..I.K].S.*.k]Kr:t67. ...v......$.....*/a...rx._.2C9...gG?.[.....2.......^..i.z....=.Gn..FOM.....\.Jr#.v.j...|.i.Z..).......xwj0..]r..j...$.......Z...g..u.N=.q..h.Z*..q.^i.....Z..c....1h..Td.hy....e...RO...Q.k...... ..fc.......Q.~I....L."H.f.3E..v./........B.....3..Pc.e.V....".[.\s.......hx.H/..w.xE....hJ-."ch.7~8Lg..W.Z......,........~...r.G.Z..A....G....O<..\.}$."..~{%|....Q+J<.2.....xc.B.7..a?....n..S...;..n/..'.\.j..~.[H..pw....R R|.aw`^....*..y..2..(~/......_o.../I...trq..s....@..Cz..ns......f........fe...:<.r.g.R....E.....b.=..Lzo:M...f1....=E3.....&..3..MpA.N.....C&.3.+.T....Kz...t .Wi...x?]......f2V....$o..v.z...X.....4.g..YN..H..o\..K.NO.

                                                                                          C:\Users\user\Documents\KATAXZVCPS.mp3.SUcY (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.83148842827377
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:/UyJNu94++dDdy85+PPtlX4uxGNYnz9z2n4qIvI56M2:/UyJW+dP5+PPX4uxGEz964qIvG2
                                                                                          MD5:D026143CE0CDA2879E301DCEC491D590
                                                                                          SHA1:88E2D551515B0470331D80AAFA0C1863ECA11CA3
                                                                                          SHA-256:28F1FC866FF0F9B2BA73B37FF8ACF78745F9F65148C5174FBD65304A5FD7FFFF
                                                                                          SHA-512:584CD6B3347F939B468AA5DD8503586F7F24D73B5A3D6650ABBAB1E25471119827C8A983AA4446EF7F8B131C56B4BA3D831FAAC9C22FFCB0F97F7CC63A678A0C
                                                                                          Malicious:false
                                                                                          Preview:Y..+.@i..MB....Y$....v...owZ#Q....+mh..U^v.v.G`.z{..|MHIVl.8.M.#x....qf.p#".....\...bP/.(....9.Vi'..r..x)...wKN.K2On.u.e..i...nf.|...N.....T[P..n.......L.....HeK..H.O..,.]&.)...t.......m..%......m...21..1:+.AT.....=..BO...N...J........s.$.Z.v@.y.|.d.sM..`.....0.l.v..V?.:.].@O.....I1C..T....*..I.K].S.*.k]Kr:t67. ...v......$.....*/a...rx._.2C9...gG?.[.....2.......^..i.z....=.Gn..FOM.....\.Jr#.v.j...|.i.Z..).......xwj0..]r..j...$.......Z...g..u.N=.q..h.Z*..q.^i.....Z..c....1h..Td.hy....e...RO...Q.k...... ..fc.......Q.~I....L."H.f.3E..v./........B.....3..Pc.e.V....".[.\s.......hx.H/..w.xE....hJ-."ch.7~8Lg..W.Z......,........~...r.G.Z..A....G....O<..\.}$."..~{%|....Q+J<.2.....xc.B.7..a?....n..S...;..n/..'.\.j..~.[H..pw....R R|.aw`^....*..y..2..(~/......_o.../I...trq..s....@..Cz..ns......f........fe...:<.r.g.R....E.....b.=..Lzo:M...f1....=E3.....&..3..MpA.N.....C&.3.+.T....Kz...t .Wi...x?]......f2V....$o..v.z...X.....4.g..YN..H..o\..K.NO.

                                                                                          C:\Users\user\Documents\KATAXZVCPS.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.828485497716814
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:UAjQaHmRxPsbhb8OLGNQKBH5580WxFD1AOCDHy6ToqUEIlAzn+aL2:UAsaoUbeyKBZ58ZxB2rHy6oqoAz+aC
                                                                                          MD5:A209758440096F07C378BFD8553FE9BA
                                                                                          SHA1:31D82BC2ABD9D868E2DE7E3EE51154F30C30F5D1
                                                                                          SHA-256:EAB8638D2A3FBECCAC6B8069A723A8507DE628A70E554968DA2A92914D1073A9
                                                                                          SHA-512:4FBBBE707EB16DF4A8D89E0AFFC0A7E27D707A144DA2F813AD92A06C79F6AB81FA5F32786CCC215FA75EB1586B81CB921BA28FE453645E98FB2B8C495BE864EB
                                                                                          Malicious:false
                                                                                          Preview:f...=.#..g..3.}.Uv..*$.....8G.......[.@{S..#..B......rFz..M.n.?l.".%.{..U...s>..u......;v~}.h.sI..*...u.G..9....y.^..Q....]......%'L.....9.w.^..o.A8..$A.Rr..b5.5.w}X../...Y...GQM.#....q...A....oB.*...e...H.]S,.~J..`..3........@....[4...|....."M......h...)..{m.R.f...Q.U...k11S.gqv*N.O..r=..P..g.N......4Ye.3.....R.[..|.W..Ue....<J......m]e..l......"...Npg(.$^...x.....z*b.....b.n..Q.?.x.4l..Q..Rr|..T...,..Q......7........=.K.....'..../......xO.\n/y,zo.,.+..l.uM2...0.....}.|.m.:N.m'.<N]..m....q0ux...p..>4*.......FF.......(.=.yq1.9.Z...[..d...i..G.u(...V.>.2W...c.R..Z...?8.~..g$x....ewgN..\L......].c.D.V.D....+.......yOLE...\.f.........q.b.%Ey..<..O..?..cd..J...)D2..)...J..D...`...M.(nB.1...m..DO.*xJ?t-.....d..q.G."x....s...IS.|..Sb...w..-.......+F|..x..R.r..*....l.G...=.!H. .<f...oP.....\.7'....k....m}.s....yAR...x...].V.....@....m...o......Xx.I.......|....l.2C...S..W..rL..D.5c.S%....0.. z.&;...W.P..3....,....>w..>C........

                                                                                          C:\Users\user\Documents\KATAXZVCPS.pdf.OfFn (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.828485497716814
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:UAjQaHmRxPsbhb8OLGNQKBH5580WxFD1AOCDHy6ToqUEIlAzn+aL2:UAsaoUbeyKBZ58ZxB2rHy6oqoAz+aC
                                                                                          MD5:A209758440096F07C378BFD8553FE9BA
                                                                                          SHA1:31D82BC2ABD9D868E2DE7E3EE51154F30C30F5D1
                                                                                          SHA-256:EAB8638D2A3FBECCAC6B8069A723A8507DE628A70E554968DA2A92914D1073A9
                                                                                          SHA-512:4FBBBE707EB16DF4A8D89E0AFFC0A7E27D707A144DA2F813AD92A06C79F6AB81FA5F32786CCC215FA75EB1586B81CB921BA28FE453645E98FB2B8C495BE864EB
                                                                                          Malicious:false
                                                                                          Preview:f...=.#..g..3.}.Uv..*$.....8G.......[.@{S..#..B......rFz..M.n.?l.".%.{..U...s>..u......;v~}.h.sI..*...u.G..9....y.^..Q....]......%'L.....9.w.^..o.A8..$A.Rr..b5.5.w}X../...Y...GQM.#....q...A....oB.*...e...H.]S,.~J..`..3........@....[4...|....."M......h...)..{m.R.f...Q.U...k11S.gqv*N.O..r=..P..g.N......4Ye.3.....R.[..|.W..Ue....<J......m]e..l......"...Npg(.$^...x.....z*b.....b.n..Q.?.x.4l..Q..Rr|..T...,..Q......7........=.K.....'..../......xO.\n/y,zo.,.+..l.uM2...0.....}.|.m.:N.m'.<N]..m....q0ux...p..>4*.......FF.......(.=.yq1.9.Z...[..d...i..G.u(...V.>.2W...c.R..Z...?8.~..g$x....ewgN..\L......].c.D.V.D....+.......yOLE...\.f.........q.b.%Ey..<..O..?..cd..J...)D2..)...J..D...`...M.(nB.1...m..DO.*xJ?t-.....d..q.G."x....s...IS.|..Sb...w..-.......+F|..x..R.r..*....l.G...=.!H. .<f...oP.....\.7'....k....m}.s....yAR...x...].V.....@....m...o......Xx.I.......|....l.2C...S..W..rL..D.5c.S%....0.. z.&;...W.P..3....,....>w..>C........

                                                                                          C:\Users\user\Documents\KATAXZVCPS.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.860877898858101
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:H/a/sT96eu6DvyppPp6/6mYBvEXFo244k0ekokLbHbcWoVCtAxLuVtw4Q4Vwd0H0:C/OVPvap/1EXG4kSokPgVEcLu3w4tVwX
                                                                                          MD5:81A3138796871FBE06C8573CD42225EC
                                                                                          SHA1:B2C252A53863279BD35803D39D0BC1CDCA1BF4BB
                                                                                          SHA-256:62ECBCFCE1B1D56E9AADDFF9CBBC29AFCC370AEC85E5B49599D37428158909D5
                                                                                          SHA-512:38B06EA8DDA6AB2EF42AD402881B888D93B3334DD32701E6497BAF51E72FCDEA68F3DDB6A32399C8D8A0F982E2F7C089E0F0218B7138934A1F0F022D3A57CD78
                                                                                          Malicious:false
                                                                                          Preview:..Fz.3...|..T....!.k.....P..u(........B..a`Q...8.Jw....J"+.m1\.1....s.S....`;.~!~y...3......Dk.({.K..B...C..f{..f...]..._o...O..... .m....#p|elx.......Y..s....|.Z....w-w.o].`.....l.xq..*?..a$.SWL.e..M[.b.....;.FKX.R...3..M....~C....@J...:......T....T.w...f.4..7>PW+.t.....#N..e`..1..N..I.m........h5u.@....2.!T.6.Eg..x.X....6=.a....L.mj.td!....9....C..6.S......$.w..;0.|..sH.S29.......y...0^.rl..Y0.r....G.%.......X...9.z.s....g^;?.-...3....:7Q;*J..\I.......ep@Tw..!6y^..^v.`.Z.DW..z@...R..z.s...*.3.B#..Wv9.o...JA.(..g9..(.U..- T.@i|DN1..]@...H...-.o..`.i}v0.......v.OJ.4.,.sW......#..i'H....S..}...+9..x..U.......\....7..m(C|.....Tq)...!..OO....C.u95L.`....!......Y.f...Twu#.....2[P.).K]p........iq...e#{.G./e.u.u.xU...9p...Vt...KgcK.e5.Qk..D......"sv)..2E.T...V.:.i..s...[y..DT!n...rg.ux..........J...;/[ZS.....>*.'..m..N..b...8.?.vo. b... .8.<."...x{4...W...4.K...'..6...h..M.........h.G@'...>..^..}.x9....n:.........<r....k.MD.c.Z./;.7....8...q.

                                                                                          C:\Users\user\Documents\KATAXZVCPS.xlsx.GHwC (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.860877898858101
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:H/a/sT96eu6DvyppPp6/6mYBvEXFo244k0ekokLbHbcWoVCtAxLuVtw4Q4Vwd0H0:C/OVPvap/1EXG4kSokPgVEcLu3w4tVwX
                                                                                          MD5:81A3138796871FBE06C8573CD42225EC
                                                                                          SHA1:B2C252A53863279BD35803D39D0BC1CDCA1BF4BB
                                                                                          SHA-256:62ECBCFCE1B1D56E9AADDFF9CBBC29AFCC370AEC85E5B49599D37428158909D5
                                                                                          SHA-512:38B06EA8DDA6AB2EF42AD402881B888D93B3334DD32701E6497BAF51E72FCDEA68F3DDB6A32399C8D8A0F982E2F7C089E0F0218B7138934A1F0F022D3A57CD78
                                                                                          Malicious:false
                                                                                          Preview:..Fz.3...|..T....!.k.....P..u(........B..a`Q...8.Jw....J"+.m1\.1....s.S....`;.~!~y...3......Dk.({.K..B...C..f{..f...]..._o...O..... .m....#p|elx.......Y..s....|.Z....w-w.o].`.....l.xq..*?..a$.SWL.e..M[.b.....;.FKX.R...3..M....~C....@J...:......T....T.w...f.4..7>PW+.t.....#N..e`..1..N..I.m........h5u.@....2.!T.6.Eg..x.X....6=.a....L.mj.td!....9....C..6.S......$.w..;0.|..sH.S29.......y...0^.rl..Y0.r....G.%.......X...9.z.s....g^;?.-...3....:7Q;*J..\I.......ep@Tw..!6y^..^v.`.Z.DW..z@...R..z.s...*.3.B#..Wv9.o...JA.(..g9..(.U..- T.@i|DN1..]@...H...-.o..`.i}v0.......v.OJ.4.,.sW......#..i'H....S..}...+9..x..U.......\....7..m(C|.....Tq)...!..OO....C.u95L.`....!......Y.f...Twu#.....2[P.).K]p........iq...e#{.G./e.u.u.xU...9p...Vt...KgcK.e5.Qk..D......"sv)..2E.T...V.:.i..s...[y..DT!n...rg.ux..........J...;/[ZS.....>*.'..m..N..b...8.?.vo. b... .8.<."...x{4...W...4.K...'..6...h..M.........h.G@'...>..^..}.x9....n:.........<r....k.MD.c.Z./;.7....8...q.

                                                                                          C:\Users\user\Documents\LTKMYBSEYZ.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:COM executable for DOS
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.872534013601208
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:AlFvgLqQLD7wC+uU0N3YKmcK8NONCQW3mTNfsF9t/wsxDWa9:AlFvgLjLwCTfRhfNONCf3mhfsFrIsYa9
                                                                                          MD5:11AAD50308C98AA6A016EC4969F784A2
                                                                                          SHA1:3CAED15A4F0F93A5B849133D3E420C07F0FA5571
                                                                                          SHA-256:BB1948AAC81A180CEFD7F048FF5C210CF1DAFAEB22F1F950530B631C6AB75029
                                                                                          SHA-512:1604A94198FE79BB41C7A2281D23A30A6F85580A4E8CBA368467C1DF4B4AB3C812B948BE99F1A0C99C6E06170594E01B3B712BE64E181EF9A59D8E364A8D500E
                                                                                          Malicious:false
                                                                                          Preview:...M...K...`...A=/...+.'.1.rj.}i.7....J.H.&.i;m....1.$2..^|.xI.........LW..2..aOP.&2.B..q..MS...6sM.I...\;..^............`...Ni4{...[.B.>i......n);F.S.M.....*.....~..S.O..Zj.8n.[.3.sc.cz...}.n#.".....c.-.}z...|.....({...u.T...wj#......o|._d...g......{1./W?...d..`_...r..i....t..cIW..^K...y...)^...2.%m......5..H.V....$..@..+I...zY#.xu........!...9......-......8........l$.h..]{9.-.Z..}....x..2i7..w.r)...........{..Y..Vc...A]...i5/!{...U>..M.0.N..t|......)..,.M.J..A...`.po.A.7..)i....^`.....O.,Y:..K.}..T.X..~...;...V=..W.B....Z..........*..6.6l.../.i+......d.(...X.|....1...^...D..eD.&$.&.*..W'..63.G.6..[..f..t.....R.'P..B.$.q..%..@`C..s@.RGr.w...Mn.......f...e#>..]@a.......5/&....c....8...'..&.0...P H.....k..D>g.......U.....M...JT.h..F[...o....E.o.......y......+.\d.T....&.l6..N....d.~...."<.GXvF..:.F...L@4.&..tQ..].\t.!.?o:..)9.L...J...t.b...eP..@M.....d...v..EO+..r.L..5.$.._.Xj...>Z@.pD...].d..m.d.9@.'..?9.W....T..r.......:.0.....O..G.

                                                                                          C:\Users\user\Documents\LTKMYBSEYZ.pdf.NHyT (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:COM executable for DOS
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.872534013601208
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:AlFvgLqQLD7wC+uU0N3YKmcK8NONCQW3mTNfsF9t/wsxDWa9:AlFvgLjLwCTfRhfNONCf3mhfsFrIsYa9
                                                                                          MD5:11AAD50308C98AA6A016EC4969F784A2
                                                                                          SHA1:3CAED15A4F0F93A5B849133D3E420C07F0FA5571
                                                                                          SHA-256:BB1948AAC81A180CEFD7F048FF5C210CF1DAFAEB22F1F950530B631C6AB75029
                                                                                          SHA-512:1604A94198FE79BB41C7A2281D23A30A6F85580A4E8CBA368467C1DF4B4AB3C812B948BE99F1A0C99C6E06170594E01B3B712BE64E181EF9A59D8E364A8D500E
                                                                                          Malicious:false
                                                                                          Preview:...M...K...`...A=/...+.'.1.rj.}i.7....J.H.&.i;m....1.$2..^|.xI.........LW..2..aOP.&2.B..q..MS...6sM.I...\;..^............`...Ni4{...[.B.>i......n);F.S.M.....*.....~..S.O..Zj.8n.[.3.sc.cz...}.n#.".....c.-.}z...|.....({...u.T...wj#......o|._d...g......{1./W?...d..`_...r..i....t..cIW..^K...y...)^...2.%m......5..H.V....$..@..+I...zY#.xu........!...9......-......8........l$.h..]{9.-.Z..}....x..2i7..w.r)...........{..Y..Vc...A]...i5/!{...U>..M.0.N..t|......)..,.M.J..A...`.po.A.7..)i....^`.....O.,Y:..K.}..T.X..~...;...V=..W.B....Z..........*..6.6l.../.i+......d.(...X.|....1...^...D..eD.&$.&.*..W'..63.G.6..[..f..t.....R.'P..B.$.q..%..@`C..s@.RGr.w...Mn.......f...e#>..]@a.......5/&....c....8...'..&.0...P H.....k..D>g.......U.....M...JT.h..F[...o....E.o.......y......+.\d.T....&.l6..N....d.~...."<.GXvF..:.F...L@4.&..tQ..].\t.!.?o:..)9.L...J...t.b...eP..@M.....d...v..EO+..r.L..5.$.._.Xj...>Z@.pD...].d..m.d.9@.'..?9.W....T..r.......:.0.....O..G.

                                                                                          C:\Users\user\Documents\NIKHQAIQAU\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Documents\NWTVCDUMOB.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.844790043570119
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:dxUFRvgEyMw3LqBJ4JbQjyXW1YtWsIuCNOS1hHHl47Wonz/Dh:0/vjz+JbQjv1EzrXS3HHlOdzLh
                                                                                          MD5:F278B56523F1FF0AC7FB22C7185F074C
                                                                                          SHA1:308D973CE806A8FC808C70F7D89CA53AF4429D85
                                                                                          SHA-256:651481114AE238F88186FF3108A6AA766DB500FC852D98A8CEF55EC73AB4DE58
                                                                                          SHA-512:A2AC51EB293E85B8D0AD6F5E940CCCFDCC303FD8C239AE18E416066D0C153E07EEAEFA671034E1A0F6851EEA22AE150788BB9AF3098971AEE354A1B4207795CF
                                                                                          Malicious:false
                                                                                          Preview:...X...(..;.....<.Es...$$...3.L.v..l...Ii..cv...@..?)D..f.......z.".. .........Un6.F./...Iz.:.wmO.BA...&......B...5...-35K.j=..F'I.q....,I0....u...#...$[c...F.ha.$..t...s.M......n...F.as.'.......K..N...f..O.......^.2_.g......4..Ys.C...]......uu..qf83.i..b>I....M.,.|Dt.M......=Y.K...O.-..JH,o.5....u~.Z.~D.......gX.u"e.iz..*.z>].....U...B.7.8>.hW/.ro.{a..rJ*}FK....&....3/z1.0..p....;.R...S*a...{>....|......Xj...S-..........E.j.}.ZR.....'.\....B...\.7^.*.0S.+1...p.Y...1.o..U.1r3v8.}.%a.xF.;J...tg...8b.......Q...".(s....\.... ..h(..iD.h2.t.*..........g.v.W..g.p....b&..4.....c.k;.?..x..{..A.E.Xg.".....f.5?..).''.g.~..S^.7>N.A$O.:.3;....%.L.:x...5.....W[..1.,.*...a....A..6_....*.{7`'..}.3..l.&sX.zC.T..5=..$.............D;.W.2.)....~.....b..$.....P.v-..axQn..#......5...}..[......t.~..y[g..C.0..........*...Q.x.D7.....T...1..0u.k..f>..o..>..T. .u....r.K.....&.L........_..'.|Uz.[..;.|....~...lC:j.o..I....m.Y.}"!.NT.l..z...u...9....

                                                                                          C:\Users\user\Documents\NWTVCDUMOB.png.CWTp (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.844790043570119
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:dxUFRvgEyMw3LqBJ4JbQjyXW1YtWsIuCNOS1hHHl47Wonz/Dh:0/vjz+JbQjv1EzrXS3HHlOdzLh
                                                                                          MD5:F278B56523F1FF0AC7FB22C7185F074C
                                                                                          SHA1:308D973CE806A8FC808C70F7D89CA53AF4429D85
                                                                                          SHA-256:651481114AE238F88186FF3108A6AA766DB500FC852D98A8CEF55EC73AB4DE58
                                                                                          SHA-512:A2AC51EB293E85B8D0AD6F5E940CCCFDCC303FD8C239AE18E416066D0C153E07EEAEFA671034E1A0F6851EEA22AE150788BB9AF3098971AEE354A1B4207795CF
                                                                                          Malicious:false
                                                                                          Preview:...X...(..;.....<.Es...$$...3.L.v..l...Ii..cv...@..?)D..f.......z.".. .........Un6.F./...Iz.:.wmO.BA...&......B...5...-35K.j=..F'I.q....,I0....u...#...$[c...F.ha.$..t...s.M......n...F.as.'.......K..N...f..O.......^.2_.g......4..Ys.C...]......uu..qf83.i..b>I....M.,.|Dt.M......=Y.K...O.-..JH,o.5....u~.Z.~D.......gX.u"e.iz..*.z>].....U...B.7.8>.hW/.ro.{a..rJ*}FK....&....3/z1.0..p....;.R...S*a...{>....|......Xj...S-..........E.j.}.ZR.....'.\....B...\.7^.*.0S.+1...p.Y...1.o..U.1r3v8.}.%a.xF.;J...tg...8b.......Q...".(s....\.... ..h(..iD.h2.t.*..........g.v.W..g.p....b&..4.....c.k;.?..x..{..A.E.Xg.".....f.5?..).''.g.~..S^.7>N.A$O.:.3;....%.L.:x...5.....W[..1.,.*...a....A..6_....*.{7`'..}.3..l.&sX.zC.T..5=..$.............D;.W.2.)....~.....b..$.....P.v-..axQn..#......5...}..[......t.~..y[g..C.0..........*...Q.x.D7.....T...1..0u.k..f>..o..>..T. .u....r.K.....&.L........_..'.|Uz.[..;.|....~...lC:j.o..I....m.Y.}"!.NT.l..z...u...9....

                                                                                          C:\Users\user\Documents\ONBQCLYSPU.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8324204998736455
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:wpHfhSkz7vW3cSmiYug0c2QGaRFCnpZccZE3uNPA5gdXuFm:w1fh1z7Zn81YRFCp76eNPA5ap
                                                                                          MD5:583110EBE8227C18A6F3A323B9D65B01
                                                                                          SHA1:78FAC776FCA3DB098250899A3E7A0C6C0966FF21
                                                                                          SHA-256:34154CAE4D0E771B41023D46AA23B22A73F3D62D74546553E1A305903AAE3958
                                                                                          SHA-512:1E105ACAAE4F6B0C8A109C9778D12AB0DAE00CF3997494B9A135F669D53A69B646FB61D5F3DEF1647921A70589D17AD8AD8CAA1A8DFB518D4A3C7410C7EEE901
                                                                                          Malicious:false
                                                                                          Preview:.'QVE...3....JJ*Ubs<.y...2..o{x....pg.Z.$F[..X..J(..Rj..f.l.h%*....X..fjr.mK1.D...lR...Q...;9...)\.H.FoizUS..Y...9...Q..VzJ..l0]....(.g6.d.{0\..I...CH|.C....T.8..H../.......A...q.....9.(rs...0n..z.a.-...3.,..%L.L<.W...*9.).B..($.HS...u.\*...(Q.Byz1...A%...Uq..[}...X..q.%...4....BP....O.=...e......L..:.N[.......,......&c...3..7..Y...4.h....(......H?......|...i..AV.A.*P..'...3.....|1x.p...*...o+..B#...n2.......i....9....Vw.|F.+...S6..t^bd.7.d....R[..JYQb.Z..n.eE...PY....Fw......S..\..i|..GP.0.v..BUt...T..RFC...cM4.10.?vVi.....S..cJA}2.v...qBEYAg.~-...l5......%.y..Vm^.q..#......;?.p..;.......6R......O..^2b.<kR..{A...L.]M..u"..g.v.....=>$em...4....6\.........._7?.mZ.8....@.......@NA...'..o.A11S..aN.m..UE...;Tt]...en..K.E.|92........JM..:t.Z..]uEGbh.<.J'u..e.A...6.@..e.R...l.S..!.....jP..,.J...t.<..:.#M%...k.~.a......,Q............P.-=...8.2.K..M.C..]$[....&z....r.....V..y.&.h1bl...`.T...K94~gH.:.vhM..8._*.|......XM..W.p...Bom4...C.m.R.@.:.,..d...

                                                                                          C:\Users\user\Documents\ONBQCLYSPU.docx.GQBt (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8324204998736455
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:wpHfhSkz7vW3cSmiYug0c2QGaRFCnpZccZE3uNPA5gdXuFm:w1fh1z7Zn81YRFCp76eNPA5ap
                                                                                          MD5:583110EBE8227C18A6F3A323B9D65B01
                                                                                          SHA1:78FAC776FCA3DB098250899A3E7A0C6C0966FF21
                                                                                          SHA-256:34154CAE4D0E771B41023D46AA23B22A73F3D62D74546553E1A305903AAE3958
                                                                                          SHA-512:1E105ACAAE4F6B0C8A109C9778D12AB0DAE00CF3997494B9A135F669D53A69B646FB61D5F3DEF1647921A70589D17AD8AD8CAA1A8DFB518D4A3C7410C7EEE901
                                                                                          Malicious:false
                                                                                          Preview:.'QVE...3....JJ*Ubs<.y...2..o{x....pg.Z.$F[..X..J(..Rj..f.l.h%*....X..fjr.mK1.D...lR...Q...;9...)\.H.FoizUS..Y...9...Q..VzJ..l0]....(.g6.d.{0\..I...CH|.C....T.8..H../.......A...q.....9.(rs...0n..z.a.-...3.,..%L.L<.W...*9.).B..($.HS...u.\*...(Q.Byz1...A%...Uq..[}...X..q.%...4....BP....O.=...e......L..:.N[.......,......&c...3..7..Y...4.h....(......H?......|...i..AV.A.*P..'...3.....|1x.p...*...o+..B#...n2.......i....9....Vw.|F.+...S6..t^bd.7.d....R[..JYQb.Z..n.eE...PY....Fw......S..\..i|..GP.0.v..BUt...T..RFC...cM4.10.?vVi.....S..cJA}2.v...qBEYAg.~-...l5......%.y..Vm^.q..#......;?.p..;.......6R......O..^2b.<kR..{A...L.]M..u"..g.v.....=>$em...4....6\.........._7?.mZ.8....@.......@NA...'..o.A11S..aN.m..UE...;Tt]...en..K.E.|92........JM..:t.Z..]uEGbh.<.J'u..e.A...6.@..e.R...l.S..!.....jP..,.J...t.<..:.#M%...k.~.a......,Q............P.-=...8.2.K..M.C..]$[....&z....r.....V..y.&.h1bl...`.T...K94~gH.:.vhM..8._*.|......XM..W.p...Bom4...C.m.R.@.:.,..d...

                                                                                          C:\Users\user\Documents\ONBQCLYSPU.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.841971171233963
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:+J6/6NhZfUIxVdOG7vnHMdxffgRIT9R9EzIyD+8wCYMPuA:+E6XhHM/oRC9E0rY1v
                                                                                          MD5:D9D5A5E8C6C440C040C61B76B8FBBFF1
                                                                                          SHA1:A8B39351035D3A14FAB326E01C05F25085AC3A80
                                                                                          SHA-256:239956DCA0F0EB71F3C32E650682BAD3AE72CA926A9EFA8613B0BCA9EDDAA76C
                                                                                          SHA-512:C29612299FBCF342F35F3041698DC587A8E85F11E122391A6CB2EF3F226A14A40221E7463A7A737110EB6964EE7B5290C9575B5D0468CE9B8C6EE6673C345C5D
                                                                                          Malicious:false
                                                                                          Preview:.Js..}..^.3.......Q.u/.....$.b$.....\e6.oa.2...x.g4....Y.yx6......_..l|.8..'..4...c.:....\.^W..'...R.n..u9.....fC.......*....l.-.I.g...<0...%...!...4g......9.(....?.w..=...8X......x...C_f....+L......|..D..u#........Nv.Y.V......`{D....~Y..39z.d.P0..#..|.......X..PT...M...e@X.+^..u.[..SX\....zVGq~m.....oS....?..U....U.4.l.P.a"...&<...3v....(..,]...\.u.U_7.=...w.G./..".?.DP..J.!..I.e../.ga...a.H..}:...S.0.)...98...N.gmlx....).8...z.%...<....%{.Xq.b.\.5;q..o$N.D../..l..#.&..I.8z.R...?....L{B,...U.$&}\..@.I..D..S.pdH].S.,~K..>.i..Z.....#.s%.X\.I.J^`>...P..>.3.,....h..d.;.m..o.{..?.6...LQ...7...H...G..A.N.fO.........:3S.a.N.V.&@f. ...-.).Z..$.`r.9.7...--L.M{..|BD.......%-j....Dx.~`.$.....e....L.....-fP@U_.Q.......0...MI4.+.z%...uz2....2`sTJ\5....~D+.Y>..}....?.J..}.a..\..[H8..i?_...SZa.;..).).U>..R..B......>..X.!2.x]W..+G.J.<+..%.M#eC.a.8.+..!.Jm.._.. V.e...Z..l5u..]..y...,...'yK..Xq(5.#...K...R.$V!].2B.Y.$.5...>`..!..X .~.3<...].."..#k...!..b

                                                                                          C:\Users\user\Documents\ONBQCLYSPU.pdf.qLEF (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.841971171233963
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:+J6/6NhZfUIxVdOG7vnHMdxffgRIT9R9EzIyD+8wCYMPuA:+E6XhHM/oRC9E0rY1v
                                                                                          MD5:D9D5A5E8C6C440C040C61B76B8FBBFF1
                                                                                          SHA1:A8B39351035D3A14FAB326E01C05F25085AC3A80
                                                                                          SHA-256:239956DCA0F0EB71F3C32E650682BAD3AE72CA926A9EFA8613B0BCA9EDDAA76C
                                                                                          SHA-512:C29612299FBCF342F35F3041698DC587A8E85F11E122391A6CB2EF3F226A14A40221E7463A7A737110EB6964EE7B5290C9575B5D0468CE9B8C6EE6673C345C5D
                                                                                          Malicious:false
                                                                                          Preview:.Js..}..^.3.......Q.u/.....$.b$.....\e6.oa.2...x.g4....Y.yx6......_..l|.8..'..4...c.:....\.^W..'...R.n..u9.....fC.......*....l.-.I.g...<0...%...!...4g......9.(....?.w..=...8X......x...C_f....+L......|..D..u#........Nv.Y.V......`{D....~Y..39z.d.P0..#..|.......X..PT...M...e@X.+^..u.[..SX\....zVGq~m.....oS....?..U....U.4.l.P.a"...&<...3v....(..,]...\.u.U_7.=...w.G./..".?.DP..J.!..I.e../.ga...a.H..}:...S.0.)...98...N.gmlx....).8...z.%...<....%{.Xq.b.\.5;q..o$N.D../..l..#.&..I.8z.R...?....L{B,...U.$&}\..@.I..D..S.pdH].S.,~K..>.i..Z.....#.s%.X\.I.J^`>...P..>.3.,....h..d.;.m..o.{..?.6...LQ...7...H...G..A.N.fO.........:3S.a.N.V.&@f. ...-.).Z..$.`r.9.7...--L.M{..|BD.......%-j....Dx.~`.$.....e....L.....-fP@U_.Q.......0...MI4.+.z%...uz2....2`sTJ\5....~D+.Y>..}....?.J..}.a..\..[H8..i?_...SZa.;..).).U>..R..B......>..X.!2.x]W..+G.J.<+..%.M#eC.a.8.+..!.Jm.._.. V.e...Z..l5u..]..y...,...'yK..Xq(5.#...K...R.$V!].2B.Y.$.5...>`..!..X .~.3<...].."..#k...!..b

                                                                                          C:\Users\user\Documents\ONBQCLYSPU\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Documents\ONBQCLYSPU\KATAXZVCPS.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.842319857563073
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:M+YUrEOj8rob5gXH//09JDdB/DDsxqBZ1F9GQ+9Dz7kmXeEFgELBS:MpUrDj8Y5gX//09V7DsgBZ1b+tPkmXeL
                                                                                          MD5:E82A008AEF0957639E9FEB7403258C77
                                                                                          SHA1:CB71A891EF329494812DDBD0E942A2B840D29ADF
                                                                                          SHA-256:A16F67EDA7D1B1411ED5A96BA636EF7DA14ADB2699CF3089EB5FE79026965DA5
                                                                                          SHA-512:1F1865B4AD25909542C7E92AB99B406D45D413388471181E3CDBDEED8FE699FE40331C140EE9128D002DE2A15E33288B2A672B62FA1BB33C29D45623276E99FF
                                                                                          Malicious:false
                                                                                          Preview:.a.i.!Dg..4...."+.Q.r.......8._...g....-1Y..\c].K.">W.kA....RF...<..j.Z...=.=R....E*...z.........8x.UM.t...'.=.F.......!.0.....xH..q.I..Y<..K.>. .X...D4.<.'&.[.5..IW..f{[.0.[.....o./...,.7\JV..*...L...]*.....q....g.i....S.k>.\....K5G......<.....9..X....(.F...$]j#.}.....E...Xf...1B.f...'v..]A....O..Xs.k...M+.ms....fm../K.i..q:......n.ag..-..@...Jt.4(K.`6....7j..R(C..Ud..3...^>b9.....C....+......,....@...g.d......D.Q.J.k.'.j..N...{...y..ddn....Ft.r;r@l.0.p}.lR...E%...A.Uh|..&.J.".......V.]...I.o./0.X.i=.T..S.b..C.M..6...D."..e#..y.Fk~....MP.*V4.l...&.R..@..5..'...Bsq.}ps...<.DG?.YY..27dX/........<...D\&....xV.6.p...g-..h..6.sou.S.&H.2. ll"$..e.!...~..."u..l/...e,.g....y6in..U..,o.....A.Vg....s...D`~....~..q.K..i....4Tb.9.7.@.]....(.f....nL...wc...$J^y.o...o.....fG.,...f}.......m.D.C.Y.j..0.D|<.h..C.;=......=......./?\...~.f|t....S8.W...v..N....*...tg..J.5;.b[.^:l.D.91.rQ.*0$.....j....h...r.e~..4." .Io....l..g.T....d.U.ky+../QADc2:....c.9<.<....>.

                                                                                          C:\Users\user\Documents\ONBQCLYSPU\KATAXZVCPS.xlsx.UpaD (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.842319857563073
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:M+YUrEOj8rob5gXH//09JDdB/DDsxqBZ1F9GQ+9Dz7kmXeEFgELBS:MpUrDj8Y5gX//09V7DsgBZ1b+tPkmXeL
                                                                                          MD5:E82A008AEF0957639E9FEB7403258C77
                                                                                          SHA1:CB71A891EF329494812DDBD0E942A2B840D29ADF
                                                                                          SHA-256:A16F67EDA7D1B1411ED5A96BA636EF7DA14ADB2699CF3089EB5FE79026965DA5
                                                                                          SHA-512:1F1865B4AD25909542C7E92AB99B406D45D413388471181E3CDBDEED8FE699FE40331C140EE9128D002DE2A15E33288B2A672B62FA1BB33C29D45623276E99FF
                                                                                          Malicious:false
                                                                                          Preview:.a.i.!Dg..4...."+.Q.r.......8._...g....-1Y..\c].K.">W.kA....RF...<..j.Z...=.=R....E*...z.........8x.UM.t...'.=.F.......!.0.....xH..q.I..Y<..K.>. .X...D4.<.'&.[.5..IW..f{[.0.[.....o./...,.7\JV..*...L...]*.....q....g.i....S.k>.\....K5G......<.....9..X....(.F...$]j#.}.....E...Xf...1B.f...'v..]A....O..Xs.k...M+.ms....fm../K.i..q:......n.ag..-..@...Jt.4(K.`6....7j..R(C..Ud..3...^>b9.....C....+......,....@...g.d......D.Q.J.k.'.j..N...{...y..ddn....Ft.r;r@l.0.p}.lR...E%...A.Uh|..&.J.".......V.]...I.o./0.X.i=.T..S.b..C.M..6...D."..e#..y.Fk~....MP.*V4.l...&.R..@..5..'...Bsq.}ps...<.DG?.YY..27dX/........<...D\&....xV.6.p...g-..h..6.sou.S.&H.2. ll"$..e.!...~..."u..l/...e,.g....y6in..U..,o.....A.Vg....s...D`~....~..q.K..i....4Tb.9.7.@.]....(.f....nL...wc...$J^y.o...o.....fG.,...f}.......m.D.C.Y.j..0.D|<.h..C.;=......=......./?\...~.f|t....S8.W...v..N....*...tg..J.5;.b[.^:l.D.91.rQ.*0$.....j....h...r.e~..4." .Io....l..g.T....d.U.ky+../QADc2:....c.9<.<....>.

                                                                                          C:\Users\user\Documents\ONBQCLYSPU\LTKMYBSEYZ.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.850729379505328
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Dwq8Z+fCGPNxMYHWQYVV2kTfeOQI2xcDj0aGeSN90hAs/f4y9x2IvL2:stZSZFxMCkvfNwSjtS78WIvC
                                                                                          MD5:16421EEE40EE2C3424A96068797FDF9F
                                                                                          SHA1:C61B296E0310544C6E7562FA478B3222B33B5B3D
                                                                                          SHA-256:DC832F47F9C7A8ACE1A5C640752E9B2BBBA9BB4587678B6663DDB5CC3F95D4FD
                                                                                          SHA-512:837825EF4F9E0D8A23E0B9057F08C551FCDD11FD47CBA76ED2BED6BCDEE6747E1250ED7A09FE4FF800FE07CCFBFB7DE5D8B970A2D24A8DE460C4039FA7A6DAC9
                                                                                          Malicious:false
                                                                                          Preview:...TY..4..nxs .+.R..p3.y..|..pS.<...E.u......=iDN..aR.,E..\...A...%..c..G&..2.,..5...1l.j....5.:..Bpc."..xO..tv......`..Q.m....x.M.*.D...\....)4U.T.w\.'....+..3?p..D......I........PD.[3..w$k..p....;!..1.%....'.2..XS.R9.i...'y%.m}S.E.....c..f....`.}..F......cR...0.Dh+._h..f........d.._.\.3..........N.>.s..e...fq.D......;.+...9..OY..A{....A.A.r&..gV.V..??..Z.n...r.<^M....[U...bE..B...6 .."....,.....!S.&1..'N{....\.#...m.<......v... .M.}iS...$.65adp..j3....G.=..A.~(J0.K..H....).....{.|...".-.......G.-...P.Y..K%l....Hg.Zm..'.G..$.~>..[.....Ra..6..~.`.Y......q.F*..M...2z.A.i.8.=+......v..%,.*W../.K.C.4._<..2f....RY.=c..c.yY%..F..."s...T0....{...+.."..5v..z.tk(E..|....D.U.M%....p6...E.:<.<./...R.e4.....q@W...h.......8.l-S?..U..b...cw{...0&.C..vh..>.1./..m.).~....A6&..t........R.......dg..EiP.........._.!.Q.o.I.v....WD!lu..u$oX.}.h....!M.|z.\.....t.....P@..=......o...'bX.T..."v!-3.A8...Rq+v&;.'>..J..=q..\.%..)]..j.9..d.Q.....2...E.r

                                                                                          C:\Users\user\Documents\ONBQCLYSPU\LTKMYBSEYZ.pdf.ZBUT (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.850729379505328
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Dwq8Z+fCGPNxMYHWQYVV2kTfeOQI2xcDj0aGeSN90hAs/f4y9x2IvL2:stZSZFxMCkvfNwSjtS78WIvC
                                                                                          MD5:16421EEE40EE2C3424A96068797FDF9F
                                                                                          SHA1:C61B296E0310544C6E7562FA478B3222B33B5B3D
                                                                                          SHA-256:DC832F47F9C7A8ACE1A5C640752E9B2BBBA9BB4587678B6663DDB5CC3F95D4FD
                                                                                          SHA-512:837825EF4F9E0D8A23E0B9057F08C551FCDD11FD47CBA76ED2BED6BCDEE6747E1250ED7A09FE4FF800FE07CCFBFB7DE5D8B970A2D24A8DE460C4039FA7A6DAC9
                                                                                          Malicious:false
                                                                                          Preview:...TY..4..nxs .+.R..p3.y..|..pS.<...E.u......=iDN..aR.,E..\...A...%..c..G&..2.,..5...1l.j....5.:..Bpc."..xO..tv......`..Q.m....x.M.*.D...\....)4U.T.w\.'....+..3?p..D......I........PD.[3..w$k..p....;!..1.%....'.2..XS.R9.i...'y%.m}S.E.....c..f....`.}..F......cR...0.Dh+._h..f........d.._.\.3..........N.>.s..e...fq.D......;.+...9..OY..A{....A.A.r&..gV.V..??..Z.n...r.<^M....[U...bE..B...6 .."....,.....!S.&1..'N{....\.#...m.<......v... .M.}iS...$.65adp..j3....G.=..A.~(J0.K..H....).....{.|...".-.......G.-...P.Y..K%l....Hg.Zm..'.G..$.~>..[.....Ra..6..~.`.Y......q.F*..M...2z.A.i.8.=+......v..%,.*W../.K.C.4._<..2f....RY.=c..c.yY%..F..."s...T0....{...+.."..5v..z.tk(E..|....D.U.M%....p6...E.:<.<./...R.e4.....q@W...h.......8.l-S?..U..b...cw{...0&.C..vh..>.1./..m.).~....A6&..t........R.......dg..EiP.........._.!.Q.o.I.v....WD!lu..u$oX.}.h....!M.|z.\.....t.....P@..=......o...'bX.T..."v!-3.A8...Rq+v&;.'>..J..=q..\.%..)]..j.9..d.Q.....2...E.r

                                                                                          C:\Users\user\Documents\ONBQCLYSPU\ONBQCLYSPU.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8280554422209345
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:alT4wqxF+koToVXzlzheDRMkxbInAX6riYb6mEpZ2f3YpOFGfmeNmpJN6T7tCNFr:mjI8iJzwSobIAX62Ymdge1ApJqmdwkoC
                                                                                          MD5:9351E1DC59F0B8CB48AA5F5CF556EDDA
                                                                                          SHA1:9CA192D97E8CF5DE907A7608A30BE3DF73966A81
                                                                                          SHA-256:47E762F553F2CAC000E36069B126283EEED442F9DC7C5524E4AE3E505F5AD8E3
                                                                                          SHA-512:139DF1F5432F50550C24C88351A1147E8106E0884B17A6949D64F63D3C5286E749B52912B1999479633DEE920AF64DEAE2D76964EC3B9BA2260ABCCDDD5CED10
                                                                                          Malicious:false
                                                                                          Preview:.V...*D.kSN...F.p...&..XP...!.Ye..OpWx...M..w"......HT..........7......,b5{.'_.. ...../.=h]...v..B.....^.X..m..".ua...n.^..UJ......P.......U...s...?...+6...8..r\......d1M6..VI.$...=...~..J..i...q..8..h.X....8....*...~.P.../..L.0...#.......X.X(.9kj.....B-).zt..eJ..V.`.;..4.....0.2...........0!..Sg....&r.la..b..RR.#.FT..w...b-o+...$.Zk^*dU...'......!...L...N..iy=..T.....?GzL...Xk.i.p.U...g...I...6..3.c..0..v...A...>..T..s....t.23.$..,e...&.Mo.o./.t.J,.99...%..l.T...7@E.....}.q....Hz^w........E.....u.Xw..Er.}..ab..P...Y.....M..zrAi..Z...d....#.)X...?Z...)..K .^'....y.wT.g.....-.....~G.>.Az.rs.4...b..rE.._.eU....w....Qm[.g9..A.r...uQ.c.>..R..\..->......^......4I[.lT.2l.%.=..^y...yLt_..!......}...`bd.v=)^.x.$k........%&.U.fi.....?..g;..)...J....XO.:.40e...4..<FC..E.R..Hi..F.t....5..N?\.5<7...m...=[.f...r.c. ...d...'.K..'..1.H.Pd}....... ..hz. H.j.....N.6.9....A&...6-k.PF..JY..B. ...v..Z1..:.~?..Y...p:...*....0~v^...gw'...v.6."..<......S.Z.'....[

                                                                                          C:\Users\user\Documents\ONBQCLYSPU\ONBQCLYSPU.docx.TeBS (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8280554422209345
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:alT4wqxF+koToVXzlzheDRMkxbInAX6riYb6mEpZ2f3YpOFGfmeNmpJN6T7tCNFr:mjI8iJzwSobIAX62Ymdge1ApJqmdwkoC
                                                                                          MD5:9351E1DC59F0B8CB48AA5F5CF556EDDA
                                                                                          SHA1:9CA192D97E8CF5DE907A7608A30BE3DF73966A81
                                                                                          SHA-256:47E762F553F2CAC000E36069B126283EEED442F9DC7C5524E4AE3E505F5AD8E3
                                                                                          SHA-512:139DF1F5432F50550C24C88351A1147E8106E0884B17A6949D64F63D3C5286E749B52912B1999479633DEE920AF64DEAE2D76964EC3B9BA2260ABCCDDD5CED10
                                                                                          Malicious:false
                                                                                          Preview:.V...*D.kSN...F.p...&..XP...!.Ye..OpWx...M..w"......HT..........7......,b5{.'_.. ...../.=h]...v..B.....^.X..m..".ua...n.^..UJ......P.......U...s...?...+6...8..r\......d1M6..VI.$...=...~..J..i...q..8..h.X....8....*...~.P.../..L.0...#.......X.X(.9kj.....B-).zt..eJ..V.`.;..4.....0.2...........0!..Sg....&r.la..b..RR.#.FT..w...b-o+...$.Zk^*dU...'......!...L...N..iy=..T.....?GzL...Xk.i.p.U...g...I...6..3.c..0..v...A...>..T..s....t.23.$..,e...&.Mo.o./.t.J,.99...%..l.T...7@E.....}.q....Hz^w........E.....u.Xw..Er.}..ab..P...Y.....M..zrAi..Z...d....#.)X...?Z...)..K .^'....y.wT.g.....-.....~G.>.Az.rs.4...b..rE.._.eU....w....Qm[.g9..A.r...uQ.c.>..R..\..->......^......4I[.lT.2l.%.=..^y...yLt_..!......}...`bd.v=)^.x.$k........%&.U.fi.....?..g;..)...J....XO.:.40e...4..<FC..E.R..Hi..F.t....5..N?\.5<7...m...=[.f...r.c. ...d...'.K..'..1.H.Pd}....... ..hz. H.j.....N.6.9....A&...6-k.PF..JY..B. ...v..Z1..:.~?..Y...p:...*....0~v^...gw'...v.6."..<......S.Z.'....[

                                                                                          C:\Users\user\Documents\ONBQCLYSPU\RAYHIWGKDI.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.845008097099242
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:0wkz9zC2jz2lIDL+r6JwV5R9EvUlT555AUig4Q6Pvr9QNkFTFqwfMxC:SG2NDar6JDcAng4QAdFTzX
                                                                                          MD5:EF3A49F208F561B5C9701D48B9EFAFDE
                                                                                          SHA1:111809369F9BAFDD21E71ADCDBEF7B9A2B6A8E7B
                                                                                          SHA-256:B386E9088C6DAF85FB10B89A7A1F2D9FA14043E82BD0B172BACFA22EF88E8E8D
                                                                                          SHA-512:337F72C3959B2DD58691E17473AA5D8B6B8638CF81827DE183CBC1ADCD026F0F5BF8C2F9F7FE710AFC603A3040FC6BC96BEC0B9DDDA5A03FA636DEB30379A1CF
                                                                                          Malicious:false
                                                                                          Preview:.*..._...L!5....5V....I[..#.....Z...2.D.....t.8Q....1.+P.a"].y-.X5y..5.u..g..(...Q........<..?X..9%..4+vW....(.i.4..r.^H.9..@....J.Y}..{&.'...xTs.B.~.......'....ps6..E..|.,.......N.......&r...C.]i.....~8.$...w..(......Bdr.O.R2(..6.2h.X....kL........qK....4..>...aC....>.}....M..-...[}%..a..#....1..2.......UW.+z.s`.mr.+Tm.D.f.0'...,...2...u......E.,..Yv....{..5.h..T....i..UN+.....e[..J}..yZ]j.p.u.[...;.!..yl.g..gE`.........-....o.*..P...H......"B.>r.i.Y&.,L..=6Z.||B2.00s.5KBc{w|.)2..c.E..Z..\TFj..?...G.P.5.;2..Jpy~.<M;..F.-g..6.BV.../.....K.%..B.....'C.3.1)|].......9i.!M.. .-..........j...v.:..|...z.:C(c"3$.Ct!.....'Rs...I....i.k..Xh!.A....F...V@...........@k._-...X.X..K.T.l...D..g.....{....d..".s.4..A0....../I.N..._=...R..a...CE.s0.....~.'....,q!.....a...]...[Q.or.......8.t}Sv.TT....H_...5e..KQ.j.......Q.nG......}..6....^."7!.....1z;}.3\v.......{..P..{.M<N.Z..W.H.k.{.y?..-C.]"V^9......_...>....O.s.${..".Pl...ON.<.U....+/N...C..FKD,...W..

                                                                                          C:\Users\user\Documents\ONBQCLYSPU\RAYHIWGKDI.mp3.msKP (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.845008097099242
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:0wkz9zC2jz2lIDL+r6JwV5R9EvUlT555AUig4Q6Pvr9QNkFTFqwfMxC:SG2NDar6JDcAng4QAdFTzX
                                                                                          MD5:EF3A49F208F561B5C9701D48B9EFAFDE
                                                                                          SHA1:111809369F9BAFDD21E71ADCDBEF7B9A2B6A8E7B
                                                                                          SHA-256:B386E9088C6DAF85FB10B89A7A1F2D9FA14043E82BD0B172BACFA22EF88E8E8D
                                                                                          SHA-512:337F72C3959B2DD58691E17473AA5D8B6B8638CF81827DE183CBC1ADCD026F0F5BF8C2F9F7FE710AFC603A3040FC6BC96BEC0B9DDDA5A03FA636DEB30379A1CF
                                                                                          Malicious:false
                                                                                          Preview:.*..._...L!5....5V....I[..#.....Z...2.D.....t.8Q....1.+P.a"].y-.X5y..5.u..g..(...Q........<..?X..9%..4+vW....(.i.4..r.^H.9..@....J.Y}..{&.'...xTs.B.~.......'....ps6..E..|.,.......N.......&r...C.]i.....~8.$...w..(......Bdr.O.R2(..6.2h.X....kL........qK....4..>...aC....>.}....M..-...[}%..a..#....1..2.......UW.+z.s`.mr.+Tm.D.f.0'...,...2...u......E.,..Yv....{..5.h..T....i..UN+.....e[..J}..yZ]j.p.u.[...;.!..yl.g..gE`.........-....o.*..P...H......"B.>r.i.Y&.,L..=6Z.||B2.00s.5KBc{w|.)2..c.E..Z..\TFj..?...G.P.5.;2..Jpy~.<M;..F.-g..6.BV.../.....K.%..B.....'C.3.1)|].......9i.!M.. .-..........j...v.:..|...z.:C(c"3$.Ct!.....'Rs...I....i.k..Xh!.A....F...V@...........@k._-...X.X..K.T.l...D..g.....{....d..".s.4..A0....../I.N..._=...R..a...CE.s0.....~.'....,q!.....a...]...[Q.or.......8.t}Sv.TT....H_...5e..KQ.j.......Q.nG......}..6....^."7!.....1z;}.3\v.......{..P..{.M<N.Z..W.H.k.{.y?..-C.]"V^9......_...>....O.s.${..".Pl...ON.<.U....+/N...C..FKD,...W..

                                                                                          C:\Users\user\Documents\ONBQCLYSPU\YPSIACHYXW.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.864207157437309
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:ECqmfth76jVIv4kojEESOmwjonjhLbNv8Omco4Vj8R/jvJ2HWLyYsahNT:F76mwxQmmphlAiGjvQ2L9
                                                                                          MD5:D24BEF736EE5DE470945DCABE0C1E2E2
                                                                                          SHA1:C0C2C038F1A7E46F2F50C203B42ECCF7BF2DE1D9
                                                                                          SHA-256:989E6760284DB41E27EE8B51FB3FB49AB6BF536D2B5DB7920FC4972736CAA26D
                                                                                          SHA-512:4C7063B8303704A4AE2221C5D8B7A8B71B3117226BD8A71C2E9C3D663B326F1FF0884D8DC6CC02C2DBB9EF9C15F9A93768719D1001B3821601BFF80A519307BE
                                                                                          Malicious:false
                                                                                          Preview:Q\..S..z.%.Tn...7.ea.k'.6...<qh...._.3.'>|b&...L$......9.....q...r..R...mE....B.u....KYX2...>.Sx..B...v? ...1.-.[;.Q*0..........v.4*<#\...w.P.x.5U(...:...#A~.pN"...nO..x+..=.^b..h`.Y.4....\^...=.....r.Q}.ox....+....3.%.....i...4s(.w.w.....;.^..M.j2l.=.I.* )......$....\.r........Q..VA..?...a.X../...m".AAb:.2.^u.^...S...H...;..KNLE.m..q....m3'Ho...].....2_.........@.-;.9.Q..|..?.s.?..].w....$tc<.....[$e..............6.Ja.l..(.A......x.m.i...2.PI.1Np..<.t.q!;....b .-L....3Y.v..dx6..#j....hLT>......O^`...T{.k.9......vN.}z.o..i....f....R1..sv.{F.......WM@......j....e....5...a..).^.....lj.G...j.. .8......~n...)_.&.K.6wm.M.PW.Mj.-...@h.....U......Y..C.x.R.S.BsQ....C.>........<je].w....B.SS-d.X.I>Ix|.*..3..90.cx%k...X...e....].k...:3..V.......$:...H..[.9F..+D.D.]=..InE.H.....? F....z`U..2......e....^..../..~.SJ.!e.<.4....[....;.TFeGz.....Q.+$..1...=.3..=..K.c.x....mP...j{..FI.h.n..:.^./3;..}...cz.........q|.......+n..........O|.d.p.k...

                                                                                          C:\Users\user\Documents\ONBQCLYSPU\YPSIACHYXW.jpg.bLny (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.864207157437309
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:ECqmfth76jVIv4kojEESOmwjonjhLbNv8Omco4Vj8R/jvJ2HWLyYsahNT:F76mwxQmmphlAiGjvQ2L9
                                                                                          MD5:D24BEF736EE5DE470945DCABE0C1E2E2
                                                                                          SHA1:C0C2C038F1A7E46F2F50C203B42ECCF7BF2DE1D9
                                                                                          SHA-256:989E6760284DB41E27EE8B51FB3FB49AB6BF536D2B5DB7920FC4972736CAA26D
                                                                                          SHA-512:4C7063B8303704A4AE2221C5D8B7A8B71B3117226BD8A71C2E9C3D663B326F1FF0884D8DC6CC02C2DBB9EF9C15F9A93768719D1001B3821601BFF80A519307BE
                                                                                          Malicious:false
                                                                                          Preview:Q\..S..z.%.Tn...7.ea.k'.6...<qh...._.3.'>|b&...L$......9.....q...r..R...mE....B.u....KYX2...>.Sx..B...v? ...1.-.[;.Q*0..........v.4*<#\...w.P.x.5U(...:...#A~.pN"...nO..x+..=.^b..h`.Y.4....\^...=.....r.Q}.ox....+....3.%.....i...4s(.w.w.....;.^..M.j2l.=.I.* )......$....\.r........Q..VA..?...a.X../...m".AAb:.2.^u.^...S...H...;..KNLE.m..q....m3'Ho...].....2_.........@.-;.9.Q..|..?.s.?..].w....$tc<.....[$e..............6.Ja.l..(.A......x.m.i...2.PI.1Np..<.t.q!;....b .-L....3Y.v..dx6..#j....hLT>......O^`...T{.k.9......vN.}z.o..i....f....R1..sv.{F.......WM@......j....e....5...a..).^.....lj.G...j.. .8......~n...)_.&.K.6wm.M.PW.Mj.-...@h.....U......Y..C.x.R.S.BsQ....C.>........<je].w....B.SS-d.X.I>Ix|.*..3..90.cx%k...X...e....].k...:3..V.......$:...H..[.9F..+D.D.]=..InE.H.....? F....z`U..2......e....^..../..~.SJ.!e.<.4....[....;.TFeGz.....Q.+$..1...=.3..=..K.c.x....mP...j{..FI.h.n..:.^./3;..}...cz.........q|.......+n..........O|.d.p.k...

                                                                                          C:\Users\user\Documents\ONBQCLYSPU\ZBEDCJPBEY.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8366897393821615
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:WQEGqPFSZgHHJeDQGntBao83G78xJCRxZh4VNncY2DjLu:W1pugH+QWGHaReHJqLu
                                                                                          MD5:09DA49F3879B7947F993CB13E76B07C0
                                                                                          SHA1:0DEB631FB193610AD5691E556865F347CF8008A0
                                                                                          SHA-256:30CC8C57CA376FAEA32678B34F4912B8649585AE28E053C8E0DEDA7D28F49631
                                                                                          SHA-512:6B181D79FD4DBACE005D4F514F4BBDE36774CCD7324394B35AF97DF9AB1F1C67DD7570A1AD48227E4784BD3483E1F87FD0C545F54437B8E5476DA19CC102512B
                                                                                          Malicious:false
                                                                                          Preview:..*..},...d...B...X.K..I..p.#..y../.].[.. .o{4uS..:2..b..k...UZ..\.....4;.u9....9.Y..}n-u..F...:.... ....,..fn#..&(.k.Yf./....D............@}.vc...t.P..&2.hFJ...P..s.uoE{.....K.}8..@.-..+..#..F..P...m.[...8d5...? %....d.%e(.......<.*...b6{..._.RX/...F.....m...H_.d.iK.-.\b@-...9...zHo.hz.....X...u-..s!2.]`..Hu.....[..5.a.n..'...7Jx...22...U.^..........i&(.9.[Q.....e.i...(..F.IQ....&..,..0.eD.T....u.P.f/I......Q)....:........Y..)!.L......ldK..JA.Z6.s..B.I.Y..qr.JG...GOp..{.\x.^....{...I}n.s..{.{V. .~.O'.V...U..8.......uX..U......B.......l.x..6.L.^.xo....a.tI(@..._.]...O..J.rbN.e1E.^W}.....,qq~.J...P..........(....B.~...t.".'..xr[].Yy.&..k..I....l..:..^..'.48.............z..b...x5...2c.!=@.W.".....`6.3.,oa..`..v............Q$.L..6..^..XZCS..S.v..,...&wV...E... .a.>5^.X;.a.?g6......,.F..'b..%.H...rp_.2.....R}...i.a....]1>...=...d.t...+..U".N..r...[.............xn.......@..H-..?J%A....m.(.It9...Ek...G...p%.........*..}....l)..:.5Q...mt....

                                                                                          C:\Users\user\Documents\ONBQCLYSPU\ZBEDCJPBEY.png.GgFv (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8366897393821615
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:WQEGqPFSZgHHJeDQGntBao83G78xJCRxZh4VNncY2DjLu:W1pugH+QWGHaReHJqLu
                                                                                          MD5:09DA49F3879B7947F993CB13E76B07C0
                                                                                          SHA1:0DEB631FB193610AD5691E556865F347CF8008A0
                                                                                          SHA-256:30CC8C57CA376FAEA32678B34F4912B8649585AE28E053C8E0DEDA7D28F49631
                                                                                          SHA-512:6B181D79FD4DBACE005D4F514F4BBDE36774CCD7324394B35AF97DF9AB1F1C67DD7570A1AD48227E4784BD3483E1F87FD0C545F54437B8E5476DA19CC102512B
                                                                                          Malicious:false
                                                                                          Preview:..*..},...d...B...X.K..I..p.#..y../.].[.. .o{4uS..:2..b..k...UZ..\.....4;.u9....9.Y..}n-u..F...:.... ....,..fn#..&(.k.Yf./....D............@}.vc...t.P..&2.hFJ...P..s.uoE{.....K.}8..@.-..+..#..F..P...m.[...8d5...? %....d.%e(.......<.*...b6{..._.RX/...F.....m...H_.d.iK.-.\b@-...9...zHo.hz.....X...u-..s!2.]`..Hu.....[..5.a.n..'...7Jx...22...U.^..........i&(.9.[Q.....e.i...(..F.IQ....&..,..0.eD.T....u.P.f/I......Q)....:........Y..)!.L......ldK..JA.Z6.s..B.I.Y..qr.JG...GOp..{.\x.^....{...I}n.s..{.{V. .~.O'.V...U..8.......uX..U......B.......l.x..6.L.^.xo....a.tI(@..._.]...O..J.rbN.e1E.^W}.....,qq~.J...P..........(....B.~...t.".'..xr[].Yy.&..k..I....l..:..^..'.48.............z..b...x5...2c.!=@.W.".....`6.3.,oa..`..v............Q$.L..6..^..XZCS..S.v..,...&wV...E... .a.>5^.X;.a.?g6......,.F..'b..%.H...rp_.2.....R}...i.a....]1>...=...d.t...+..U".N..r...[.............xn.......@..H-..?J%A....m.(.It9...Ek...G...p%.........*..}....l)..:.5Q...mt....

                                                                                          C:\Users\user\Documents\RAYHIWGKDI.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.864418292749079
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:pT1nT80J8gyih9i2QPCYclBQdBkdRsX4RhY2TEeMeUPWisflEiyIyTR0M+7:pTh8sE2WhidRTYAMeUOiyMhTR0N
                                                                                          MD5:01BD115BD02BB1B8DB8AD3CB0999E719
                                                                                          SHA1:333226F9DE7CC7953498A54A00FC0B813CC48399
                                                                                          SHA-256:289C4B8422828FFBDC631E13DE774FD7D138AA773C7EC846AB6134A6F974A15D
                                                                                          SHA-512:04F5590ECC1649555C15E19E3D0682769F60E8F2F8E8ED197A1BF19C377DB91569F7685D32E264767827D7267756E852D0E5E3F4DE7167B5ED60D021B91E093B
                                                                                          Malicious:false
                                                                                          Preview:... .e.....]!.j/.H0.].'.bF.(.E..9.X..r.;.qz.Ml.....@..6.$...A.9Q0...1Q.W.Yr...v.!....=.AT.!.b..f.P..|..|./.cS."~..4z.f.d.$80.I^...P6`Vn<EG="j.!>.....9t..u.3'..mv.5.......j...\$...C.@Q##9h.O.......od.z......SF|.......xt<..F..XH].......$....\:.....0o....r(........w..4.......:.r.X.3x.fr....h$t...n.j.QZ<K......K..B.'...|V.\..[.)g......c.p.Q....lH.+/..C.P.m.......n.:.s....W8q .&RR5..o..J......>.../I..e[.r..D..3.....s.'...9....&.....G8k%9\..7P.w...m.|..x.......k..Q>..E.4...Q....6Q.{....'.T.......x...j6./.R.|..M..YM. .B\.}.s^.....c..\....a....%A&...F}......g<c......1..5... ....H.........On....N.=.q...3(g..gq.-..!$....!-..;....T...I.>..S....}.*.......v....X..USP....jg...t...di..a.. ........eb......"..K.M.5.k.43........(1......5.4v.tZ.sD..E..T..F.....:.;..,..r........h....6...].=3"h.E4..hR\..s.....][...Ba...t2c.%y7......#yOS.{c..+..c...@>.<H\...V'?......c..QY...rN{.G.m..`,..2m..If.R..x..Z.~|.....o.....k.T.'w.........~........Gs.L....Y.!N.mp<1Kn.>...

                                                                                          C:\Users\user\Documents\RAYHIWGKDI.mp3.KHju (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.864418292749079
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:pT1nT80J8gyih9i2QPCYclBQdBkdRsX4RhY2TEeMeUPWisflEiyIyTR0M+7:pTh8sE2WhidRTYAMeUOiyMhTR0N
                                                                                          MD5:01BD115BD02BB1B8DB8AD3CB0999E719
                                                                                          SHA1:333226F9DE7CC7953498A54A00FC0B813CC48399
                                                                                          SHA-256:289C4B8422828FFBDC631E13DE774FD7D138AA773C7EC846AB6134A6F974A15D
                                                                                          SHA-512:04F5590ECC1649555C15E19E3D0682769F60E8F2F8E8ED197A1BF19C377DB91569F7685D32E264767827D7267756E852D0E5E3F4DE7167B5ED60D021B91E093B
                                                                                          Malicious:false
                                                                                          Preview:... .e.....]!.j/.H0.].'.bF.(.E..9.X..r.;.qz.Ml.....@..6.$...A.9Q0...1Q.W.Yr...v.!....=.AT.!.b..f.P..|..|./.cS."~..4z.f.d.$80.I^...P6`Vn<EG="j.!>.....9t..u.3'..mv.5.......j...\$...C.@Q##9h.O.......od.z......SF|.......xt<..F..XH].......$....\:.....0o....r(........w..4.......:.r.X.3x.fr....h$t...n.j.QZ<K......K..B.'...|V.\..[.)g......c.p.Q....lH.+/..C.P.m.......n.:.s....W8q .&RR5..o..J......>.../I..e[.r..D..3.....s.'...9....&.....G8k%9\..7P.w...m.|..x.......k..Q>..E.4...Q....6Q.{....'.T.......x...j6./.R.|..M..YM. .B\.}.s^.....c..\....a....%A&...F}......g<c......1..5... ....H.........On....N.=.q...3(g..gq.-..!$....!-..;....T...I.>..S....}.*.......v....X..USP....jg...t...di..a.. ........eb......"..K.M.5.k.43........(1......5.4v.tZ.sD..E..T..F.....:.;..,..r........h....6...].=3"h.E4..hR\..s.....][...Ba...t2c.%y7......#yOS.{c..+..c...@>.<H\...V'?......c..QY...rN{.G.m..`,..2m..If.R..x..Z.~|.....o.....k.T.'w.........~........Gs.L....Y.!N.mp<1Kn.>...

                                                                                          C:\Users\user\Documents\SQRKHNBNYN\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Documents\UMMBDNEQBN.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8325394418412975
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:9Tso/XrAFUI8YW2j6AbHuCGTb3NyhtXwFKTzjIvawxLBz19r/0jUzSEOrasRb:9YoIlE2j6eOCGTbctXSGGPHDmvOsN
                                                                                          MD5:BF93580DEE488BD041EF3101A701AE58
                                                                                          SHA1:D9CE4D1EA16BF84865CF2F3C9915752644E47195
                                                                                          SHA-256:A16098EBB7CAAC34F881779AFFE10AAF0A6AD61D0B2C0B82CB8ACE7E023D8C63
                                                                                          SHA-512:F0323F883C94222AD2C8CDEE02465ADC05A074A96A3837B2C5E0EBE15DF85AE8491BA318D68381A05D43AA4B1CBC5F92B45F4ED88081A1298CCB45EA00F77337
                                                                                          Malicious:false
                                                                                          Preview:..5.&.l...M..S.@;...".bgDS.h..D=...Y!..`....8.>...fW.5..h......X...YH.l<..egE.z...(...i.....QI../ym|.1.bf1...x...`.<`.K2...=!.j.X....h.....~P....4..._....T.9.r.g~=FX..2.Q.|J.........!.......>....UE.....m...)2.^.x..P.|]..?...q5gvK.+".O..%Z].#......AU.....].y.7e.2.sqi.......i.BI.rU...55.\...1H73y.\+...&...)7..?X8..U...x~.a.......g.J,.z...pS..%.v....p.D.oC...h......N..[.k.0....r/g..R.I.Jo..x.I...c.._T../v.9..tZ.s.....*.1....\Qh.i?.8A..@si.....<..3..WR.HP..&.F.Z.a.Z..l^..+.U?.....D.....iG.............c1M.....!.Qm.*.cN!.X7..G.....w?.z3&....k.r,.d^.........?#,..5=.1...0.-LD...T.X2w.M..o.B...3..a....S$T.+.H;).T.,..I_K..|.Y.4E.....n6.>....t...SL..nB^...j.P....c./..9.....^&.23.q...=E..SS!...dw.D....j..W?.XH.._..bc.<.yr.....4...W.z{.........M.].)x....t..4..}..\.$\...S.x.*..!.=..CZ.r..(..5.'....oI..!...A.4C...-:..i@.g..?..t...1$k:n-........r..7...W..Y..*..$...(..#....8....C^....B..;....Dr.>1$....[yo6.......]..h|.....\..3zm..o.BcAp..`;#..H.?

                                                                                          C:\Users\user\Documents\UMMBDNEQBN.png.CciI (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8325394418412975
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:9Tso/XrAFUI8YW2j6AbHuCGTb3NyhtXwFKTzjIvawxLBz19r/0jUzSEOrasRb:9YoIlE2j6eOCGTbctXSGGPHDmvOsN
                                                                                          MD5:BF93580DEE488BD041EF3101A701AE58
                                                                                          SHA1:D9CE4D1EA16BF84865CF2F3C9915752644E47195
                                                                                          SHA-256:A16098EBB7CAAC34F881779AFFE10AAF0A6AD61D0B2C0B82CB8ACE7E023D8C63
                                                                                          SHA-512:F0323F883C94222AD2C8CDEE02465ADC05A074A96A3837B2C5E0EBE15DF85AE8491BA318D68381A05D43AA4B1CBC5F92B45F4ED88081A1298CCB45EA00F77337
                                                                                          Malicious:false
                                                                                          Preview:..5.&.l...M..S.@;...".bgDS.h..D=...Y!..`....8.>...fW.5..h......X...YH.l<..egE.z...(...i.....QI../ym|.1.bf1...x...`.<`.K2...=!.j.X....h.....~P....4..._....T.9.r.g~=FX..2.Q.|J.........!.......>....UE.....m...)2.^.x..P.|]..?...q5gvK.+".O..%Z].#......AU.....].y.7e.2.sqi.......i.BI.rU...55.\...1H73y.\+...&...)7..?X8..U...x~.a.......g.J,.z...pS..%.v....p.D.oC...h......N..[.k.0....r/g..R.I.Jo..x.I...c.._T../v.9..tZ.s.....*.1....\Qh.i?.8A..@si.....<..3..WR.HP..&.F.Z.a.Z..l^..+.U?.....D.....iG.............c1M.....!.Qm.*.cN!.X7..G.....w?.z3&....k.r,.d^.........?#,..5=.1...0.-LD...T.X2w.M..o.B...3..a....S$T.+.H;).T.,..I_K..|.Y.4E.....n6.>....t...SL..nB^...j.P....c./..9.....^&.23.q...=E..SS!...dw.D....j..W?.XH.._..bc.<.yr.....4...W.z{.........M.].)x....t..4..}..\.$\...S.x.*..!.=..CZ.r..(..5.'....oI..!...A.4C...-:..i@.g..?..t...1$k:n-........r..7...W..Y..*..$...(..#....8....C^....B..;....Dr.>1$....[yo6.......]..h|.....\..3zm..o.BcAp..`;#..H.?

                                                                                          C:\Users\user\Documents\VLZDGUKUTZ.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.856836926721407
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:irZyVZIapCZ8Cy1gxXEcVxe4joTJr7G3t6GFp/eK1f8bAvgyRRk85S:iNoXpDCEcBbe4jqMYkeKSLEl5S
                                                                                          MD5:5A6570B98FD994AF472F419B8ADDB761
                                                                                          SHA1:A150E15A0345BB19C7F3687AC95F181F18083891
                                                                                          SHA-256:E92C78C15CE76CCC778F64AC5DEED797D7EA091C6A8A620D3D0C6ABF42C14942
                                                                                          SHA-512:F8F70E4014A952182B754C854B6F0DF132753367100CBD3182093C05E14D8F64E2D0BE4223F6650E9518878E807ED14C624D39C43639679934F4EEC35155BB95
                                                                                          Malicious:false
                                                                                          Preview:...X[.|.B.*.e.^........."K.|'f],...%...Ejp\a..+...D..J..2l;&.p..0J..|.......&n.K...".....>h...G..{....y.Y...w.l.`+.5!w..aL...;.w......H.g...H.-=.{..G\..0..o...r.Z..2....9Nk|D{..n.-.An.i.ey.6':....z.....r#..W..........B..Q....6...._.......U......o...{i.8."..a.....WH....l{~......)(C.z.-F^.1..n..z...n......U&.u.....A..........#..r.........(w...ZF.\68.Q.b.Z.$..K..-.waj..........o2..g...tE.P.s...$W.!...-.M....[-..Z.u...>....i.d:...).4./>.G...&-B.>...O3..U.,...K* 4..r.....AE..b2..a.9...4...8%w...!@"..;."r.m..&!)..n...y....G.A.}.@.J.-..P......x.k.|fi.4.L.:........O.c6C#....*.<..Xq]LESy..FU..9.....i..o.LU_.3...hE.V..&.$.u.]...;].(.Z".........".U...r.....2.&QL...P(..k...1..(...:.^....QHo. ..M.3.OZ.94..nZ..J.. ..=..{....x.......'....k.De..7\3r.>.r...~>...T...r..k\.~.G...Kpv...0}.11..J....t.z.m.y..D.vM3W....K..}.y9....V.m!Jx.L.\....O[.hX.^=......N2...I/....C.*.v...z...`.#.|;.4....W.j_[rx.A.8.X7.). .|..Y.......6.r.t.../.z.Q...S.&...l.......

                                                                                          C:\Users\user\Documents\VLZDGUKUTZ.jpg.LZbV (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.856836926721407
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:irZyVZIapCZ8Cy1gxXEcVxe4joTJr7G3t6GFp/eK1f8bAvgyRRk85S:iNoXpDCEcBbe4jqMYkeKSLEl5S
                                                                                          MD5:5A6570B98FD994AF472F419B8ADDB761
                                                                                          SHA1:A150E15A0345BB19C7F3687AC95F181F18083891
                                                                                          SHA-256:E92C78C15CE76CCC778F64AC5DEED797D7EA091C6A8A620D3D0C6ABF42C14942
                                                                                          SHA-512:F8F70E4014A952182B754C854B6F0DF132753367100CBD3182093C05E14D8F64E2D0BE4223F6650E9518878E807ED14C624D39C43639679934F4EEC35155BB95
                                                                                          Malicious:false
                                                                                          Preview:...X[.|.B.*.e.^........."K.|'f],...%...Ejp\a..+...D..J..2l;&.p..0J..|.......&n.K...".....>h...G..{....y.Y...w.l.`+.5!w..aL...;.w......H.g...H.-=.{..G\..0..o...r.Z..2....9Nk|D{..n.-.An.i.ey.6':....z.....r#..W..........B..Q....6...._.......U......o...{i.8."..a.....WH....l{~......)(C.z.-F^.1..n..z...n......U&.u.....A..........#..r.........(w...ZF.\68.Q.b.Z.$..K..-.waj..........o2..g...tE.P.s...$W.!...-.M....[-..Z.u...>....i.d:...).4./>.G...&-B.>...O3..U.,...K* 4..r.....AE..b2..a.9...4...8%w...!@"..;."r.m..&!)..n...y....G.A.}.@.J.-..P......x.k.|fi.4.L.:........O.c6C#....*.<..Xq]LESy..FU..9.....i..o.LU_.3...hE.V..&.$.u.]...;].(.Z".........".U...r.....2.&QL...P(..k...1..(...:.^....QHo. ..M.3.OZ.94..nZ..J.. ..=..{....x.......'....k.De..7\3r.>.r...~>...T...r..k\.~.G...Kpv...0}.11..J....t.z.m.y..D.vM3W....K..}.y9....V.m!Jx.L.\....O[.hX.^=......N2...I/....C.*.v...z...`.#.|;.4....W.j_[rx.A.8.X7.). .|..Y.......6.r.t.../.z.Q...S.&...l.......

                                                                                          C:\Users\user\Documents\VLZDGUKUTZ.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.848624186439609
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:a0gRK8lYmn4i9VYDgeOFX+GbEVo+l2+AeRhHm2R2vMs4BG/8/Yqq8bSx3:SRxYmn4AWDOzkoLWRE241aYOZ2
                                                                                          MD5:6ECE0F2DB8F1CD38F4C5C33F39AE332F
                                                                                          SHA1:9CCE3D321C82ABC01A6B07E6C818481E50501A19
                                                                                          SHA-256:88D45DC229425F5B8B57D1A18265F9A653D76BA5E8C347992BDDB5E0AC21825E
                                                                                          SHA-512:AF32BEF9CB774BA353DD58293A4F466656F35398214F4938534243E2BAF853BAD7D319455A9B83BD8F148FE76A225D90B75C9C82B70ECCFF97F815A7904AA988
                                                                                          Malicious:false
                                                                                          Preview:0t.i^$u./...q...L..t..... ..NO.......T.I..6N.."K6.q.r.qK.....!...U..E-.........5\..!...vc."N1......r9;.`..$u.....M..>..g./.......p..j.?.3..C...0.A...C:V..........2=.?...w.c..^.....I 6.jU1......I.1.[.!j-..wKLs(.-...)....@...y...iy.......M.... ...x.h..lq|*.n.&c...{.P....."..*....F.... ..I..U.....me....T..Jl.ECna..k...w...... .....X.*.........6....`2=.E...G!G^...D../......v..............^4C....!.5...c.})...S.+.....$;."........$.~.y.......x.GA(Iq...*..:;......(.Y...o~...G5...)VFR/.;.K..&...@#...y..|..l. U.|.e.TX.L..J........v.[.2dU>.9x8.....>5yW.o&j.9C.".:S.@a..]R.K<A......G.P....~>~.+v.3`u......)...D. ...W.Y...%.......}.,.$..iJ%.}.<.....3...Z.d....JZ.0.137x..5#f.?..<}.F.Pn...z.=.x`'f...I..t...P...A..n.e..m.\<..)~...A.6...2..I%}`... <..Ne...G.Fvc|......,.........*|.....~..P.aq....Rs.G&eg.._...i..<u.........V.>}.MY.}.JJ.Y..............MI.=.\.*`..:....f..... .............z...2........K._0%L....I(./.Z....#;Y.......D>3g!.'K..R.IQZ.(W.}.8UF..

                                                                                          C:\Users\user\Documents\VLZDGUKUTZ.xlsx.jZeT (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.848624186439609
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:a0gRK8lYmn4i9VYDgeOFX+GbEVo+l2+AeRhHm2R2vMs4BG/8/Yqq8bSx3:SRxYmn4AWDOzkoLWRE241aYOZ2
                                                                                          MD5:6ECE0F2DB8F1CD38F4C5C33F39AE332F
                                                                                          SHA1:9CCE3D321C82ABC01A6B07E6C818481E50501A19
                                                                                          SHA-256:88D45DC229425F5B8B57D1A18265F9A653D76BA5E8C347992BDDB5E0AC21825E
                                                                                          SHA-512:AF32BEF9CB774BA353DD58293A4F466656F35398214F4938534243E2BAF853BAD7D319455A9B83BD8F148FE76A225D90B75C9C82B70ECCFF97F815A7904AA988
                                                                                          Malicious:false
                                                                                          Preview:0t.i^$u./...q...L..t..... ..NO.......T.I..6N.."K6.q.r.qK.....!...U..E-.........5\..!...vc."N1......r9;.`..$u.....M..>..g./.......p..j.?.3..C...0.A...C:V..........2=.?...w.c..^.....I 6.jU1......I.1.[.!j-..wKLs(.-...)....@...y...iy.......M.... ...x.h..lq|*.n.&c...{.P....."..*....F.... ..I..U.....me....T..Jl.ECna..k...w...... .....X.*.........6....`2=.E...G!G^...D../......v..............^4C....!.5...c.})...S.+.....$;."........$.~.y.......x.GA(Iq...*..:;......(.Y...o~...G5...)VFR/.;.K..&...@#...y..|..l. U.|.e.TX.L..J........v.[.2dU>.9x8.....>5yW.o&j.9C.".:S.@a..]R.K<A......G.P....~>~.+v.3`u......)...D. ...W.Y...%.......}.,.$..iJ%.}.<.....3...Z.d....JZ.0.137x..5#f.?..<}.F.Pn...z.=.x`'f...I..t...P...A..n.e..m.\<..)~...A.6...2..I%}`... <..Ne...G.Fvc|......,.........*|.....~..P.aq....Rs.G&eg.._...i..<u.........V.>}.MY.}.JJ.Y..............MI.=.\.*`..:....f..... .............z...2........K._0%L....I(./.Z....#;Y.......D>3g!.'K..R.IQZ.(W.}.8UF..

                                                                                          C:\Users\user\Documents\WKXEWIOTXI\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Documents\XZXHAVGRAG.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8647237886992345
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:ShVOqiHTMbQGiXAG+C8C97i7dXTliEaDrINKc0P5ROkPe7mI7q5t6PZ:WVO3HYKXDzw7dD4zDrINKXCp64Z
                                                                                          MD5:AB0E0AF327449CC3930F35B9433DF114
                                                                                          SHA1:5DC3BC1CB2083B9F8C09682243C9A9DFE55E861D
                                                                                          SHA-256:83BCDA6CE5B2E0F037212E0C7F2079F3D11B9B5CBE990111028B66627D9DC440
                                                                                          SHA-512:C320D2919F3E18544CFCF34CE017D1532C980F39D521A3CCA4FE0DDD64682A8B852F19F1B6FE0E2F9B7D952692798CD62ED1DE9A4B09C1F54CD1D2712BEBE4F2
                                                                                          Malicious:false
                                                                                          Preview:B..^>....{r.>..@...$.;..dO..W.*.!]!y..L.!._!.EF..3.{.ReW_k.s{#Z.....(...p.>.N5.)..6..........O.R....a..G.M.2.}0..3..O./[..:.;PL.....~.`-0...6oz.*X;4.]...`+.#.u`.ff3^.|W.\....[....,q.....bP...Kc..I..~;K.E:)8..3...p..A..k.4K*k....x1.\.xA.....[*.1L&.K.7......B.Pz..'.....a..6......9..>..m.J.o....m7.....a.9..N../.G...%..g4...IWU..iF.2.s...lB.g.%Zp./.r.:..8Dh...!T."..*...V......Z..(+iv%*<../.....g.v2.R...%<!....sW..|.H$.......X.bP ?.e.......QL7f...{..."....v.......o.=..m.=....-.6..k@ .l..!"..&.FgC.*Kp......|..>E?.i..7h.Q.k..=..k........}.y#..M..2S..yI-..9 .wA.;.7...1.. .c<..^....Ir4.D..ha.6./vJ|H.....!A..E.k....<..^v7.H.VK.k.W6....D......P......~.AS.uH..P.........a...............-.n..M.H.N.;.....T....o...44.9.e.1..P...=R..c.....hM..c..*g..+US.}!f....,...k.....X...........Ph..." ..=.:.z.G.....*[.^...X5.CK.]....W..3........6W..>..:.U.rk$........!..Rw..^Y.D...R f'R$..??.C..c.jNF.(q.zTH....j.!/..m9s_./s."*.&.........`....`0..._.....;.c...j/.P.r..'.@&T..*...b[

                                                                                          C:\Users\user\Documents\XZXHAVGRAG.docx.NVjb (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8647237886992345
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:ShVOqiHTMbQGiXAG+C8C97i7dXTliEaDrINKc0P5ROkPe7mI7q5t6PZ:WVO3HYKXDzw7dD4zDrINKXCp64Z
                                                                                          MD5:AB0E0AF327449CC3930F35B9433DF114
                                                                                          SHA1:5DC3BC1CB2083B9F8C09682243C9A9DFE55E861D
                                                                                          SHA-256:83BCDA6CE5B2E0F037212E0C7F2079F3D11B9B5CBE990111028B66627D9DC440
                                                                                          SHA-512:C320D2919F3E18544CFCF34CE017D1532C980F39D521A3CCA4FE0DDD64682A8B852F19F1B6FE0E2F9B7D952692798CD62ED1DE9A4B09C1F54CD1D2712BEBE4F2
                                                                                          Malicious:false
                                                                                          Preview:B..^>....{r.>..@...$.;..dO..W.*.!]!y..L.!._!.EF..3.{.ReW_k.s{#Z.....(...p.>.N5.)..6..........O.R....a..G.M.2.}0..3..O./[..:.;PL.....~.`-0...6oz.*X;4.]...`+.#.u`.ff3^.|W.\....[....,q.....bP...Kc..I..~;K.E:)8..3...p..A..k.4K*k....x1.\.xA.....[*.1L&.K.7......B.Pz..'.....a..6......9..>..m.J.o....m7.....a.9..N../.G...%..g4...IWU..iF.2.s...lB.g.%Zp./.r.:..8Dh...!T."..*...V......Z..(+iv%*<../.....g.v2.R...%<!....sW..|.H$.......X.bP ?.e.......QL7f...{..."....v.......o.=..m.=....-.6..k@ .l..!"..&.FgC.*Kp......|..>E?.i..7h.Q.k..=..k........}.y#..M..2S..yI-..9 .wA.;.7...1.. .c<..^....Ir4.D..ha.6./vJ|H.....!A..E.k....<..^v7.H.VK.k.W6....D......P......~.AS.uH..P.........a...............-.n..M.H.N.;.....T....o...44.9.e.1..P...=R..c.....hM..c..*g..+US.}!f....,...k.....X...........Ph..." ..=.:.z.G.....*[.^...X5.CK.]....W..3........6W..>..:.U.rk$........!..Rw..^Y.D...R f'R$..??.C..c.jNF.(q.zTH....j.!/..m9s_./s."*.&.........`....`0..._.....;.c...j/.P.r..'.@&T..*...b[

                                                                                          C:\Users\user\Documents\XZXHAVGRAG.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.849636272804735
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:5lMTBOqgX8leYyE9/ooetaui4WGwTwdJVzohvhLXKiXbG0Ai3iBbZ6wA34:5lMTQqgMwgGoete4WGJJVshvhL6iXPA3
                                                                                          MD5:A11BDAB30B20D1E2A4E6BF3A1BF0E915
                                                                                          SHA1:F46DCF222130339881D83A3495E733FC213CEDDF
                                                                                          SHA-256:074380A1C5865152DD0C1896916850E9EB976CE8DC2F395496063A87A10CA11F
                                                                                          SHA-512:60CFF48AD416EF48521133361053A91B7D1EAAB6B8C4923C813AA04EA511A720ABC60066025F6E03751ECF1AFB314262A7892D0ACDB29EAAFEFC54F2B695904B
                                                                                          Malicious:false
                                                                                          Preview:.Lg..Y..|.E...........)`.Xk.A&.gC........06.....D..%.........h..^E._...fz{+osRb...g.qO.)...b.G...L|~....h?Z............r..'.w.,.X.z..HL.at._..}..4.DF.^......n.D.D. .;.......vlY...Z..e.h..8(..@|.3W.Im.s...W..<.[..B.8......#?........d$H.v....P..D.GU...9..|!B.x)../=..E?.~.Z.......IK..q`.2..6.....+...E-F..;..!.<...~...(.[.x.....oc..3. l...G.....U...._.N.,..].~_....x...H{....v.........%}r<..[.M......@...U..EK..j....v[.[../}+.#]....R...~..$....:....w._.R..B#7..W..<.N4....!hB.......S.. ..4#.56.,..,b.M0..#7.[b...!ILRE.YD...!..%.q.........Aw...Ru.........e=...~....<.e......:6...t.a....f.'$.A.z;.}&s1....2....W^...Z.PK...0-W...wO.~5.-.D..P#......t..2v......[...e.....b..m.M.....Au...m.1.p:.,.~.G.......V(....5...I....-.\Bi....yW.......].G......j..tw).m+)...fT.X.7..:...@..1..'..C..$3.Q.....9./@.9..d].......x.{.N..@..'W...IL.F..A.<...}...=..s8{A.........q.=h..#....o.ny..&.).....6.P.P....5.wF>U..s....".....Z,......s..S.....&...L.G..{b2r<w54>.J.C`5.......h.

                                                                                          C:\Users\user\Documents\XZXHAVGRAG.xlsx.wWbY (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.849636272804735
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:5lMTBOqgX8leYyE9/ooetaui4WGwTwdJVzohvhLXKiXbG0Ai3iBbZ6wA34:5lMTQqgMwgGoete4WGJJVshvhL6iXPA3
                                                                                          MD5:A11BDAB30B20D1E2A4E6BF3A1BF0E915
                                                                                          SHA1:F46DCF222130339881D83A3495E733FC213CEDDF
                                                                                          SHA-256:074380A1C5865152DD0C1896916850E9EB976CE8DC2F395496063A87A10CA11F
                                                                                          SHA-512:60CFF48AD416EF48521133361053A91B7D1EAAB6B8C4923C813AA04EA511A720ABC60066025F6E03751ECF1AFB314262A7892D0ACDB29EAAFEFC54F2B695904B
                                                                                          Malicious:false
                                                                                          Preview:.Lg..Y..|.E...........)`.Xk.A&.gC........06.....D..%.........h..^E._...fz{+osRb...g.qO.)...b.G...L|~....h?Z............r..'.w.,.X.z..HL.at._..}..4.DF.^......n.D.D. .;.......vlY...Z..e.h..8(..@|.3W.Im.s...W..<.[..B.8......#?........d$H.v....P..D.GU...9..|!B.x)../=..E?.~.Z.......IK..q`.2..6.....+...E-F..;..!.<...~...(.[.x.....oc..3. l...G.....U...._.N.,..].~_....x...H{....v.........%}r<..[.M......@...U..EK..j....v[.[../}+.#]....R...~..$....:....w._.R..B#7..W..<.N4....!hB.......S.. ..4#.56.,..,b.M0..#7.[b...!ILRE.YD...!..%.q.........Aw...Ru.........e=...~....<.e......:6...t.a....f.'$.A.z;.}&s1....2....W^...Z.PK...0-W...wO.~5.-.D..P#......t..2v......[...e.....b..m.M.....Au...m.1.p:.,.~.G.......V(....5...I....-.\Bi....yW.......].G......j..tw).m+)...fT.X.7..:...@..1..'..C..$3.Q.....9./@.9..d].......x.{.N..@..'W...IL.F..A.<...}...=..s8{A.........q.=h..#....o.ny..&.).....6.P.P....5.wF>U..s....".....Z,......s..S.....&...L.G..{b2r<w54>.J.C`5.......h.

                                                                                          C:\Users\user\Documents\XZXHAVGRAG\DVWHKMNFNN.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.856744440397362
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:We7zqhJ4HM7X35kKy1fHBBxNwPhw3rTEDt7Se1H+Raw:nQ7X35IbxR0Dtc
                                                                                          MD5:5D9AB0E17A73643D2E84237168F0D76D
                                                                                          SHA1:666BD44C5C0C638CE607E56E790BB20130F14E5E
                                                                                          SHA-256:C111183F6D2488D9B6349848A19A84A03DDA8422D0DFD55F6ED855F352BCDCAB
                                                                                          SHA-512:751204A0BD6D9192BC41EF6488F23668067B1ABEF7C24346F348FEE25E7582DEB00E271C6D00660EC7851D210230527400CA3CE5161C2F29545074651049BABB
                                                                                          Malicious:false
                                                                                          Preview:.T...|..:....+Z>....n....c.D.bi.ZM.....F....{......K3..x.O....Q...l...Y^.W<t..<..1l.\. jH..9.\.....5U..y..X.P.3~m......N.C|.e........5....7.`?`'.\....2.m.L.!.0..{#. +j..)=...d..g"...>.QckO.~..:o....)G~....h.b.k}.....:@...........DR..~.7...sC..c^.^.t...,S...H..[....n...<.2e..d.~........W.,.N..u...NN....Rb.C.!v.wX..T-`..'.*M..R......Z...`H...%m.t4..A.yI..?....M....%....o.C.....6..zA..X....A`?(..\1....y@.J....a......EtuB.B..xR.......X.,Bq.Lf.kC.4k..{.......j0..5.I....pM."....g..L.(H.u........Xy._.G.f.xu.2.K.....b..............n<..BF.Gj{1t8..-..OH*6*..t4.....b.m~Q.=............K..H~! ...T..?P..X.U...K....t+...=g.xl.S......gFG..C.......^(.$4....J.%._B...:P.k......N0KW.\....\.4..e...\.H.^?. m..@........... 9.....0......|..A .O.p...X...H5..z.........?.!..L.....1* e.v(.2'Rs=.%9.*Ct..o_..k..y...../...o<.k#.Yp...>.@..m 74.Z)....O..q..6.q"]\.LM........]...~.{....'.jw.T..`..m.rzMa."..>~S...I/Hq!..#.qk....D..f.;Hz..._hy|.......T).)...l.*....8...I..^%..

                                                                                          C:\Users\user\Documents\XZXHAVGRAG\DVWHKMNFNN.jpg.eKiE (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.856744440397362
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:We7zqhJ4HM7X35kKy1fHBBxNwPhw3rTEDt7Se1H+Raw:nQ7X35IbxR0Dtc
                                                                                          MD5:5D9AB0E17A73643D2E84237168F0D76D
                                                                                          SHA1:666BD44C5C0C638CE607E56E790BB20130F14E5E
                                                                                          SHA-256:C111183F6D2488D9B6349848A19A84A03DDA8422D0DFD55F6ED855F352BCDCAB
                                                                                          SHA-512:751204A0BD6D9192BC41EF6488F23668067B1ABEF7C24346F348FEE25E7582DEB00E271C6D00660EC7851D210230527400CA3CE5161C2F29545074651049BABB
                                                                                          Malicious:false
                                                                                          Preview:.T...|..:....+Z>....n....c.D.bi.ZM.....F....{......K3..x.O....Q...l...Y^.W<t..<..1l.\. jH..9.\.....5U..y..X.P.3~m......N.C|.e........5....7.`?`'.\....2.m.L.!.0..{#. +j..)=...d..g"...>.QckO.~..:o....)G~....h.b.k}.....:@...........DR..~.7...sC..c^.^.t...,S...H..[....n...<.2e..d.~........W.,.N..u...NN....Rb.C.!v.wX..T-`..'.*M..R......Z...`H...%m.t4..A.yI..?....M....%....o.C.....6..zA..X....A`?(..\1....y@.J....a......EtuB.B..xR.......X.,Bq.Lf.kC.4k..{.......j0..5.I....pM."....g..L.(H.u........Xy._.G.f.xu.2.K.....b..............n<..BF.Gj{1t8..-..OH*6*..t4.....b.m~Q.=............K..H~! ...T..?P..X.U...K....t+...=g.xl.S......gFG..C.......^(.$4....J.%._B...:P.k......N0KW.\....\.4..e...\.H.^?. m..@........... 9.....0......|..A .O.p...X...H5..z.........?.!..L.....1* e.v(.2'Rs=.%9.*Ct..o_..k..y...../...o<.k#.Yp...>.@..m 74.Z)....O..q..6.q"]\.LM........]...~.{....'.jw.T..`..m.rzMa."..>~S...I/Hq!..#.qk....D..f.;Hz..._hy|.......T).)...l.*....8...I..^%..

                                                                                          C:\Users\user\Documents\XZXHAVGRAG\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Documents\XZXHAVGRAG\KATAXZVCPS.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.852177655367201
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:qAxo75ukvlHWE6SnqB/r/afc5+BiMmXLrhSSLkTzRa31i20hYmhcR:5ouC16h/Laf3s4zR4shYmOR
                                                                                          MD5:D649E4D8EA7653A7FFA6FB10251254D1
                                                                                          SHA1:D61934E8215419CB84EEC108A904628C43A2E18D
                                                                                          SHA-256:F6B9B3570B760DA2E67E96710650DF1A32ED7848576335420B7FB80909C4B3CC
                                                                                          SHA-512:6796B3C9AC13F7A0CFA9E63A86D985EC4DE1F4A06762CF3FAAFD16C6FF86893FB34912DD30B912E4F6E6AFBE988B943912C6A7DC331A8694815EFE9CF9BBCE65
                                                                                          Malicious:false
                                                                                          Preview:{....L.>.......}..8...S....!.GJ.*...E.....]@i.P..7.. ..$.f.H...H.=..."S..+FX...C..;!~5...+.......z_,.E.-N.&^.....]..#......e...o.^.vrY2.W.Vas.......@.....2...M..,.\.....v..F.M.]\.II.dR...j..3.J...7...,....c..=u._.r&....i..Wy3bn.zQM..Y.j.H....o..e.zjX.E].r.&. .WUf.....b@iV.......*.23..Z.h...t....B.......@.)M.6|)j}Y.z.@....8B9.:..........d.....<.t7t.X.._.`hBjf9E2.......f.......9.}-....F../G..c...&...;=;b....jn..P..]..!`..z+.....<C)..]......]..m..6.HS.#.M..s?.../o.7.t..]..!s&.`Yj....f..sM..=...;...8.....Hq.\T.d;...m.5P...l..Ww..\.W_.+..JY..-...r.....[.....4.p...%...Bk..."u$v.....r.Q.$.my.`R5......g6]C .....S..>H.h.[t..L.....S...o7.[Iy....L+.Y.r....."..U.6v...Jc{v]..z.BV...M....7L....xB...dgFW.....<`.g.k. y1...z....|.l.......[h.m....#9F..L..k...a3.f.]. +'~...q........bR....Lt.S..".N.H.... .`@...b..../..QN.....S...K.>o2t.H..8n......9....(..*$.....u...Rh&*..h....S.......R3.}..w...|[..=J.vv.+GK./Zt..V. f.....{?...f..O..p9..R.Rp....t.Wq[.L...

                                                                                          C:\Users\user\Documents\XZXHAVGRAG\KATAXZVCPS.pdf.wfPg (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.852177655367201
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:qAxo75ukvlHWE6SnqB/r/afc5+BiMmXLrhSSLkTzRa31i20hYmhcR:5ouC16h/Laf3s4zR4shYmOR
                                                                                          MD5:D649E4D8EA7653A7FFA6FB10251254D1
                                                                                          SHA1:D61934E8215419CB84EEC108A904628C43A2E18D
                                                                                          SHA-256:F6B9B3570B760DA2E67E96710650DF1A32ED7848576335420B7FB80909C4B3CC
                                                                                          SHA-512:6796B3C9AC13F7A0CFA9E63A86D985EC4DE1F4A06762CF3FAAFD16C6FF86893FB34912DD30B912E4F6E6AFBE988B943912C6A7DC331A8694815EFE9CF9BBCE65
                                                                                          Malicious:false
                                                                                          Preview:{....L.>.......}..8...S....!.GJ.*...E.....]@i.P..7.. ..$.f.H...H.=..."S..+FX...C..;!~5...+.......z_,.E.-N.&^.....]..#......e...o.^.vrY2.W.Vas.......@.....2...M..,.\.....v..F.M.]\.II.dR...j..3.J...7...,....c..=u._.r&....i..Wy3bn.zQM..Y.j.H....o..e.zjX.E].r.&. .WUf.....b@iV.......*.23..Z.h...t....B.......@.)M.6|)j}Y.z.@....8B9.:..........d.....<.t7t.X.._.`hBjf9E2.......f.......9.}-....F../G..c...&...;=;b....jn..P..]..!`..z+.....<C)..]......]..m..6.HS.#.M..s?.../o.7.t..]..!s&.`Yj....f..sM..=...;...8.....Hq.\T.d;...m.5P...l..Ww..\.W_.+..JY..-...r.....[.....4.p...%...Bk..."u$v.....r.Q.$.my.`R5......g6]C .....S..>H.h.[t..L.....S...o7.[Iy....L+.Y.r....."..U.6v...Jc{v]..z.BV...M....7L....xB...dgFW.....<`.g.k. y1...z....|.l.......[h.m....#9F..L..k...a3.f.]. +'~...q........bR....Lt.S..".N.H.... .`@...b..../..QN.....S...K.>o2t.H..8n......9....(..*$.....u...Rh&*..h....S.......R3.}..w...|[..=J.vv.+GK./Zt..V. f.....{?...f..O..p9..R.Rp....t.Wq[.L...

                                                                                          C:\Users\user\Documents\XZXHAVGRAG\NWTVCDUMOB.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.840030709595046
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Mo+jXIuUN4qz/irbkzcrJo4B/GjI0pNrwmWxTwWbUMSd7oZN7nHee:Z+TIuy6fkzai4h10p+rPbUMSd7oZZV
                                                                                          MD5:C2021E3DB989A1E9AA8942688808ACC8
                                                                                          SHA1:AF8B659891A9395746B169D65FF206B99FAEF457
                                                                                          SHA-256:F4A43C7C25FE22F71F44644B8FCC6656D837B90C6FE13DAEA4E0ED2BC3F00838
                                                                                          SHA-512:83E87F83F1780543AEF8958A3D40DE884DF76FEA00E87699EB5900285B2A290F55E21584926E971F247EC30F56036A213F705DEAA4BAE28935CF7045141199DA
                                                                                          Malicious:false
                                                                                          Preview:#/........F....Y."|j#.F\.O,...,....C~..p.......R..k*[.i= ......n.E.eab!..D......E3.F.IH...a.W.8.vw.R....k..&ZK..sz..,R.~.-...xD.zs._=}.+.G?,...I.r.x...-F...o..%..G...l.]*U...CQ.U..k.g|<.....z......%...K..G.;D}..R..*H.'....../......8>...lDi.t..........h.-..............P4...;..--)P..+.=......Gv......'.L3...q)+K..}..4.iE..y[0..C$T..).....P\Vr.q..4.SV.8......~..R......'...)..U.].,i....X.UTQE.{...0%. .{W.D...['.#...'.<o......q.k.^[..&./.y..7.....PQ>.IQdP{.8.9.S.Bv.y..1.-}..,..-#..=:]n}.N.VA..P...#..+#.X...6.G. .o..~..A...|.Z...4.....K.L...a..~.....O#.,..V......^Bz.$Z.I...Q$...!d4.0.<.N.8k..........t...WH.y>E.R..a)fKd...%^m..P%...s..&..<.D..[Z5...]....4.......+P7N.z3..b.3......Y...$...h_.E....Nl..d2cK......sX5~E^1..]...L.'..y...a...|.7..Ru;.h....m....h..!.iF....u...H..Y..q.v...t..|y*......7..........v...z.W....UBe.p.*..b.if3g..Xa<..K....gO....8......vk......z=B-{..V.y..b..0....'....J.v..}....../.q.},.J..=w......1.1...z.

                                                                                          C:\Users\user\Documents\XZXHAVGRAG\NWTVCDUMOB.png.XSfD (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.840030709595046
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Mo+jXIuUN4qz/irbkzcrJo4B/GjI0pNrwmWxTwWbUMSd7oZN7nHee:Z+TIuy6fkzai4h10p+rPbUMSd7oZZV
                                                                                          MD5:C2021E3DB989A1E9AA8942688808ACC8
                                                                                          SHA1:AF8B659891A9395746B169D65FF206B99FAEF457
                                                                                          SHA-256:F4A43C7C25FE22F71F44644B8FCC6656D837B90C6FE13DAEA4E0ED2BC3F00838
                                                                                          SHA-512:83E87F83F1780543AEF8958A3D40DE884DF76FEA00E87699EB5900285B2A290F55E21584926E971F247EC30F56036A213F705DEAA4BAE28935CF7045141199DA
                                                                                          Malicious:false
                                                                                          Preview:#/........F....Y."|j#.F\.O,...,....C~..p.......R..k*[.i= ......n.E.eab!..D......E3.F.IH...a.W.8.vw.R....k..&ZK..sz..,R.~.-...xD.zs._=}.+.G?,...I.r.x...-F...o..%..G...l.]*U...CQ.U..k.g|<.....z......%...K..G.;D}..R..*H.'....../......8>...lDi.t..........h.-..............P4...;..--)P..+.=......Gv......'.L3...q)+K..}..4.iE..y[0..C$T..).....P\Vr.q..4.SV.8......~..R......'...)..U.].,i....X.UTQE.{...0%. .{W.D...['.#...'.<o......q.k.^[..&./.y..7.....PQ>.IQdP{.8.9.S.Bv.y..1.-}..,..-#..=:]n}.N.VA..P...#..+#.X...6.G. .o..~..A...|.Z...4.....K.L...a..~.....O#.,..V......^Bz.$Z.I...Q$...!d4.0.<.N.8k..........t...WH.y>E.R..a)fKd...%^m..P%...s..&..<.D..[Z5...]....4.......+P7N.z3..b.3......Y...$...h_.E....Nl..d2cK......sX5~E^1..]...L.'..y...a...|.7..Ru;.h....m....h..!.iF....u...H..Y..q.v...t..|y*......7..........v...z.W....UBe.p.*..b.if3g..Xa<..K....gO....8......vk......z=B-{..V.y..b..0....'....J.v..}....../.q.},.J..=w......1.1...z.

                                                                                          C:\Users\user\Documents\XZXHAVGRAG\VLZDGUKUTZ.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.833380421768295
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Ruq+7/N5+5agiSmfE4NAG+464ZtlNeZEqs85YHAxbMKn20+qM:Ruq+7/vYxLG+b+lEqqsCMAtRM
                                                                                          MD5:67BAEAA49567A196882553582D6F1776
                                                                                          SHA1:1B07424DE85A745BFFEE467280302FBF60317863
                                                                                          SHA-256:D02F7BD4028C676ABB41B407CD3E5F470B0CA1433C967DEEE6EB754213A1C781
                                                                                          SHA-512:16A5F3800587E8E7983C67EC559E07FC5AA4A2A09C7A463C3F8B77075B2D721F848E6E5191DBC271C0C5AF2D88E91FB404BF4CB2A2301D94BB6E4D9E494146A5
                                                                                          Malicious:false
                                                                                          Preview:.]..].M..J\.V.U..U.....>.3..4.........H.]Pm\."+.k?..v..a.p.i..63..f...>.K.....W.*..*..=.....`.\X/.~..|..-#?.:..... .x2.....,.s..%...s&A.EH<.......;..i.n.n............s..w[.......LA.K'.'..C....vJ(;.......P.....N....Z...".dd2[u..^....x.....;"..|......<.#Q...T....e.`..e...t..M...e..........o.../.H..M.a.;..'...B.Y..../......'d04...]0...3..'@z.z..H|.}k..e...T.0...$'p.T.6...UJ\........i:...@Av}t.W..-J.2..]~.<..M..b.If.4nR.*....R....f}..g....zBe.<~...?...WO().N.Y,...CC.(.......G..0a...E;`...FJ.,ZsN....,..w.01...\A,.6....%..Z6..7Z..s.g$.Bi.Pf..,o.s.9....^....N.G....(.......@Kl...a.r.....g ..$Z!..$F./)".....s(.Q\p.v.:..OH..@..1`.k..V.....>......z...]. ...5...Q......iM.......+...r....oM....&.Zb...he^Y....-....7L.dI..7..<&.}}..D.f..j..4.[..}..9..R....`.m.u.L......+|.Y....u.....g..8y.,In..9t=.i.~_.R.duKu.xYvf.e.N........*.o:...u...'.UKy...u7.(.e7..N......9}:e-P.."s..9..=....w.S.g.....z.......F"..Wf...r...Jd..F...1.x.L....W...#....xE.....o8.r.5>X..4

                                                                                          C:\Users\user\Documents\XZXHAVGRAG\VLZDGUKUTZ.xlsx.thPv (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.833380421768295
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:Ruq+7/N5+5agiSmfE4NAG+464ZtlNeZEqs85YHAxbMKn20+qM:Ruq+7/vYxLG+b+lEqqsCMAtRM
                                                                                          MD5:67BAEAA49567A196882553582D6F1776
                                                                                          SHA1:1B07424DE85A745BFFEE467280302FBF60317863
                                                                                          SHA-256:D02F7BD4028C676ABB41B407CD3E5F470B0CA1433C967DEEE6EB754213A1C781
                                                                                          SHA-512:16A5F3800587E8E7983C67EC559E07FC5AA4A2A09C7A463C3F8B77075B2D721F848E6E5191DBC271C0C5AF2D88E91FB404BF4CB2A2301D94BB6E4D9E494146A5
                                                                                          Malicious:false
                                                                                          Preview:.]..].M..J\.V.U..U.....>.3..4.........H.]Pm\."+.k?..v..a.p.i..63..f...>.K.....W.*..*..=.....`.\X/.~..|..-#?.:..... .x2.....,.s..%...s&A.EH<.......;..i.n.n............s..w[.......LA.K'.'..C....vJ(;.......P.....N....Z...".dd2[u..^....x.....;"..|......<.#Q...T....e.`..e...t..M...e..........o.../.H..M.a.;..'...B.Y..../......'d04...]0...3..'@z.z..H|.}k..e...T.0...$'p.T.6...UJ\........i:...@Av}t.W..-J.2..]~.<..M..b.If.4nR.*....R....f}..g....zBe.<~...?...WO().N.Y,...CC.(.......G..0a...E;`...FJ.,ZsN....,..w.01...\A,.6....%..Z6..7Z..s.g$.Bi.Pf..,o.s.9....^....N.G....(.......@Kl...a.r.....g ..$Z!..$F./)".....s(.Q\p.v.:..OH..@..1`.k..V.....>......z...]. ...5...Q......iM.......+...r....oM....&.Zb...he^Y....-....7L.dI..7..<&.}}..D.f..j..4.[..}..9..R....`.m.u.L......+|.Y....u.....g..8y.,In..9t=.i.~_.R.duKu.xYvf.e.N........*.o:...u...'.UKy...u7.(.e7..N......9}:e-P.."s..9..=....w.S.g.....z.......F"..Wf...r...Jd..F...1.x.L....W...#....xE.....o8.r.5>X..4

                                                                                          C:\Users\user\Documents\XZXHAVGRAG\XZXHAVGRAG.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.830242263086162
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:6m7Egl7KqokKYs+sfsFAOvyGCUHpEKJPtjTzlhe7KE3EI55mpODtGP:6mJlmhkmPa2U6ePpdzE35Mutw
                                                                                          MD5:6D5F723BB6A9A322DD2AF89F6F6B8C1A
                                                                                          SHA1:0BF5D4D74DFEEED918495B9B548E07EEBD2DE348
                                                                                          SHA-256:76D5391DE306CAB673967A35336BC728E048D8B9E1B2F040DB74E5FCAD6A515C
                                                                                          SHA-512:21A7656C0A7210FDF74194BF596E6408D277D913822991CE2D8DB94B70EF32D791ED0E120E964532651D752C133FA24B149A156690F0F9907B8CDDE03BD396A4
                                                                                          Malicious:false
                                                                                          Preview:.f..N.{....i<;.\.j_..&.....r.....m.....e....Q..q.wp...\h!..z..Ji.njK.k(..&.;.k.*........E.M....a@..b...d...7Zu..s..c.)9.....#..).AL......h.M5<......K.L1...S..]..0:..\r.X..E...4Bo.>p..b{4.F......XH..M...G.}.."E.._...i..q(.Yo....eo...7...+...7I..lj`.>%p..Qk....`]..}.8?.....0..7]b.De.6.:..v....".L..[=}.t......1....KM....4.'..t..|...>d.] 0...}..p....sH,*.....E..2...r4....7..v.....1..(L...A.mC!.....h..V.......{#$...J.....nR...u.n.........n...@s.b..C|...s0.....>.k..|D)..!....4q+:.:D....@:3G....,.A...!7Y....;Z.I.W.P1).}.<.Q-.)&).+.`..`QN@...;3.u40...h.1...|.u...i.Vs.RR..x93.u.P.j.A.vr.... ..o...`A.D.S...+s(.........l.C........|...Cd.....6r.i....r].c...<.?....(....q...P)...W:..].#A.wI.b.....p.7C.-..S.v..z.=...Z...L...!........>..\.P.&|~\.q.. XJ|S f$...?]&..Xq9..vt.//........N.^...p....wh..8c&...<!...1.wC.q....H.(s.o0.~..z..*...N..;(.../../1...p<...Y#N..G...g:.G[4V.S........[..R.}0..8...hD_....s<k....v.W.4S...4g).C.b.w.J.0n;..M.....B1u"...z._....

                                                                                          C:\Users\user\Documents\XZXHAVGRAG\XZXHAVGRAG.docx.eMWA (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.830242263086162
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:6m7Egl7KqokKYs+sfsFAOvyGCUHpEKJPtjTzlhe7KE3EI55mpODtGP:6mJlmhkmPa2U6ePpdzE35Mutw
                                                                                          MD5:6D5F723BB6A9A322DD2AF89F6F6B8C1A
                                                                                          SHA1:0BF5D4D74DFEEED918495B9B548E07EEBD2DE348
                                                                                          SHA-256:76D5391DE306CAB673967A35336BC728E048D8B9E1B2F040DB74E5FCAD6A515C
                                                                                          SHA-512:21A7656C0A7210FDF74194BF596E6408D277D913822991CE2D8DB94B70EF32D791ED0E120E964532651D752C133FA24B149A156690F0F9907B8CDDE03BD396A4
                                                                                          Malicious:false
                                                                                          Preview:.f..N.{....i<;.\.j_..&.....r.....m.....e....Q..q.wp...\h!..z..Ji.njK.k(..&.;.k.*........E.M....a@..b...d...7Zu..s..c.)9.....#..).AL......h.M5<......K.L1...S..]..0:..\r.X..E...4Bo.>p..b{4.F......XH..M...G.}.."E.._...i..q(.Yo....eo...7...+...7I..lj`.>%p..Qk....`]..}.8?.....0..7]b.De.6.:..v....".L..[=}.t......1....KM....4.'..t..|...>d.] 0...}..p....sH,*.....E..2...r4....7..v.....1..(L...A.mC!.....h..V.......{#$...J.....nR...u.n.........n...@s.b..C|...s0.....>.k..|D)..!....4q+:.:D....@:3G....,.A...!7Y....;Z.I.W.P1).}.<.Q-.)&).+.`..`QN@...;3.u40...h.1...|.u...i.Vs.RR..x93.u.P.j.A.vr.... ..o...`A.D.S...+s(.........l.C........|...Cd.....6r.i....r].c...<.?....(....q...P)...W:..].#A.wI.b.....p.7C.-..S.v..z.=...Z...L...!........>..\.P.&|~\.q.. XJ|S f$...?]&..Xq9..vt.//........N.^...p....wh..8c&...<!...1.wC.q....H.(s.o0.~..z..*...N..;(.../../1...p<...Y#N..G...g:.G[4V.S........[..R.}0..8...hD_....s<k....v.W.4S...4g).C.b.w.J.0n;..M.....B1u"...z._....

                                                                                          C:\Users\user\Documents\XZXHAVGRAG\YPSIACHYXW.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.856759163161907
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:ZwVW6LdO+DY6rw4HHJNwTx9eFCJblIPTJoyIgqfjCAh0eNRTgvcI2G4i:CVhA5qnJNUJJOpqfjHh1Tgvc3G4i
                                                                                          MD5:0E0285A7D0C51B509D7D907A1A59F827
                                                                                          SHA1:2B614DEAC2E4868293E9FA60E46E03B0DC31A26C
                                                                                          SHA-256:D89AE46041C3196F4AED2FA50076EEE15E7F5887FBBC371129CE8A8E9DB54DEC
                                                                                          SHA-512:471E76E83506074D3F9E28D5CE516F33EAA7D190990A15B69058BA5A71833BBB169D2EADA8FA95D7FBAA2638073BC887A01917A5450B13F958DC95121031CE6A
                                                                                          Malicious:false
                                                                                          Preview:..BW..v|TutS...........>..M......3.`.%........g.J.}.MsK~..sb.c:..-.9.........s2.q80.4...4.?..#.\.r...|Y.@.F.Frh... ....z.mz[..p.@....x..Jl[?......./..]......P.Y..........am......PK.F.......<.........N.E j.M....;.b.._.4".#;.Rh...T..hO-.W....~Zl.i2...RK.._...D.."....-.#..s...)ip6ab.../tP.Q......-..1ujA...\.)6....T.u... 7d,...2:.b..y..ap....c..p._~B`..WDc...I%?......%= .1W_.y.0..Kc..c>.&..N.$.<...c.@...GS(...'....t.Z....t.....i. .5..T.~).$..N..^.Uj.=v.^H.f...f...qV...}..a.x.........P.!c.\W..?^..D..............KWT..%....j.......f.s...G/UJ....D.....%t....+6.*......Gc...m~r....F!R01RT.i..VmzA....".FBhWe..]..NF..L.0....,.....lh..3i!...N,...c...dB..*..d....P.Es.G.%...\.3l.......0K.N.f\'Jg....]..c5.8.ok.._..2......Q.z.yc1..&..-8..3...~.e|.....S...i...Q*..-{9FS.l.S..$'q.g.c......Q5.....".1.....F.a..........=...6j..h..$.A...n.n..}.d..P...M.//....q....`...nmeo..R..J....px..R..;....I..o.........L#....:Y..p.....J..m...Y.Q]....Z...QP+..U>f.d...Z.-\8.

                                                                                          C:\Users\user\Documents\XZXHAVGRAG\YPSIACHYXW.mp3.shKb (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.856759163161907
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:ZwVW6LdO+DY6rw4HHJNwTx9eFCJblIPTJoyIgqfjCAh0eNRTgvcI2G4i:CVhA5qnJNUJJOpqfjHh1Tgvc3G4i
                                                                                          MD5:0E0285A7D0C51B509D7D907A1A59F827
                                                                                          SHA1:2B614DEAC2E4868293E9FA60E46E03B0DC31A26C
                                                                                          SHA-256:D89AE46041C3196F4AED2FA50076EEE15E7F5887FBBC371129CE8A8E9DB54DEC
                                                                                          SHA-512:471E76E83506074D3F9E28D5CE516F33EAA7D190990A15B69058BA5A71833BBB169D2EADA8FA95D7FBAA2638073BC887A01917A5450B13F958DC95121031CE6A
                                                                                          Malicious:false
                                                                                          Preview:..BW..v|TutS...........>..M......3.`.%........g.J.}.MsK~..sb.c:..-.9.........s2.q80.4...4.?..#.\.r...|Y.@.F.Frh... ....z.mz[..p.@....x..Jl[?......./..]......P.Y..........am......PK.F.......<.........N.E j.M....;.b.._.4".#;.Rh...T..hO-.W....~Zl.i2...RK.._...D.."....-.#..s...)ip6ab.../tP.Q......-..1ujA...\.)6....T.u... 7d,...2:.b..y..ap....c..p._~B`..WDc...I%?......%= .1W_.y.0..Kc..c>.&..N.$.<...c.@...GS(...'....t.Z....t.....i. .5..T.~).$..N..^.Uj.=v.^H.f...f...qV...}..a.x.........P.!c.\W..?^..D..............KWT..%....j.......f.s...G/UJ....D.....%t....+6.*......Gc...m~r....F!R01RT.i..VmzA....".FBhWe..]..NF..L.0....,.....lh..3i!...N,...c...dB..*..d....P.Es.G.%...\.3l.......0K.N.f\'Jg....]..c5.8.ok.._..2......Q.z.yc1..&..-8..3...~.e|.....S...i...Q*..-{9FS.l.S..$'q.g.c......Q5.....".1.....F.a..........=...6j..h..$.A...n.n..}.d..P...M.//....q....`...nmeo..R..J....px..R..;....I..o.........L#....:Y..p.....J..m...Y.Q]....Z...QP+..U>f.d...Z.-\8.

                                                                                          C:\Users\user\Documents\YPSIACHYXW.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.862484588405981
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:WhkmiA88A5DEtHjZEroqlHEgDmtp32vZBbZNeUTSSnrDxKxmVEEP9D:EhOrBlELQN5W8FD
                                                                                          MD5:DF0BBAD42B88DF32D66798047D9B17CA
                                                                                          SHA1:F61A1B78DD24A78BBE81F081C58F6EB664A3F90D
                                                                                          SHA-256:BC9325257586D71CC47763B8D601463F5573AAE58A348280714031A2B6881D6A
                                                                                          SHA-512:32750234DA0727DACD98C08443CB5A9E85B1A117ADD8D0B96E98E740164075FFEA431F5E853CEC4452CEEEBD0C5DE927728FBE6AD8707921DFAC53757F29F8A3
                                                                                          Malicious:false
                                                                                          Preview:..g..R;.u$+...m.Jj....!V....ON....``.1....1./...nD}.C.ZI9..P.i..&..*hy...........1.p..|.".d....F}u...%..+.VB.!:Cb....)I..3."Kml,.IR....<...,\.3*_.'.Q#.(.L|.('.......M..v..i%..b.......cf...2s..2>q....-.q%....:.I.=8e.M....\...rFHB...6...r...@Es'.w......-.Y.....M.f]0<3Dd. ...7..I.h...H...S..S.7!o>.@&J.0.K.9.... ...:>P.)c..V ..,.dI.-.U..0.,.*A..:ek.D......y........0.<...Rg.......~YG..Z.F(.!..9.z}..sS}1.C)O.cJp.~..3.fmC.......BJ}.;.8...Q.Mf..AwB...9...g..*.......K..d...r.......dT.R.3.kFt.Q.....{W.p...Y..."...#/..u/{....GPOH.........5..."L~.Q.O7.+...R.l'...S.../..Y.....4.Q].l.._......V.ck...bm..._i....*.D.b.|.).R..[.._......h....l...kN_.T.G....A..m.&..V3U..0.4^..+.....t"....k=.]jLq..}.z...<...]Q..fM.."zi..2e...|S.6.#.h...!.A..2..*...[.L,YJyu.?;.`.qi1D.Yo"..$..r892......(.j0.......?...?.Vgw...ct.#._V)..........V$...".......K@.*..]..KB.$N.=g.w...<W)F..x....GN=...f.y..$...}.]..qxh{.........C.q.t>.....:x....e..u..>.q..+.2....&7G.......<1(.Hi#...~....

                                                                                          C:\Users\user\Documents\YPSIACHYXW.jpg.VBwy (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.862484588405981
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:WhkmiA88A5DEtHjZEroqlHEgDmtp32vZBbZNeUTSSnrDxKxmVEEP9D:EhOrBlELQN5W8FD
                                                                                          MD5:DF0BBAD42B88DF32D66798047D9B17CA
                                                                                          SHA1:F61A1B78DD24A78BBE81F081C58F6EB664A3F90D
                                                                                          SHA-256:BC9325257586D71CC47763B8D601463F5573AAE58A348280714031A2B6881D6A
                                                                                          SHA-512:32750234DA0727DACD98C08443CB5A9E85B1A117ADD8D0B96E98E740164075FFEA431F5E853CEC4452CEEEBD0C5DE927728FBE6AD8707921DFAC53757F29F8A3
                                                                                          Malicious:false
                                                                                          Preview:..g..R;.u$+...m.Jj....!V....ON....``.1....1./...nD}.C.ZI9..P.i..&..*hy...........1.p..|.".d....F}u...%..+.VB.!:Cb....)I..3."Kml,.IR....<...,\.3*_.'.Q#.(.L|.('.......M..v..i%..b.......cf...2s..2>q....-.q%....:.I.=8e.M....\...rFHB...6...r...@Es'.w......-.Y.....M.f]0<3Dd. ...7..I.h...H...S..S.7!o>.@&J.0.K.9.... ...:>P.)c..V ..,.dI.-.U..0.,.*A..:ek.D......y........0.<...Rg.......~YG..Z.F(.!..9.z}..sS}1.C)O.cJp.~..3.fmC.......BJ}.;.8...Q.Mf..AwB...9...g..*.......K..d...r.......dT.R.3.kFt.Q.....{W.p...Y..."...#/..u/{....GPOH.........5..."L~.Q.O7.+...R.l'...S.../..Y.....4.Q].l.._......V.ck...bm..._i....*.D.b.|.).R..[.._......h....l...kN_.T.G....A..m.&..V3U..0.4^..+.....t"....k=.]jLq..}.z...<...]Q..fM.."zi..2e...|S.6.#.h...!.A..2..*...[.L,YJyu.?;.`.qi1D.Yo"..$..r892......(.j0.......?...?.Vgw...ct.#._V)..........V$...".......K@.*..]..KB.$N.=g.w...<W)F..x....GN=...f.y..$...}.]..qxh{.........C.q.t>.....:x....e..u..>.q..+.2....&7G.......<1(.Hi#...~....

                                                                                          C:\Users\user\Documents\YPSIACHYXW.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8454981922174625
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:KGyD96BAJo5uSElm1HacIH8CHwALcn6bjQ3JqWKSnMkd0D2B+H:4DQWmAwX6PcQxkd03
                                                                                          MD5:D390DA15B3297D57CA4C02FD77421AB9
                                                                                          SHA1:6AA6473CE17A2A0E5792E9C93DA049F4ADC04681
                                                                                          SHA-256:9C40F8A77DB6FD783638957220DB4A7F4FA9DFCD39EBAF6265378C2286E4E1BA
                                                                                          SHA-512:33BF6C4AAF59C09B9F1F86AD6A34B1A768F238A4470E088EBDC1394F718C587B584B651A2D0593776D44D11AB7192D22F05D104915C5E52D3161664A90CBD821
                                                                                          Malicious:false
                                                                                          Preview:L......w....kY.'G..&..b...u..@...f5....~...i...n.j..p....N,..fS...2b.g".....3.....F..jW...AI.U......c3...\..g..j..=g..<......t.a.S...u>.O....I^...|.1.......7.a./..V....i&L.R...o...e@...y.j......AY.e>j......2.....r..O5D'...A..g\.,+S&..>#L.2.b{-J...T&.u.........p.:.5.W......qn)6.+..!...a..'(O..T_.....oT.&.c..4...}..X...../xQm.a.;E$...%q..i.6g.(t.&.u........b.L....[k.C:5.F.l&..cp_zV.#I.[-L.... .H-..z.n...*.-.?.k*O.O.T`'R..}..b8@..[O....C..E..........aa.kb..........h..k.5..........A..Rx...O.o.i.b.A.....d.).y6?E.%6=.&.Yp..8.V._....z.J.Uj.)..:vM4.R....Q..(..)=M..89y....x.X.dk..3gxo..z.. ..T.q+..I.u.o4K.......#9<`..9.KJP.Z...X.X/.S..f]0...........x.-...+ ....M...Q..O.,.......xe.e..A<..k.w..Q9.1.HMy.e1.FY.....=.i.JO.r{..zA|.\.o#.Z)....H..f....Zu6*.d._.Cm.......r....<.A...$.......I..xi@..p.2iL.lVM...,r......@.Q.W.M.......U.2..l....E..@.&r.;i].7O.~..b..}. .a.0...{.....1...+e...../H..!.....4...F=....M&N.....K..v.<...c.h....../.~..1.`...`..

                                                                                          C:\Users\user\Documents\YPSIACHYXW.mp3.Nczu (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8454981922174625
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:KGyD96BAJo5uSElm1HacIH8CHwALcn6bjQ3JqWKSnMkd0D2B+H:4DQWmAwX6PcQxkd03
                                                                                          MD5:D390DA15B3297D57CA4C02FD77421AB9
                                                                                          SHA1:6AA6473CE17A2A0E5792E9C93DA049F4ADC04681
                                                                                          SHA-256:9C40F8A77DB6FD783638957220DB4A7F4FA9DFCD39EBAF6265378C2286E4E1BA
                                                                                          SHA-512:33BF6C4AAF59C09B9F1F86AD6A34B1A768F238A4470E088EBDC1394F718C587B584B651A2D0593776D44D11AB7192D22F05D104915C5E52D3161664A90CBD821
                                                                                          Malicious:false
                                                                                          Preview:L......w....kY.'G..&..b...u..@...f5....~...i...n.j..p....N,..fS...2b.g".....3.....F..jW...AI.U......c3...\..g..j..=g..<......t.a.S...u>.O....I^...|.1.......7.a./..V....i&L.R...o...e@...y.j......AY.e>j......2.....r..O5D'...A..g\.,+S&..>#L.2.b{-J...T&.u.........p.:.5.W......qn)6.+..!...a..'(O..T_.....oT.&.c..4...}..X...../xQm.a.;E$...%q..i.6g.(t.&.u........b.L....[k.C:5.F.l&..cp_zV.#I.[-L.... .H-..z.n...*.-.?.k*O.O.T`'R..}..b8@..[O....C..E..........aa.kb..........h..k.5..........A..Rx...O.o.i.b.A.....d.).y6?E.%6=.&.Yp..8.V._....z.J.Uj.)..:vM4.R....Q..(..)=M..89y....x.X.dk..3gxo..z.. ..T.q+..I.u.o4K.......#9<`..9.KJP.Z...X.X/.S..f]0...........x.-...+ ....M...Q..O.,.......xe.e..A<..k.w..Q9.1.HMy.e1.FY.....=.i.JO.r{..zA|.\.o#.Z)....H..f....Zu6*.d._.Cm.......r....<.A...$.......I..xi@..p.2iL.lVM...,r......@.Q.W.M.......U.2..l....E..@.&r.;i].7O.~..b..}. .a.0...{.....1...+e...../H..!.....4...F=....M&N.....K..v.<...c.h....../.~..1.`...`..

                                                                                          C:\Users\user\Documents\ZBEDCJPBEY.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.836567002774442
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:eSIAZ6bDRya5C+eMTcTvo9RNCwVckONq/6hLEchndiZbE:eSIAZ6bFya5OscTmmwSk2qyWchdiZo
                                                                                          MD5:343A21E243A28CE37CCD0DB62E63F307
                                                                                          SHA1:2A065E9F380BA355108855B6F7407EE665E98F1B
                                                                                          SHA-256:FD9191E944F5C78BCE4C0F3E7D46C7DAAD0A14173406B862756211E7FEF22F1A
                                                                                          SHA-512:6CCB623FAA919C0CF79D8DA28AA2E1E9DE69A825D60B0A0DEA2CB434AF0B7FC53784ECC94A3F1B191F085CFE6ED2710F028BD4BFEED810CAD4079ABE2757D696
                                                                                          Malicious:false
                                                                                          Preview:C'.....ot.......$o.k\E@..o..unn..M._.N.f......|...-.b...H....3.......G..oJ.....Ch.rP)...M....v.s\.n..|....|y..`#.n%y.C.s....Z.(.3.t..&....j_.7....b..".,....>..RHK..U..?..p.k..........LD...6PE...!.Ml..w..i.\Z!....U.I..s.Is4.M.{....@.An..g..<N)2<....D'q......P.'....$...Y9.../.48^5..;7e...j..hdu..k.V.BL,.<.u%\Xsn.x.Nz..Td#.:..zQ...=..s..0K4..).0.[s'....?.W\. M.&..AFT.1...M.j.J........8{Wn.P./..g..5(........n.,..(F......f.Ufv..x......v..........X.I...$N.#{`..JaA[.l.}...oF..s&...b.x...>?$...HU.....q...xO....s...u.b...J..@T.?...wr..[...s.'.?..^B$B.y.+.Mo.:+......"4..m...fI.+..>`.80'rp...g..q.......Lrt.b...E...-?..z+:.8...a..U....|{.H..U....k"...KDO.!......\......".... .......h...I4.{.5.A...1.......'...q...........?.2g.e.uT.@..QD....._.?^.....C....Z.<.a......1..H,..I.s......k..!,<....v]....GJ!....H.)p....v...wtZ.h.X?.[y.a.g...^..5?...$..Eo..3.3..ZS...f.s....<....L3^...m]w.+A.e...s.....J....B........8.~.{KF...P7..#Z..%...4.U=zxq..BZk4B[n...P..E.

                                                                                          C:\Users\user\Documents\ZBEDCJPBEY.png.vguc (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.836567002774442
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:eSIAZ6bDRya5C+eMTcTvo9RNCwVckONq/6hLEchndiZbE:eSIAZ6bFya5OscTmmwSk2qyWchdiZo
                                                                                          MD5:343A21E243A28CE37CCD0DB62E63F307
                                                                                          SHA1:2A065E9F380BA355108855B6F7407EE665E98F1B
                                                                                          SHA-256:FD9191E944F5C78BCE4C0F3E7D46C7DAAD0A14173406B862756211E7FEF22F1A
                                                                                          SHA-512:6CCB623FAA919C0CF79D8DA28AA2E1E9DE69A825D60B0A0DEA2CB434AF0B7FC53784ECC94A3F1B191F085CFE6ED2710F028BD4BFEED810CAD4079ABE2757D696
                                                                                          Malicious:false
                                                                                          Preview:C'.....ot.......$o.k\E@..o..unn..M._.N.f......|...-.b...H....3.......G..oJ.....Ch.rP)...M....v.s\.n..|....|y..`#.n%y.C.s....Z.(.3.t..&....j_.7....b..".,....>..RHK..U..?..p.k..........LD...6PE...!.Ml..w..i.\Z!....U.I..s.Is4.M.{....@.An..g..<N)2<....D'q......P.'....$...Y9.../.48^5..;7e...j..hdu..k.V.BL,.<.u%\Xsn.x.Nz..Td#.:..zQ...=..s..0K4..).0.[s'....?.W\. M.&..AFT.1...M.j.J........8{Wn.P./..g..5(........n.,..(F......f.Ufv..x......v..........X.I...$N.#{`..JaA[.l.}...oF..s&...b.x...>?$...HU.....q...xO....s...u.b...J..@T.?...wr..[...s.'.?..^B$B.y.+.Mo.:+......"4..m...fI.+..>`.80'rp...g..q.......Lrt.b...E...-?..z+:.8...a..U....|{.H..U....k"...KDO.!......\......".... .......h...I4.{.5.A...1.......'...q...........?.2g.e.uT.@..QD....._.?^.....C....Z.<.a......1..H,..I.s......k..!,<....v]....GJ!....H.)p....v...wtZ.h.X?.[y.a.g...^..5?...$..Eo..3.3..ZS...f.s....<....L3^...m]w.+A.e...s.....J....B........8.~.{KF...P7..#Z..%...4.U=zxq..BZk4B[n...P..E.

                                                                                          C:\Users\user\Downloads\DTBZGIOOSO.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.839110308047722
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:GnjXOx2RPeUnd2S/evAi+RLbXhKKg6Uc5161FjOwp5JW8S8gsb:GnyxDSMAtbFlIFiE5JW8Sx0
                                                                                          MD5:99E69CF5C426E8B9689AE5D15862FBDD
                                                                                          SHA1:FE2BA6FA3D656547BE23399E7FE218B3E386F6C0
                                                                                          SHA-256:DDE4FDD95C478A7D182B99C50BC906F79CCB9BEB1039808D2B899F2CE3D7B307
                                                                                          SHA-512:A820263A59139F64E056BDAF9272C0AB414D75D38FF86533FA97647F2822362ADB6D58D122311E0143753A009AEC5039932380F548E27840F405C8D90FCB813D
                                                                                          Malicious:false
                                                                                          Preview:.^.w.A....D...r.,.;.v.t.p.p...W.yxf...i..@..]>...J'..x.....]".&.j.w.*8.......F..(.j.1..#(..y.lPO.v.P.'...-.....9K.;...&..I.<..3..:BN..=NNE..u...`...x....H.fTc....q....R.....'$.fn..m...3.$.)Oz.B....*...!..7...:.82..Y9..227.B...J0.q.t.w.L-2!KbwG..4.Ea~1.K<l|<..p.H.<.].uGFN%W.9.Y3...aN..S.z..............<;0.. ..uK..,.2..R........v..w{..*%.....x.v.L&CF-V..klh.!L....Isf.*...K..K.9.w@.&......7.b.....]..$.2TH...q..dj$[1..c.D...U%.I...h.D...*...q.2.8jQ.............At..].E3y4Yf.....^.....O'.c.....N.<.....a.A...p......e;....._,,@.2..J.x+...s.....)wbI....|.kq#..E:.ji....v(....5.y...<...I....i...R.. ..w.....IV>.....2..;...._>.:~......}.y.....)..w)........Kq..x:..|V..y.).6(.#..;.=......,{...0..)....j.?-.$..0.sxyyN.&...._}&."/..e..*.:.R..d.. ..{.^...$s)5.oU.C."k.S...p^.q.N.*..36.........S;..[.gttU#hQd8.q..B-..0..._..K`.B...N.4o~.}C\.!...|..."1.J....m..1.M..E..M.)...........U.i.\N...(l.v.f.......SA......^..`o+......Up.F..[.$..|.00....].Zv<.IZN.......u..X..

                                                                                          C:\Users\user\Downloads\DTBZGIOOSO.docx.tQbh (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.839110308047722
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:GnjXOx2RPeUnd2S/evAi+RLbXhKKg6Uc5161FjOwp5JW8S8gsb:GnyxDSMAtbFlIFiE5JW8Sx0
                                                                                          MD5:99E69CF5C426E8B9689AE5D15862FBDD
                                                                                          SHA1:FE2BA6FA3D656547BE23399E7FE218B3E386F6C0
                                                                                          SHA-256:DDE4FDD95C478A7D182B99C50BC906F79CCB9BEB1039808D2B899F2CE3D7B307
                                                                                          SHA-512:A820263A59139F64E056BDAF9272C0AB414D75D38FF86533FA97647F2822362ADB6D58D122311E0143753A009AEC5039932380F548E27840F405C8D90FCB813D
                                                                                          Malicious:false
                                                                                          Preview:.^.w.A....D...r.,.;.v.t.p.p...W.yxf...i..@..]>...J'..x.....]".&.j.w.*8.......F..(.j.1..#(..y.lPO.v.P.'...-.....9K.;...&..I.<..3..:BN..=NNE..u...`...x....H.fTc....q....R.....'$.fn..m...3.$.)Oz.B....*...!..7...:.82..Y9..227.B...J0.q.t.w.L-2!KbwG..4.Ea~1.K<l|<..p.H.<.].uGFN%W.9.Y3...aN..S.z..............<;0.. ..uK..,.2..R........v..w{..*%.....x.v.L&CF-V..klh.!L....Isf.*...K..K.9.w@.&......7.b.....]..$.2TH...q..dj$[1..c.D...U%.I...h.D...*...q.2.8jQ.............At..].E3y4Yf.....^.....O'.c.....N.<.....a.A...p......e;....._,,@.2..J.x+...s.....)wbI....|.kq#..E:.ji....v(....5.y...<...I....i...R.. ..w.....IV>.....2..;...._>.:~......}.y.....)..w)........Kq..x:..|V..y.).6(.#..;.=......,{...0..)....j.?-.$..0.sxyyN.&...._}&."/..e..*.:.R..d.. ..{.^...$s)5.oU.C."k.S...p^.q.N.*..36.........S;..[.gttU#hQd8.q..B-..0..._..K`.B...N.4o~.}C\.!...|..."1.J....m..1.M..E..M.)...........U.i.\N...(l.v.f.......SA......^..`o+......Up.F..[.$..|.00....].Zv<.IZN.......u..X..

                                                                                          C:\Users\user\Downloads\DVWHKMNFNN.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.831469318759569
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:93Jy3ciDT2XsR+CWm65qrwSehQL5iOqoefVyQhfoUHHDmIAufn:DirfQ//m65Yi3vVZQOHOc
                                                                                          MD5:4337B170FF833987EC79406ECAC2C177
                                                                                          SHA1:D8F6322E9FC1301EA422FE349C4FBAE4543C11C3
                                                                                          SHA-256:BC9A6BB9E57AFD8720CEAF872F764D45FFBE3FF25A44403588B81A624066EF43
                                                                                          SHA-512:8C92EC3BAE56962E3CF6CB2AB91CB34B66DA143CC90E909E159212F949CF1B350CFF62B5F3EA9577FCC217C8E514C0EEBFFAEE976C0BAD14E1655C11D9A819DB
                                                                                          Malicious:false
                                                                                          Preview:w....(..H.N.....y.i..VA....u4..x&...).O(....?p.}H.G.y.......9.hs.%...D..d...3q.f...I......`.-x..?.....1#.......I.t..*..=.hf...a.. QOQf......';.n5..._...=.|....{..M$M.zr{./.?.._.'8.y.@xv.r...U.`...s.V..6E,w.V.Uw....x..|...B.....h.X2..f.5..[..x5...d.m..m.|......C....F..m.=M.DZ@..B.]..b...ey..DLh......;:!"...KX.r`j6&j-.K.J.J........S]..D....r..m(..o._..-h...C...H.4..sp.E.|.d.f{>.f....W...b....J.-..1...#.................;..x..s.".EX.C& ..^Z...=.Wm.x!.#....yy..t...u.vo...cA.aK.]...Pn.._..j..TG8.ye.A....G.;l$...#.rA]...nU]....)J..@Q..rR..;v.V...ee/.L...[c..$`...i.C..$.@<..;....8.W"......"..G.m../..y.r.).&.....-..SS../...W.$pr..c........q.0?f.2...\.......SZ....M..8..q?.*....uL....[.D..$..y..i._...@"f'.B..#......] ..Q`,R.........^a)]t...l.d....v..Kh;3........}...y;...J..+7@.:.......h.x.GC'...HQ...K.r[hz `....{t.L;0$o.....b.M.H.<.9.APMa.E<2Z?o.Tb...z..2.Gb....f#r.O.....KjQ.....C..E....u........{...V6....\..D..f@.\(3<..`.z.-..8a.^b......I;

                                                                                          C:\Users\user\Downloads\DVWHKMNFNN.jpg.FbPe (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.831469318759569
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:93Jy3ciDT2XsR+CWm65qrwSehQL5iOqoefVyQhfoUHHDmIAufn:DirfQ//m65Yi3vVZQOHOc
                                                                                          MD5:4337B170FF833987EC79406ECAC2C177
                                                                                          SHA1:D8F6322E9FC1301EA422FE349C4FBAE4543C11C3
                                                                                          SHA-256:BC9A6BB9E57AFD8720CEAF872F764D45FFBE3FF25A44403588B81A624066EF43
                                                                                          SHA-512:8C92EC3BAE56962E3CF6CB2AB91CB34B66DA143CC90E909E159212F949CF1B350CFF62B5F3EA9577FCC217C8E514C0EEBFFAEE976C0BAD14E1655C11D9A819DB
                                                                                          Malicious:false
                                                                                          Preview:w....(..H.N.....y.i..VA....u4..x&...).O(....?p.}H.G.y.......9.hs.%...D..d...3q.f...I......`.-x..?.....1#.......I.t..*..=.hf...a.. QOQf......';.n5..._...=.|....{..M$M.zr{./.?.._.'8.y.@xv.r...U.`...s.V..6E,w.V.Uw....x..|...B.....h.X2..f.5..[..x5...d.m..m.|......C....F..m.=M.DZ@..B.]..b...ey..DLh......;:!"...KX.r`j6&j-.K.J.J........S]..D....r..m(..o._..-h...C...H.4..sp.E.|.d.f{>.f....W...b....J.-..1...#.................;..x..s.".EX.C& ..^Z...=.Wm.x!.#....yy..t...u.vo...cA.aK.]...Pn.._..j..TG8.ye.A....G.;l$...#.rA]...nU]....)J..@Q..rR..;v.V...ee/.L...[c..$`...i.C..$.@<..;....8.W"......"..G.m../..y.r.).&.....-..SS../...W.$pr..c........q.0?f.2...\.......SZ....M..8..q?.*....uL....[.D..$..y..i._...@"f'.B..#......] ..Q`,R.........^a)]t...l.d....v..Kh;3........}...y;...J..+7@.:.......h.x.GC'...HQ...K.r[hz `....{t.L;0$o.....b.M.H.<.9.APMa.E<2Z?o.Tb...z..2.Gb....f#r.O.....KjQ.....C..E....u........{...V6....\..D..f@.\(3<..`.z.-..8a.^b......I;

                                                                                          C:\Users\user\Downloads\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Downloads\KATAXZVCPS.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.875782583304558
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:jBph5S03QrYCm30TtDQR2GQ6GOHQ5zPS2Z1cO97mRo12zk8m58dxEdmjhzFaf:jB75db3wtDQ8xMmjSO9Va5zktq4AhC
                                                                                          MD5:3DB615DB13393115D8A4E50A1DEC14EF
                                                                                          SHA1:71F479AA638A17430FF9045CFE21C30580337648
                                                                                          SHA-256:19E00917E4A16694A1E4AED7529D4B310AF616AEF1BDDFE2C3BE677E97D0A0FD
                                                                                          SHA-512:574AC5041CBE91574A059D36E1B7917D68BF32048DB907D623FE22D81924681E39D8EBA83EBEF469179687F6ADEC75C38A9BA42AADBCB0155A9E1D023F32AD7C
                                                                                          Malicious:false
                                                                                          Preview:..._...=...,.*r".;...Y.f.L.........|...?.....=........1....K..Q.q.M).>.!.....*.L..;..R........l...w`r8.^/.G...;8I(.....6^.)q...dFG... ....0...nG..$<80..N.e..>.]....X..8R...?.......&....J+.....H.@.Y ...f.#i.B.................6.....)...e...N3.U.%-.!+... S...M.$=.........2..b.po"...#5.)~AG..}y..ME.41..>....Cw.~.;E.H.L..LP..y...`./. t...^.........:.Q....b..W..1.Q{X....>.J.}.&.V4.E.n{Wm..........^`.].<.,...5b......7..e.).t.Q.!W.=..q<e..Y.<.s..u.'...c.....w./9..~i.m..+f".)t. ..OZ..i1.....%K..,.y.J....5....)....uM.u....z..%...s.1.E.c......[.S&j.|}NH.......=.s...<.}L)W..}.#p..C...dOYg.....#....d....L......8.qb[.Q..d.:mw.Q..Q...=T.......<?.=d|:J...l...%.......i.{..N4.. OD.."..eSV(.D..j.'.B....~Z.....o~...hdm..P..c|J....M%..zIVt..E#.h........o|=.v....]q.5.b.}.,...>."..N5.N.@U.ip..,W.....z~..Q.`,......:.Z.Y2V..h..5.E.....M.!".M.a.VUm..*yt../...(.Pq...4X...p`.(.....^Kh0.k.C.w.P.9....6..B..Ly..O..K}.b.piL..[......X....x.t@.<6...1..S..A.d..F

                                                                                          C:\Users\user\Downloads\KATAXZVCPS.mp3.sePc (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.875782583304558
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:jBph5S03QrYCm30TtDQR2GQ6GOHQ5zPS2Z1cO97mRo12zk8m58dxEdmjhzFaf:jB75db3wtDQ8xMmjSO9Va5zktq4AhC
                                                                                          MD5:3DB615DB13393115D8A4E50A1DEC14EF
                                                                                          SHA1:71F479AA638A17430FF9045CFE21C30580337648
                                                                                          SHA-256:19E00917E4A16694A1E4AED7529D4B310AF616AEF1BDDFE2C3BE677E97D0A0FD
                                                                                          SHA-512:574AC5041CBE91574A059D36E1B7917D68BF32048DB907D623FE22D81924681E39D8EBA83EBEF469179687F6ADEC75C38A9BA42AADBCB0155A9E1D023F32AD7C
                                                                                          Malicious:false
                                                                                          Preview:..._...=...,.*r".;...Y.f.L.........|...?.....=........1....K..Q.q.M).>.!.....*.L..;..R........l...w`r8.^/.G...;8I(.....6^.)q...dFG... ....0...nG..$<80..N.e..>.]....X..8R...?.......&....J+.....H.@.Y ...f.#i.B.................6.....)...e...N3.U.%-.!+... S...M.$=.........2..b.po"...#5.)~AG..}y..ME.41..>....Cw.~.;E.H.L..LP..y...`./. t...^.........:.Q....b..W..1.Q{X....>.J.}.&.V4.E.n{Wm..........^`.].<.,...5b......7..e.).t.Q.!W.=..q<e..Y.<.s..u.'...c.....w./9..~i.m..+f".)t. ..OZ..i1.....%K..,.y.J....5....)....uM.u....z..%...s.1.E.c......[.S&j.|}NH.......=.s...<.}L)W..}.#p..C...dOYg.....#....d....L......8.qb[.Q..d.:mw.Q..Q...=T.......<?.=d|:J...l...%.......i.{..N4.. OD.."..eSV(.D..j.'.B....~Z.....o~...hdm..P..c|J....M%..zIVt..E#.h........o|=.v....]q.5.b.}.,...>."..N5.N.@U.ip..,W.....z~..Q.`,......:.Z.Y2V..h..5.E.....M.!".M.a.VUm..*yt../...(.Pq...4X...p`.(.....^Kh0.k.C.w.P.9....6..B..Ly..O..K}.b.piL..[......X....x.t@.<6...1..S..A.d..F

                                                                                          C:\Users\user\Downloads\KATAXZVCPS.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.870360404538315
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:EQGlVZQUypBM+qVI8fQp4VN81Ek5olZiGy/hSYvo6cnCtoD:EQuhf88CN5oqGIhTvZ1M
                                                                                          MD5:444B66FE8C6AADD05E0B49249C146950
                                                                                          SHA1:9F5FD5AD3EF06EBE5D75B0C05B3DB02EFBF67F3F
                                                                                          SHA-256:7E792428DD6BD7BC66704F5BACEB664EE9C21AF3961158B15207055B18D97E8F
                                                                                          SHA-512:ECFF525511C2C32CF2E8350DDC754DB6D44E527C4D94870E89E5F91AEC7B781E97BCAB3EFECB1A2F3B6E6B3200A5A054B75814D64C6FFD686ACD2445B695AE67
                                                                                          Malicious:false
                                                                                          Preview:...,0.'{..3...w...N....X97^...y...Y..X.....j.\..c......:...e.Yp.K|,...^.#.D.1..t.L{.3..~.L(X.u.,Vy.H.....8.C....u......Y..%.. yT../?H*es.;J.........}.M...b.^m0!.7.x....U...7.}.....Ex......Xr.K.\`...7.D...K...2j.YS.%F........eRV...P..`.-..].'....V.-.....2..rk4...n..i..l...7!.....{."..d.T.......'A..../......AA.q......]....`Q?. .>.....}..7VU.<ie.s...3qM..ds.V*...(..+..*..:..T+...$.WG.U ...}M.~p.D.ly..g..iwy.5..s..j5..&..!....zt...3Bd.!.%...G.k.m.@.N....... ...E....T......O"..L..........6...o1...M......G....v.A$.{.....c.98_%....V..z.K.."...`S.....}.=........S............{..9.+7..#Jpa.....b.l.%.....3.:.....K./pL....b.......3...6..-k{..:./....(.q...........\.Pz<"RE1....S..7.Y...|X?..`.:&...n(.C..].k..>0..Q..=Z...Kh`.....Z...X4x.....!.W[.>..q..SF....$.....#.>..u...A.d......W.)....)..D'..u..3.....&..=.i.z?T.L...y|lqDC.._`...n\.@.R..{..f....l..Gk)C.Zo...# ..w....It.@.~.]...z..@.{.<,....6.f....Z.i|....1.I.*P.d..N..V.#..._.J.f!..*.?

                                                                                          C:\Users\user\Downloads\KATAXZVCPS.pdf.Mtlv (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.870360404538315
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:EQGlVZQUypBM+qVI8fQp4VN81Ek5olZiGy/hSYvo6cnCtoD:EQuhf88CN5oqGIhTvZ1M
                                                                                          MD5:444B66FE8C6AADD05E0B49249C146950
                                                                                          SHA1:9F5FD5AD3EF06EBE5D75B0C05B3DB02EFBF67F3F
                                                                                          SHA-256:7E792428DD6BD7BC66704F5BACEB664EE9C21AF3961158B15207055B18D97E8F
                                                                                          SHA-512:ECFF525511C2C32CF2E8350DDC754DB6D44E527C4D94870E89E5F91AEC7B781E97BCAB3EFECB1A2F3B6E6B3200A5A054B75814D64C6FFD686ACD2445B695AE67
                                                                                          Malicious:false
                                                                                          Preview:...,0.'{..3...w...N....X97^...y...Y..X.....j.\..c......:...e.Yp.K|,...^.#.D.1..t.L{.3..~.L(X.u.,Vy.H.....8.C....u......Y..%.. yT../?H*es.;J.........}.M...b.^m0!.7.x....U...7.}.....Ex......Xr.K.\`...7.D...K...2j.YS.%F........eRV...P..`.-..].'....V.-.....2..rk4...n..i..l...7!.....{."..d.T.......'A..../......AA.q......]....`Q?. .>.....}..7VU.<ie.s...3qM..ds.V*...(..+..*..:..T+...$.WG.U ...}M.~p.D.ly..g..iwy.5..s..j5..&..!....zt...3Bd.!.%...G.k.m.@.N....... ...E....T......O"..L..........6...o1...M......G....v.A$.{.....c.98_%....V..z.K.."...`S.....}.=........S............{..9.+7..#Jpa.....b.l.%.....3.:.....K./pL....b.......3...6..-k{..:./....(.q...........\.Pz<"RE1....S..7.Y...|X?..`.:&...n(.C..].k..>0..Q..=Z...Kh`.....Z...X4x.....!.W[.>..q..SF....$.....#.>..u...A.d......W.)....)..D'..u..3.....&..=.i.z?T.L...y|lqDC.._`...n\.@.R..{..f....l..Gk)C.Zo...# ..w....It.@.~.]...z..@.{.<,....6.f....Z.i|....1.I.*P.d..N..V.#..._.J.f!..*.?

                                                                                          C:\Users\user\Downloads\KATAXZVCPS.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.870134197123814
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:0hdxtSd3GjXkcGE8sKyLVEKaG7KkOxiDIWXbNTf0gqen16d:0hvtSd3ahGEHD7VIEIbd
                                                                                          MD5:3408D0EE5B39C44B95842687F8564A83
                                                                                          SHA1:FDC4CFDFC88565F9F4BF48DA98637E0A29AAACC3
                                                                                          SHA-256:DDF4A4608BA1D566ABEBAE6AB9F94ADF142699D2B6CBCB78AC3FDFCE7B183067
                                                                                          SHA-512:C6A4B91379E7917FEB7835CE605C3DF290B04D934629E1A8956DA09E15BA68905A115CC9226510746AB7194CBEFDBA53DCCB160C8101BF35DBA306212B245102
                                                                                          Malicious:false
                                                                                          Preview:l....Ey....q..8n.|..D...I.{k.7.....cZ._*.)-.I{.9..H.cu...jyM..........p[..N.R. W..}D.%.D._.7e.P.z..0dm :.+..6.LA-.Z..v(.}..]..5.#.Z.....e.../&.....#.&.y.'..p.q..........Q...y..Y..Q..g..c...=&.....tY....&...n;....U..K...N......'...M..e./.=".m...j|&p...J3$X.I.R...|.....tpY>;...&..R...l./...v...G.A;......) .k]]..7^...~...;'J..t."(..Ov....W.N.8.(U..j,..+f..[B.u.7...0.M.m?c.n...\.h......g..2...V.`W...J_..@0/.1....1...dpM.$..-...._.].DbP..L2+..,......-....#a..x........C.qj5.e..V.Q..*C.W....!.zaGq...*......>.S.."x.y}...a../.s.r}1.i._.......g..T.....4..P:fJ..D..........0..*..@...o...).!.M.3.8.-...W.K..]Z..f6(GV.(..Y......8q.@S....1}.....:f.m.*.h.jK.n.@.n.........j...8.rN.m. .54]....N.4N...).f......?u.....v........<.h'.$ .I.^......D.?....?.W-ywt.......R....t.zk.....a...T.v.k.7x..G...'i!C.t....#..:...M9..k.:..*.).._....K.....Oa..D..B.3[...!.. ...i.4(=$.o..w.z@.j..b:q-..T..Nq.wkz........%}.-.G!...-P....D../..fN=@.!.;./....&..7..s*.#a8b.g..{.

                                                                                          C:\Users\user\Downloads\KATAXZVCPS.xlsx.qNhM (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.870134197123814
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:0hdxtSd3GjXkcGE8sKyLVEKaG7KkOxiDIWXbNTf0gqen16d:0hvtSd3ahGEHD7VIEIbd
                                                                                          MD5:3408D0EE5B39C44B95842687F8564A83
                                                                                          SHA1:FDC4CFDFC88565F9F4BF48DA98637E0A29AAACC3
                                                                                          SHA-256:DDF4A4608BA1D566ABEBAE6AB9F94ADF142699D2B6CBCB78AC3FDFCE7B183067
                                                                                          SHA-512:C6A4B91379E7917FEB7835CE605C3DF290B04D934629E1A8956DA09E15BA68905A115CC9226510746AB7194CBEFDBA53DCCB160C8101BF35DBA306212B245102
                                                                                          Malicious:false
                                                                                          Preview:l....Ey....q..8n.|..D...I.{k.7.....cZ._*.)-.I{.9..H.cu...jyM..........p[..N.R. W..}D.%.D._.7e.P.z..0dm :.+..6.LA-.Z..v(.}..]..5.#.Z.....e.../&.....#.&.y.'..p.q..........Q...y..Y..Q..g..c...=&.....tY....&...n;....U..K...N......'...M..e./.=".m...j|&p...J3$X.I.R...|.....tpY>;...&..R...l./...v...G.A;......) .k]]..7^...~...;'J..t."(..Ov....W.N.8.(U..j,..+f..[B.u.7...0.M.m?c.n...\.h......g..2...V.`W...J_..@0/.1....1...dpM.$..-...._.].DbP..L2+..,......-....#a..x........C.qj5.e..V.Q..*C.W....!.zaGq...*......>.S.."x.y}...a../.s.r}1.i._.......g..T.....4..P:fJ..D..........0..*..@...o...).!.M.3.8.-...W.K..]Z..f6(GV.(..Y......8q.@S....1}.....:f.m.*.h.jK.n.@.n.........j...8.rN.m. .54]....N.4N...).f......?u.....v........<.h'.$ .I.^......D.?....?.W-ywt.......R....t.zk.....a...T.v.k.7x..G...'i!C.t....#..:...M9..k.:..*.).._....K.....Oa..D..B.3[...!.. ...i.4(=$.o..w.z@.j..b:q-..T..Nq.wkz........%}.-.G!...-P....D../..fN=@.!.;./....&..7..s*.#a8b.g..{.

                                                                                          C:\Users\user\Downloads\LTKMYBSEYZ.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8592945552550875
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:FQXvOKerZPTr81csrCdgQuUNW9c+4bzJRbWoIyvnewfCOLtuQ5OJXz5gTl:iXWKerAcjgQuUNWa+45Rb/vnKOZ5OpOx
                                                                                          MD5:1652136C7151083EC5DBEEB546316848
                                                                                          SHA1:89D0970F7EB399A0475ADF9D34B5E06C0156F22E
                                                                                          SHA-256:7D5B62E90972FBF9FCC912B3AA216575C7AEC927404E9B3C06394A6B7561B8EF
                                                                                          SHA-512:3A2C2FF516027BFFEBE3AF2164E622ED506FD841600BB102FFC0AB274D277EF6FC0C2CE550B17AAAB7F984B7B402CEC3B7D560E84CCC56984F33FADC2F86B028
                                                                                          Malicious:false
                                                                                          Preview:......B..H..)..p..v/j....."w.(..I|......x..G.9....^x.[...x../..^2^.J.\...M..,7*....R..... ...b.ak.O../y.R0l."^_...+S..].9-..4...g../I.....TPv..f..^S.:1....f...S\Er.-&....l.D....Q..s~..Z....9.... ....4[.kj.n]....l.W.3[.|.Hfo.P.x.It.&..M.C....2..l.})K-..~../.e...>...1....f....!".XJ.Q..2.-.[.D.v+...I.B|....V.(.q90N&.S..k...7-,.!>|LM.M.9.O..2.~..d4..CA....1.A.....d^`.b(...h......;..4..0.'./....c:.\].4e.......5...m...5m}..rBB...@e.b.C.h..S..f.Q.Z2.E.DDR.+jHp....w...Ve...O.`M..+..c....XB.t.].G......O..1C6O..."\vX.E.....+G...6..i*D..A.......m_2...S.0.,g..0..\V.._.91@(....Xt...G.g........*.>..p.~7...f@7..]..6.^\...jU..4........(.,.p.4.....Y..t..~.....P.p".....f$grBy?4@..A.:EG6....O#..=$.eH.=....k..gT..s").r..6.P. +.O.....=.....%[...u ..!............d0.a...4..z5....s.c..0......$...h..F....B'.L.A'..8....Z/C.+..z... .S...fb...\....2C.....~r.p..$... .&...Cm.KC..qNY3.....Z.~X.@..A..'...7f...Y..2...*~....zH`..1.lU.X.:...(....;e....nn..d.?)...a....9(@

                                                                                          C:\Users\user\Downloads\LTKMYBSEYZ.pdf.dmLi (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8592945552550875
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:FQXvOKerZPTr81csrCdgQuUNW9c+4bzJRbWoIyvnewfCOLtuQ5OJXz5gTl:iXWKerAcjgQuUNWa+45Rb/vnKOZ5OpOx
                                                                                          MD5:1652136C7151083EC5DBEEB546316848
                                                                                          SHA1:89D0970F7EB399A0475ADF9D34B5E06C0156F22E
                                                                                          SHA-256:7D5B62E90972FBF9FCC912B3AA216575C7AEC927404E9B3C06394A6B7561B8EF
                                                                                          SHA-512:3A2C2FF516027BFFEBE3AF2164E622ED506FD841600BB102FFC0AB274D277EF6FC0C2CE550B17AAAB7F984B7B402CEC3B7D560E84CCC56984F33FADC2F86B028
                                                                                          Malicious:false
                                                                                          Preview:......B..H..)..p..v/j....."w.(..I|......x..G.9....^x.[...x../..^2^.J.\...M..,7*....R..... ...b.ak.O../y.R0l."^_...+S..].9-..4...g../I.....TPv..f..^S.:1....f...S\Er.-&....l.D....Q..s~..Z....9.... ....4[.kj.n]....l.W.3[.|.Hfo.P.x.It.&..M.C....2..l.})K-..~../.e...>...1....f....!".XJ.Q..2.-.[.D.v+...I.B|....V.(.q90N&.S..k...7-,.!>|LM.M.9.O..2.~..d4..CA....1.A.....d^`.b(...h......;..4..0.'./....c:.\].4e.......5...m...5m}..rBB...@e.b.C.h..S..f.Q.Z2.E.DDR.+jHp....w...Ve...O.`M..+..c....XB.t.].G......O..1C6O..."\vX.E.....+G...6..i*D..A.......m_2...S.0.,g..0..\V.._.91@(....Xt...G.g........*.>..p.~7...f@7..]..6.^\...jU..4........(.,.p.4.....Y..t..~.....P.p".....f$grBy?4@..A.:EG6....O#..=$.eH.=....k..gT..s").r..6.P. +.O.....=.....%[...u ..!............d0.a...4..z5....s.c..0......$...h..F....B'.L.A'..8....Z/C.+..z... .S...fb...\....2C.....~r.p..$... .&...Cm.KC..qNY3.....Z.~X.@..A..'...7f...Y..2...*~....zH`..1.lU.X.:...(....;e....nn..d.?)...a....9(@

                                                                                          C:\Users\user\Downloads\NWTVCDUMOB.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8535072798916135
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:cSVQNsqeVzBqHNV7h+iqNWbMaVPn/U8ZGiDQDhqUBbbhwdUwiK5alIY:c6QNsqekHN1NqoYaRn/rQdBbbKdU3kvY
                                                                                          MD5:F009985743AC5DD35A621BAE86B32DA2
                                                                                          SHA1:3DB54AE767F40AFEF9D34373BDE7DBA92694841D
                                                                                          SHA-256:21FE8F0B5E1048B526BA827438B92D027F53CF60EFF1D8BD4B5BCA58E824BD1B
                                                                                          SHA-512:7CD727837C4F1CA305FE8F0C9F5D6098D72F8D46A429A0C4FEAA626A8A4CEAFA95DBFA92C53FABDFB2AEC213B9823EBBDD86060CB6227D5C519B75746A8CEB82
                                                                                          Malicious:false
                                                                                          Preview:.e..2>.I3=.u\.~.x..'U.v...R..o...........&.q....^M*s!..Nc%...1.0..l......s0A.j....u....C.K...{A.$.f....U...b.WV...q.>.2..f.,%....3Xr.u......-5..|...../=..?..@Kj....Y.......?..(.w..7M.R.M.gK..B..^e......iR..`.....K4...>....hf{h..,.kw...].....2.1{..b.V/+..&..:W.*..#.*=hS.....e.I..2.&..#O..K.u6.wq..+..;....@473.}...OH.4.....#b%..Q.,....&..E..M.l...."{.....1.......H...h|f....K.1g}D...O.._L...G..mi........Or...C...0..Qq.T..'.....Az...R.5`*..U.. ..;.R..h...M.6!0"g+...D2..H....}..J5?2S&f..o...S..a..a.._wW.|..ZQ.....a..ut...3ui<...I%..........,=...c.s...)va=...Ba..Z .^.E.G/.}.R.t.Q......^TF.a.C..d......."...ff.....\..!..].B.+....+9!.r..u.).`P.{..u=.xi./...7..l^..^.c.$..3....p....&}^#.M...1.B\..+-c3.x....p.P...T.G~S..K....c/C}.y.?.r...zGZn......|...g...I..&.Zg.sM.O...]....3.....D{.H.VX.....*%........[..M..'.................F...w...i&...Z..c..b?..}.:#_..\t..).C.1V`.ke.W.;.A....-7by....LHRl;:&.q....W.G~.....m...-./tK=....^.....

                                                                                          C:\Users\user\Downloads\NWTVCDUMOB.png.gQOr (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8535072798916135
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:cSVQNsqeVzBqHNV7h+iqNWbMaVPn/U8ZGiDQDhqUBbbhwdUwiK5alIY:c6QNsqekHN1NqoYaRn/rQdBbbKdU3kvY
                                                                                          MD5:F009985743AC5DD35A621BAE86B32DA2
                                                                                          SHA1:3DB54AE767F40AFEF9D34373BDE7DBA92694841D
                                                                                          SHA-256:21FE8F0B5E1048B526BA827438B92D027F53CF60EFF1D8BD4B5BCA58E824BD1B
                                                                                          SHA-512:7CD727837C4F1CA305FE8F0C9F5D6098D72F8D46A429A0C4FEAA626A8A4CEAFA95DBFA92C53FABDFB2AEC213B9823EBBDD86060CB6227D5C519B75746A8CEB82
                                                                                          Malicious:false
                                                                                          Preview:.e..2>.I3=.u\.~.x..'U.v...R..o...........&.q....^M*s!..Nc%...1.0..l......s0A.j....u....C.K...{A.$.f....U...b.WV...q.>.2..f.,%....3Xr.u......-5..|...../=..?..@Kj....Y.......?..(.w..7M.R.M.gK..B..^e......iR..`.....K4...>....hf{h..,.kw...].....2.1{..b.V/+..&..:W.*..#.*=hS.....e.I..2.&..#O..K.u6.wq..+..;....@473.}...OH.4.....#b%..Q.,....&..E..M.l...."{.....1.......H...h|f....K.1g}D...O.._L...G..mi........Or...C...0..Qq.T..'.....Az...R.5`*..U.. ..;.R..h...M.6!0"g+...D2..H....}..J5?2S&f..o...S..a..a.._wW.|..ZQ.....a..ut...3ui<...I%..........,=...c.s...)va=...Ba..Z .^.E.G/.}.R.t.Q......^TF.a.C..d......."...ff.....\..!..].B.+....+9!.r..u.).`P.{..u=.xi./...7..l^..^.c.$..3....p....&}^#.M...1.B\..+-c3.x....p.P...T.G~S..K....c/C}.y.?.r...zGZn......|...g...I..&.Zg.sM.O...]....3.....D{.H.VX.....*%........[..M..'.................F...w...i&...Z..c..b?..}.:#_..\t..).C.1V`.ke.W.;.A....-7by....LHRl;:&.q....W.G~.....m...-./tK=....^.....

                                                                                          C:\Users\user\Downloads\ONBQCLYSPU.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.837774276386986
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:NReLblfuG97kTjGleUHuQeJX1Xjz8PqIe1JZU3brGMcZkGLs3UebfGQzJLS:NYFn97CGleUHuQebz8Zu7QqMqLs3UefQ
                                                                                          MD5:385278F27A375C38A9BB5189A24B90B7
                                                                                          SHA1:F59767AC7E6E57EF7536B05DCDB23FD4692EB65F
                                                                                          SHA-256:F5CD918E5A302A7A4A01B622136576F51A955A8963EA21C6B5F558393CE83EC8
                                                                                          SHA-512:15B7B935BE9F6C2984DBA2D3E8C455E2EF2E42B002B2634AE662B0E663BDCCF3AC1DFC7231052AB7ABB8FDE76139973E099CCCEACC84877BAB02111672FC0D02
                                                                                          Malicious:false
                                                                                          Preview:"..t&R..(.h..78j.y..>.~._.1..;...>E0at.....|.s.#.......pw..K.&....h.n!....e,\....R.X.j.p.......cJ0$.~.x.~~.38:s.9..D...._Y....N.6.YI.t....2^.....x.v. O.JE.~.i.|...?W.,.L.h`3$....$.3Q..z.L~#.._H./.r.i.Zx.x...7....h........1...:.......Z..qI....l;m.-a.=..=]..>6.E.K..j...si.(~aX..'a....K..MO=B.Dx..-(*.l...0=....wA(;.#.^O..rS.M..8x..8.G|.]o@._ )P..#.hrCF..k...+......O.l...j.......Jg.r$d~9..rn..p.<.v.Z...d...h......T6..v5..Lq...]o....+.M.p.x.b..s.D.*...?...)....\..3O}p..p.^...K...{..!.%`CZ..NSsn..(w.._.|.R..F..k'...W.t....).F..>ic.&...n..4V...O......Nud..BPg(.%..69..]zn~..^.+s.4........*....\.y.b.}<..."S k1.=R.....I..G=.g.,.c.<.Fg.J.....2..Y.H..9.)......0.,._..HZ..O...M....w..;.t.H...G.9.t.fO,....M,m.dyL#o.P..=Ex.q..SB.f{.M..'.<.tC.T.7.O.>3..U......../..]'Q.^+....`..O%..9..L. ..,.. z.6^..Saw.I3..,c6.,..M}9...4bR..r....)p...|..$..m............-..sO..,r.-..s.R~x..{....M\. .Q3.*.....)AW.<..N.8x0.g...B?.&t..tR.s..V..8..C..#..%.../. .E...?....!.(..n.;..U;...D.M*

                                                                                          C:\Users\user\Downloads\ONBQCLYSPU.docx.BNIw (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.837774276386986
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:NReLblfuG97kTjGleUHuQeJX1Xjz8PqIe1JZU3brGMcZkGLs3UebfGQzJLS:NYFn97CGleUHuQebz8Zu7QqMqLs3UefQ
                                                                                          MD5:385278F27A375C38A9BB5189A24B90B7
                                                                                          SHA1:F59767AC7E6E57EF7536B05DCDB23FD4692EB65F
                                                                                          SHA-256:F5CD918E5A302A7A4A01B622136576F51A955A8963EA21C6B5F558393CE83EC8
                                                                                          SHA-512:15B7B935BE9F6C2984DBA2D3E8C455E2EF2E42B002B2634AE662B0E663BDCCF3AC1DFC7231052AB7ABB8FDE76139973E099CCCEACC84877BAB02111672FC0D02
                                                                                          Malicious:false
                                                                                          Preview:"..t&R..(.h..78j.y..>.~._.1..;...>E0at.....|.s.#.......pw..K.&....h.n!....e,\....R.X.j.p.......cJ0$.~.x.~~.38:s.9..D...._Y....N.6.YI.t....2^.....x.v. O.JE.~.i.|...?W.,.L.h`3$....$.3Q..z.L~#.._H./.r.i.Zx.x...7....h........1...:.......Z..qI....l;m.-a.=..=]..>6.E.K..j...si.(~aX..'a....K..MO=B.Dx..-(*.l...0=....wA(;.#.^O..rS.M..8x..8.G|.]o@._ )P..#.hrCF..k...+......O.l...j.......Jg.r$d~9..rn..p.<.v.Z...d...h......T6..v5..Lq...]o....+.M.p.x.b..s.D.*...?...)....\..3O}p..p.^...K...{..!.%`CZ..NSsn..(w.._.|.R..F..k'...W.t....).F..>ic.&...n..4V...O......Nud..BPg(.%..69..]zn~..^.+s.4........*....\.y.b.}<..."S k1.=R.....I..G=.g.,.c.<.Fg.J.....2..Y.H..9.)......0.,._..HZ..O...M....w..;.t.H...G.9.t.fO,....M,m.dyL#o.P..=Ex.q..SB.f{.M..'.<.tC.T.7.O.>3..U......../..]'Q.^+....`..O%..9..L. ..,.. z.6^..Saw.I3..,c6.,..M}9...4bR..r....)p...|..$..m............-..sO..,r.-..s.R~x..{....M\. .Q3.*.....)AW.<..N.8x0.g...B?.&t..tR.s..V..8..C..#..%.../. .E...?....!.(..n.;..U;...D.M*

                                                                                          C:\Users\user\Downloads\ONBQCLYSPU.pdf

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8482582752435235
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:sPucWAI5ZGaKjGePLvuL6IygEpT6lFcH5Qf0wO7y0Jf1dlg+DTY:AtIqhSN2I7o6qdwOe0plHDc
                                                                                          MD5:7A68384C1A7D31E61390ED7FF48FD798
                                                                                          SHA1:F672964B300C6B430AB70957FC0AA4F2E6F027BC
                                                                                          SHA-256:26B390B7D25C76A10C6E56100E207020BA56EBF88718F0C3E4D85BF8FFBB91E1
                                                                                          SHA-512:D4246CCB65E934177E776514EE438726CA0392C6EB546E3A9E54F182F87EF4D419F72AE559EC91928277B8F151ABEFFC7FDA98766EDA9DC406D8D51A304D8564
                                                                                          Malicious:false
                                                                                          Preview:TS.)8....;-..Y....\.........(z.F.aU8(.d.mc|. ...l...:.@.n..I._2...:....uY!..=u....'l.$.l|F......D(c._!.}~...7......[$....L.....d....$\..7.$.....\..tP..N.'..g.+..\..j.......'..I..,<7.&.UM....~..a.r.....\m>..Z.f.h....5.9$.HV....B..k..c.R.....k..'R.)K......}..oR.Z...c1.......~1 h"...:..4...d=hZ.....}B5|df..g?.,.W....o.F..H?....}T@c_P.P.f%...v(. Z......<..+p.R.;.Kv.,..y.U...L.s.s..|O.).ODS%...:.....^...^...zv..>.H.@...!.$.:.}.$...A.k.....w.Q...="....Z.5....R~.,...{.....&.*6.._..$..9mA......c..>.M .^....*.?l}K.kQ..I..0.J.$. ......<*.....K.[.L.<h....=.5.........4V%....{vy..=....uT..a.~.\b.>....s8...#~`..S .......D.Y.F:EV..xF[...o.-.3%...J...i;...h..x................:.V.......kw".u].........[N..F.!.3S..Kr }.X.....6....D$....Q...h.y@..G.x.:..w.3{|.......(<U..{~.nLn..].8$...o}......1.D.s...wE..FN....&.D6j..u!...v..q.c....J..M...j.H..)h.]......?W...O..sM!. .Z....y..Jy3n.^O......N.y#..)..A.....`.[m.....9.}'..3...j....]..&.L.<....r.,.P..v].!.0....Kp.)[2G?

                                                                                          C:\Users\user\Downloads\ONBQCLYSPU.pdf.sNYJ (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8482582752435235
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:sPucWAI5ZGaKjGePLvuL6IygEpT6lFcH5Qf0wO7y0Jf1dlg+DTY:AtIqhSN2I7o6qdwOe0plHDc
                                                                                          MD5:7A68384C1A7D31E61390ED7FF48FD798
                                                                                          SHA1:F672964B300C6B430AB70957FC0AA4F2E6F027BC
                                                                                          SHA-256:26B390B7D25C76A10C6E56100E207020BA56EBF88718F0C3E4D85BF8FFBB91E1
                                                                                          SHA-512:D4246CCB65E934177E776514EE438726CA0392C6EB546E3A9E54F182F87EF4D419F72AE559EC91928277B8F151ABEFFC7FDA98766EDA9DC406D8D51A304D8564
                                                                                          Malicious:false
                                                                                          Preview:TS.)8....;-..Y....\.........(z.F.aU8(.d.mc|. ...l...:.@.n..I._2...:....uY!..=u....'l.$.l|F......D(c._!.}~...7......[$....L.....d....$\..7.$.....\..tP..N.'..g.+..\..j.......'..I..,<7.&.UM....~..a.r.....\m>..Z.f.h....5.9$.HV....B..k..c.R.....k..'R.)K......}..oR.Z...c1.......~1 h"...:..4...d=hZ.....}B5|df..g?.,.W....o.F..H?....}T@c_P.P.f%...v(. Z......<..+p.R.;.Kv.,..y.U...L.s.s..|O.).ODS%...:.....^...^...zv..>.H.@...!.$.:.}.$...A.k.....w.Q...="....Z.5....R~.,...{.....&.*6.._..$..9mA......c..>.M .^....*.?l}K.kQ..I..0.J.$. ......<*.....K.[.L.<h....=.5.........4V%....{vy..=....uT..a.~.\b.>....s8...#~`..S .......D.Y.F:EV..xF[...o.-.3%...J...i;...h..x................:.V.......kw".u].........[N..F.!.3S..Kr }.X.....6....D$....Q...h.y@..G.x.:..w.3{|.......(<U..{~.nLn..].8$...o}......1.D.s...wE..FN....&.D6j..u!...v..q.c....J..M...j.H..)h.]......?W...O..sM!. .Z....y..Jy3n.^O......N.y#..)..A.....`.[m.....9.}'..3...j....]..&.L.<....r.,.P..v].!.0....Kp.)[2G?

                                                                                          C:\Users\user\Downloads\RAYHIWGKDI.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.846390040496264
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:BeCjh/wUxUNMls3pvpzOKnN2+tD/gi2MlzlmFITnAQDmh29e12:BeCjNw7Mls3pBzbnNJ2azVLm29ew
                                                                                          MD5:18C0CD9F5548E0CE83C109DBE72F4FD2
                                                                                          SHA1:76F83F969D81E4EFAC8993E39E867CF1CA733079
                                                                                          SHA-256:F0C257ADDBCEAA20232D583E502FF6D167AADE8D1E30F1C6770AA25E4DA26CEA
                                                                                          SHA-512:D09398B2F950ACC5244FA5B99C8B186FD2CA1765115040462D6F44B07F787CD8F898B907D9E22D255DD312CB9C5D17C9B57EC422D54257E02578B6198CBD85DF
                                                                                          Malicious:false
                                                                                          Preview:....=..t........#W.......fr}..md0.R.j.....\......E.a..?.r;..[F...A|_...j.=........lbc........{Q..,..m.R..........7Sa...gKO.P.+...6k....S....>...O~......03.p%..1.A..B.#.3!(...Wp^o....G......~ ...}.}Q).(c.....lt..dS.f.t.....].M......."7........i"N...F.8T<..6..`.\Y~.....ZU..iQ8=.......t....gi.P...g.(.l.-.U.R.j.m.v...w....F`...\.K":.H.\'....5....:.o.f.E.~.MF.....S..i.....U....A...b....6.e..W...d....{..y...`....(.E.....z.F..DY...Jx..........SU.Q'.".X..{......F.]GJ......O...Qo>.>w....._]...d.V.....b`.0j...M....=....j^..q..R....s....X_X..g.na..\..:.6#5k...a.Gn.......#..b..h....f..K.m.3fb.4u.0......Y=...tz....o.(.K.s...@$..6x....3z..H......N....G...w1M....i>..>._....s#.H....Ch)..Y...[^X..u7g.[....m...m.E.&....8 ...._NQM......N..[A....c("...D..[.a.+.\...q.#...#.<_.2.............>..{D.!r..NxMg.I.*..Te.q.0Y:.i.v.Z..<.%.'!Y..r..c.....S..M.M..(..{.m.T...~.NO..XF.>V.L..w'..s.s.d{n.....r}o....V;.....xV.0..0.X......r....K.k.Zp.S..`U....?...@..4[..

                                                                                          C:\Users\user\Downloads\RAYHIWGKDI.mp3.kzyR (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.846390040496264
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:BeCjh/wUxUNMls3pvpzOKnN2+tD/gi2MlzlmFITnAQDmh29e12:BeCjNw7Mls3pBzbnNJ2azVLm29ew
                                                                                          MD5:18C0CD9F5548E0CE83C109DBE72F4FD2
                                                                                          SHA1:76F83F969D81E4EFAC8993E39E867CF1CA733079
                                                                                          SHA-256:F0C257ADDBCEAA20232D583E502FF6D167AADE8D1E30F1C6770AA25E4DA26CEA
                                                                                          SHA-512:D09398B2F950ACC5244FA5B99C8B186FD2CA1765115040462D6F44B07F787CD8F898B907D9E22D255DD312CB9C5D17C9B57EC422D54257E02578B6198CBD85DF
                                                                                          Malicious:false
                                                                                          Preview:....=..t........#W.......fr}..md0.R.j.....\......E.a..?.r;..[F...A|_...j.=........lbc........{Q..,..m.R..........7Sa...gKO.P.+...6k....S....>...O~......03.p%..1.A..B.#.3!(...Wp^o....G......~ ...}.}Q).(c.....lt..dS.f.t.....].M......."7........i"N...F.8T<..6..`.\Y~.....ZU..iQ8=.......t....gi.P...g.(.l.-.U.R.j.m.v...w....F`...\.K":.H.\'....5....:.o.f.E.~.MF.....S..i.....U....A...b....6.e..W...d....{..y...`....(.E.....z.F..DY...Jx..........SU.Q'.".X..{......F.]GJ......O...Qo>.>w....._]...d.V.....b`.0j...M....=....j^..q..R....s....X_X..g.na..\..:.6#5k...a.Gn.......#..b..h....f..K.m.3fb.4u.0......Y=...tz....o.(.K.s...@$..6x....3z..H......N....G...w1M....i>..>._....s#.H....Ch)..Y...[^X..u7g.[....m...m.E.&....8 ...._NQM......N..[A....c("...D..[.a.+.\...q.#...#.<_.2.............>..{D.!r..NxMg.I.*..Te.q.0Y:.i.v.Z..<.%.'!Y..r..c.....S..M.M..(..{.m.T...~.NO..XF.>V.L..w'..s.s.d{n.....r}o....V;.....xV.0..0.X......r....K.k.Zp.S..`U....?...@..4[..

                                                                                          C:\Users\user\Downloads\UMMBDNEQBN.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.850385248625573
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:pQwAe9bTXW+NcFhOgW7kg7CH9A2tLNaYzIqc31UWgdjXv:pQG9b7zshxWXM6OBA1UW2v
                                                                                          MD5:158F32DF0E5CADE8FD3CC65479519CB8
                                                                                          SHA1:B614C7B1D01C67AD23D558A4EC5220E711F97BA5
                                                                                          SHA-256:2BA2399D07A1946E17E2FB5B0CCC2BFFDB22EAAA8DF24664FD74D9DA96B8E8AF
                                                                                          SHA-512:0CE5471861007F7DBA0E2C78F81B00034E976CED3C079E9492D589F0A5BAAF1AE5604E10599F6B5DC576F0C1A13D12D58E24B7D10696C0FF3A29444A676B2D47
                                                                                          Malicious:false
                                                                                          Preview:.%.L4..j .%.e..=..N!...&...=..c...B.Ato.OF.2Hs.......5...7..e. ../B.$..,..WbS.O.u'oI,s`...*s..d.p....'c..9..Ip..A........-.*..2...X...M........-.nW.p.A..A.......C.V......@G....T.........@J. ...v[Z.b.n..x-"h,.....`..].K..S.g`..\\`.r...:+..@L.....A.yW....[....&b}..%.f..c......q.?..F.........0H..\..z_..3.<..s4S.7rb~.+....,...%.H..y0w*.8..|u$)W.Z!.W;.~....g..A..Y.T.n.d.-.....&2.`.E...t>pn.1k.N..kF...:B..gvPcN.:W....c..S...4.o...r.c4.^..zv.\~Z.sKS.v...k6.?....R6gr.<+@.:.B.JD.."j......e.W.<$..[.C...}i.........5.i.......7.'1..7~Q..h....1'......}V*......|.I.......U.....nST2'*.......}.{.Pd.`.;.,#_E.W.6.......W..'x..;..]8t..5Q.h>V..E.e......&..y.....4.U.K.w...b...xY......!....0.F...*z...3.W....,-...vB.....!Ux.l...S./.B.....,....^.B.(+>.>..F...>.C4.4..h.....nF..iH.i...%.........w..ut..}.;.....7...EO..!mI_.O..so[f..I..S.t....aa.....('%....za2.....;....q.f..0..X..i.B..u....'.</H.r..J....y.4..C.....j:m..a..0...[`..O.$..a.......$..,S....#..P.`

                                                                                          C:\Users\user\Downloads\UMMBDNEQBN.png.WOKw (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.850385248625573
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:pQwAe9bTXW+NcFhOgW7kg7CH9A2tLNaYzIqc31UWgdjXv:pQG9b7zshxWXM6OBA1UW2v
                                                                                          MD5:158F32DF0E5CADE8FD3CC65479519CB8
                                                                                          SHA1:B614C7B1D01C67AD23D558A4EC5220E711F97BA5
                                                                                          SHA-256:2BA2399D07A1946E17E2FB5B0CCC2BFFDB22EAAA8DF24664FD74D9DA96B8E8AF
                                                                                          SHA-512:0CE5471861007F7DBA0E2C78F81B00034E976CED3C079E9492D589F0A5BAAF1AE5604E10599F6B5DC576F0C1A13D12D58E24B7D10696C0FF3A29444A676B2D47
                                                                                          Malicious:false
                                                                                          Preview:.%.L4..j .%.e..=..N!...&...=..c...B.Ato.OF.2Hs.......5...7..e. ../B.$..,..WbS.O.u'oI,s`...*s..d.p....'c..9..Ip..A........-.*..2...X...M........-.nW.p.A..A.......C.V......@G....T.........@J. ...v[Z.b.n..x-"h,.....`..].K..S.g`..\\`.r...:+..@L.....A.yW....[....&b}..%.f..c......q.?..F.........0H..\..z_..3.<..s4S.7rb~.+....,...%.H..y0w*.8..|u$)W.Z!.W;.~....g..A..Y.T.n.d.-.....&2.`.E...t>pn.1k.N..kF...:B..gvPcN.:W....c..S...4.o...r.c4.^..zv.\~Z.sKS.v...k6.?....R6gr.<+@.:.B.JD.."j......e.W.<$..[.C...}i.........5.i.......7.'1..7~Q..h....1'......}V*......|.I.......U.....nST2'*.......}.{.Pd.`.;.,#_E.W.6.......W..'x..;..]8t..5Q.h>V..E.e......&..y.....4.U.K.w...b...xY......!....0.F...*z...3.W....,-...vB.....!Ux.l...S./.B.....,....^.B.(+>.>..F...>.C4.4..h.....nF..iH.i...%.........w..ut..}.;.....7...EO..!mI_.O..so[f..I..S.t....aa.....('%....za2.....;....q.f..0..X..i.B..u....'.</H.r..J....y.4..C.....j:m..a..0...[`..O.$..a.......$..,S....#..P.`

                                                                                          C:\Users\user\Downloads\VLZDGUKUTZ.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8571563303905805
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:9Vx0bKSVCuPgor7KLbwErtcwGu491752/eVXheBVyOlOzp+d9xHH:9nDSHr7W8MfGui17M/IXheBVNI4vh
                                                                                          MD5:8D80EE4E26DC61F317C780216376AB72
                                                                                          SHA1:379D73E513903DE8C8F705450D4012A39A0E16FC
                                                                                          SHA-256:021B125B056F24AF9C5127858C0D88D0C3D74C915DCCB5CDE555AD889BA2475B
                                                                                          SHA-512:268532BCD4DF545D8CAA65C45E331EBCA27380CB82981735D2139BB0482E12B1A38F08C43C66AFCFFDDDAF10D41A3A89A1512AFBD5D1B956AB7DDC0BD9AB4D2D
                                                                                          Malicious:false
                                                                                          Preview:...L..,.>+..Y{s.UK.C.).z...sc...K.V..F..~I.t<..dJ. ..cD.....6......e.a.uS.+.ay.w.I...w...t}.5:..H......0....].,W....Jp..\.`..."nu}}b.i....*}P..93.8..w%T#).kAzn.;..)c@.D..#f..<..S...T..*......A.mB.....JD...]...gNtN..9.B.)...']...Z.<&....PK.`.7Q[..H..T..+.d..1...l.c.....f.....^..{.Bl.2.!g...^.5.G..w8.%C.....#J'.....5R.@.<.....r....?.f.dXe..9 <..i.e..Q.....,...... .@...4.v...B.3S.IP.j-.oH.....3....@...z.b-.&.d..Y|'.+'..,J..u._%%.W...\...S....@.!.Y.+.hN..A.q.0.............V..9e.!..Z,.s...].c..j"#X.*..#Rd..Q..:.....Vi.J....<....3.?.4X.N+.i.4....`....`5..k..)-.......O.b...t..1...`.G...].jI.H.b....{.0........N.m...r...,...*.&....:^...6...r7..rEl.#...K.I7x(.+..H....C.._.c7._!.~..F..O>.A....L....z.UP...../M+.[...g..I.d.+<vp.A~'....U.....r..!..5..[t...zR.....y..[..<..vD.2.$..m-...+....Nf.)....1D=#....UI.!?.8....m.m..~.....Em0,..5..<.......#...#.).....}.....%t..?..M...77~.b.9.1...Hq._-.KF..L.b .U.z.1..4....ta.=s.{.=o.....T .t......._...3...Gb.

                                                                                          C:\Users\user\Downloads\VLZDGUKUTZ.jpg.bzZI (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8571563303905805
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:9Vx0bKSVCuPgor7KLbwErtcwGu491752/eVXheBVyOlOzp+d9xHH:9nDSHr7W8MfGui17M/IXheBVNI4vh
                                                                                          MD5:8D80EE4E26DC61F317C780216376AB72
                                                                                          SHA1:379D73E513903DE8C8F705450D4012A39A0E16FC
                                                                                          SHA-256:021B125B056F24AF9C5127858C0D88D0C3D74C915DCCB5CDE555AD889BA2475B
                                                                                          SHA-512:268532BCD4DF545D8CAA65C45E331EBCA27380CB82981735D2139BB0482E12B1A38F08C43C66AFCFFDDDAF10D41A3A89A1512AFBD5D1B956AB7DDC0BD9AB4D2D
                                                                                          Malicious:false
                                                                                          Preview:...L..,.>+..Y{s.UK.C.).z...sc...K.V..F..~I.t<..dJ. ..cD.....6......e.a.uS.+.ay.w.I...w...t}.5:..H......0....].,W....Jp..\.`..."nu}}b.i....*}P..93.8..w%T#).kAzn.;..)c@.D..#f..<..S...T..*......A.mB.....JD...]...gNtN..9.B.)...']...Z.<&....PK.`.7Q[..H..T..+.d..1...l.c.....f.....^..{.Bl.2.!g...^.5.G..w8.%C.....#J'.....5R.@.<.....r....?.f.dXe..9 <..i.e..Q.....,...... .@...4.v...B.3S.IP.j-.oH.....3....@...z.b-.&.d..Y|'.+'..,J..u._%%.W...\...S....@.!.Y.+.hN..A.q.0.............V..9e.!..Z,.s...].c..j"#X.*..#Rd..Q..:.....Vi.J....<....3.?.4X.N+.i.4....`....`5..k..)-.......O.b...t..1...`.G...].jI.H.b....{.0........N.m...r...,...*.&....:^...6...r7..rEl.#...K.I7x(.+..H....C.._.c7._!.~..F..O>.A....L....z.UP...../M+.[...g..I.d.+<vp.A~'....U.....r..!..5..[t...zR.....y..[..<..vD.2.$..m-...+....Nf.)....1D=#....UI.!?.8....m.m..~.....Em0,..5..<.......#...#.).....}.....%t..?..M...77~.b.9.1...Hq._-.KF..L.b .U.z.1..4....ta.=s.{.=o.....T .t......._...3...Gb.

                                                                                          C:\Users\user\Downloads\VLZDGUKUTZ.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.854721812255258
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:8VwxTlGR2bZ9fOKh9rkcUNrRUd0W31d6+GcPlAiG0jEFB2Y+gIRbS4N21LcYXj7E:zxZGRcfdhCc0rRUV/GMEFB2weS4N27X8
                                                                                          MD5:0CA9C8A08CC3F1D1B03B18313D32811F
                                                                                          SHA1:680939B7AC2CC79D81B5B1A36855B464B0C48F32
                                                                                          SHA-256:CD5ADC9CC4CFB390AA3E62887B4A3FA7D824C411FDAFA61EBC3CBBB83D753976
                                                                                          SHA-512:FD90E75A422FF9907EA918AC2B97733EC7BF6BA08C95465CEB07F157EBB8323AFF6FB2974325222A56A6B87A9A4B6E1BDEB5295C191742046CF0AEE99C0C27AE
                                                                                          Malicious:false
                                                                                          Preview:B...t.QC?b...L...A..=,".._X^|k...Z......".n.;<.3.n.i...)........6.,y2.....v.2..vlXE....;.W..v...c.....G.+....Imw8....IG.%..=1.W....j..a.1a.J.e...L.;%..B.....].\AT...#...+.....:.i...:........K."!@.I.%...L...K....m.Z..i.P.@L;Ib...?.z...2..8<*.S~i.O...$H.......b#.m...V%.....O.S.xfB.......:........X>.el.a.Ma.e.p."......&.~....9.|T9.u..T....w..!..5&..HLE.E..MY.g.a......IH.Jc..m...n....7...s...W.A.q..l.3d..$...)..e.3.....%..9{.........."..C../.{.>.1t.....@.9.#...?)..qn...]m..J.'&.p.....J.o....H.]xf....g.D.A YZk0...$...BZ{. ....c.-.7.X:&...R.n..{;......<q._....?..0)..].JM.f.&.v@..(...n..(T;...~.xbR;....'..0.Ju4=...\.Ce..|.].O%...b.0...O....... .G.z....Xa.KC....y.........+...;..|...1A..1s...$.2...C..i.z.o..dF..2.i.Zs&..xVK|..6..b....,.C&...6.z..;2.HB(....E..F|M.)...@...;cx.....7.~. O4.xy.3Y.. ....)t%.4."..c.zE%...D.V..}...5.0..<...../.@o.?..z7.X..R..h.,...WP..oeb.k'.......r...A0^Kz. ...d..zK..L..y....)uf%.:..`.od~..]`../.!..t.B

                                                                                          C:\Users\user\Downloads\VLZDGUKUTZ.xlsx.NtvW (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.854721812255258
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:8VwxTlGR2bZ9fOKh9rkcUNrRUd0W31d6+GcPlAiG0jEFB2Y+gIRbS4N21LcYXj7E:zxZGRcfdhCc0rRUV/GMEFB2weS4N27X8
                                                                                          MD5:0CA9C8A08CC3F1D1B03B18313D32811F
                                                                                          SHA1:680939B7AC2CC79D81B5B1A36855B464B0C48F32
                                                                                          SHA-256:CD5ADC9CC4CFB390AA3E62887B4A3FA7D824C411FDAFA61EBC3CBBB83D753976
                                                                                          SHA-512:FD90E75A422FF9907EA918AC2B97733EC7BF6BA08C95465CEB07F157EBB8323AFF6FB2974325222A56A6B87A9A4B6E1BDEB5295C191742046CF0AEE99C0C27AE
                                                                                          Malicious:false
                                                                                          Preview:B...t.QC?b...L...A..=,".._X^|k...Z......".n.;<.3.n.i...)........6.,y2.....v.2..vlXE....;.W..v...c.....G.+....Imw8....IG.%..=1.W....j..a.1a.J.e...L.;%..B.....].\AT...#...+.....:.i...:........K."!@.I.%...L...K....m.Z..i.P.@L;Ib...?.z...2..8<*.S~i.O...$H.......b#.m...V%.....O.S.xfB.......:........X>.el.a.Ma.e.p."......&.~....9.|T9.u..T....w..!..5&..HLE.E..MY.g.a......IH.Jc..m...n....7...s...W.A.q..l.3d..$...)..e.3.....%..9{.........."..C../.{.>.1t.....@.9.#...?)..qn...]m..J.'&.p.....J.o....H.]xf....g.D.A YZk0...$...BZ{. ....c.-.7.X:&...R.n..{;......<q._....?..0)..].JM.f.&.v@..(...n..(T;...~.xbR;....'..0.Ju4=...\.Ce..|.].O%...b.0...O....... .G.z....Xa.KC....y.........+...;..|...1A..1s...$.2...C..i.z.o..dF..2.i.Zs&..xVK|..6..b....,.C&...6.z..;2.HB(....E..F|M.)...@...;cx.....7.~. O4.xy.3Y.. ....)t%.4."..c.zE%...D.V..}...5.0..<...../.@o.?..z7.X..R..h.,...WP..oeb.k'.......r...A0^Kz. ...d..zK..L..y....)uf%.:..`.od~..]`../.!..t.B

                                                                                          C:\Users\user\Downloads\XZXHAVGRAG.docx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8626365528303
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:oUy6Syo5/kfJsgQSSsQwijRwxtFgP90HmxaWuufyZAg1vmR2:oXJo+wowXGgmxaWrf+l1vm8
                                                                                          MD5:24459A0AC7A8455329C2DE8C0742B77D
                                                                                          SHA1:FB0359475DDCEB3F812F618FA705C526BB109AEE
                                                                                          SHA-256:4A8DEA39C6B73B71E39519E38426D6B2EA55AED6877A9910E599BACDB7B66393
                                                                                          SHA-512:0E26C77188A230BB7E57583CE31AC6E19BCB60EEFB473BC693DEBF68A8D8C8391FC4E5C38CADE94C7B2BA4357DC7C13D807D22DDA44C1CF7C4EAF54CE3B750D9
                                                                                          Malicious:false
                                                                                          Preview:...s.Z.5!'.d_.[#......A..,.kV.50d...*.n.(.qIk.......5..m.: )..'.4{.....+....i..<^...<3...)k.K*..y..6|.....;...v..i..#<.~O..@...?.w.....z....&......+(....M^....2......Z....!...{g......CW%......-.hSty.=..s.X[../...<..<..!...)PF.....6..Y.dj..LP.J..p~y:+......t.%e..=..-...S7..# .qm.....U.E..&...J.o2..."..d.....-.=.#k.h......l\1.E....9.+.G...y.@....J....V.B......zH"8..a..d~0.....2.h'.7.Z^*.......09..m.G....k.b~..x..!M..h.3.-.T.......@..~...^8P...f.m.#.?.l.!.....^HX...HR.pE...T"...xo....Jav/..'...zC28I;.f.\.....n...sK..#.r.W.H...g..q.rvx..\s:..sy&...XP.b.By......m.....VDR..[............n...\ .y....;M...^.....W..*..."..)Tm},.8h.).......C...)Q...b...>..n[..}.............G.....8...o1X.......'.|X8_......s..}._...\..Jl1..g..Z...jIn.|.9..d..@I..1....w9]@.+.[..o......-.`$E..gPP.-....V-....h.K.<..l:.T...=.......K...K....%.w.F..s.P.Y.O@T..i.H.....~...+Z...s.....{..._.k.\r.r..;.....,....hV.{....1....l......A".+<.........,e.D .8.G...F.

                                                                                          C:\Users\user\Downloads\XZXHAVGRAG.docx.CFkt (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.8626365528303
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:oUy6Syo5/kfJsgQSSsQwijRwxtFgP90HmxaWuufyZAg1vmR2:oXJo+wowXGgmxaWrf+l1vm8
                                                                                          MD5:24459A0AC7A8455329C2DE8C0742B77D
                                                                                          SHA1:FB0359475DDCEB3F812F618FA705C526BB109AEE
                                                                                          SHA-256:4A8DEA39C6B73B71E39519E38426D6B2EA55AED6877A9910E599BACDB7B66393
                                                                                          SHA-512:0E26C77188A230BB7E57583CE31AC6E19BCB60EEFB473BC693DEBF68A8D8C8391FC4E5C38CADE94C7B2BA4357DC7C13D807D22DDA44C1CF7C4EAF54CE3B750D9
                                                                                          Malicious:false
                                                                                          Preview:...s.Z.5!'.d_.[#......A..,.kV.50d...*.n.(.qIk.......5..m.: )..'.4{.....+....i..<^...<3...)k.K*..y..6|.....;...v..i..#<.~O..@...?.w.....z....&......+(....M^....2......Z....!...{g......CW%......-.hSty.=..s.X[../...<..<..!...)PF.....6..Y.dj..LP.J..p~y:+......t.%e..=..-...S7..# .qm.....U.E..&...J.o2..."..d.....-.=.#k.h......l\1.E....9.+.G...y.@....J....V.B......zH"8..a..d~0.....2.h'.7.Z^*.......09..m.G....k.b~..x..!M..h.3.-.T.......@..~...^8P...f.m.#.?.l.!.....^HX...HR.pE...T"...xo....Jav/..'...zC28I;.f.\.....n...sK..#.r.W.H...g..q.rvx..\s:..sy&...XP.b.By......m.....VDR..[............n...\ .y....;M...^.....W..*..."..)Tm},.8h.).......C...)Q...b...>..n[..}.............G.....8...o1X.......'.|X8_......s..}._...\..Jl1..g..Z...jIn.|.9..d..@I..1....w9]@.+.[..o......-.`$E..gPP.-....V-....h.K.<..l:.T...=.......K...K....%.w.F..s.P.Y.O@T..i.H.....~...+Z...s.....{..._.k.\r.r..;.....,....hV.{....1....l......A".+<.........,e.D .8.G...F.

                                                                                          C:\Users\user\Downloads\XZXHAVGRAG.xlsx

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.846461302300468
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:cD6NnrvWBxr9AJ4BTnT3H2tC5TmFpansVcOG9MUBgcmI0iJZ7R:cD6Nni/A6TnTMCQFpasV/G9MimiJhR
                                                                                          MD5:7B2B79BD6205DCD7869D81300DC4AAFF
                                                                                          SHA1:C34F894887E9D40B6CBFA4BF39222327CE04443D
                                                                                          SHA-256:5AE40F90E8256BE3D96601FA622BF977D2B7B7163D9DAC9F6CEB6CDFF13F3CE7
                                                                                          SHA-512:205A4580A852D64957973092040699E500FFBD1775BCDBE8E892D5932B4CCAD555CAAC71E343890A9E4206D0004E0707D39AA70E359341CAAE3ACFBE70A8AC7C
                                                                                          Malicious:false
                                                                                          Preview:.[.m'/OdZ... z]...}F:.Aob..{].&....=A...B..J.;x....5g...WR,:..{...?....@.X.y..W.._..@.w.x.Vpd......=...3.y^y.....A.....=..v..W..V.....V^.....~".Z..T[.y....yH.D.......J.......N..<.........kB.....)9..<u.wc.u......WqFl.x]..j.....S..V.j....^..f...v.[....Q.!q..|.&..Wb. ....8).j.>..u.}O.!op..t2...\.u..K}.*.6.WN.v...Bq.\..k...e........~.iuy....f..r3......wJ..TI.,(....q..u.......s@l.H2.......(...#,.d...|5..O.T.@(.Lu...$..9..#....R.......3SK.4.<:.Bs....2...{FdP@%.S(-..s.`...JM.#...............4.O.Y.CU....;..:5........<$..X.<.u....ye7........K..8.c._.{.......\...Z.'...w.I.2.zL..Hs}5.?..j...T)....`...D.D...\a..2D{.......<..I./...Q..,...+~lO..!..[.f!j,w.x.EF.m>B.%.1...D".....8..8...J....Z...B.Y.Y5.....I*n..o..=.=-.....P.K...o..3.A.#..v........n......s.W.,...j.O....B|7..`..6.....B....D\....V.|E(..,._.r..E./.s.^......(%.R..J.k..E...`!.+a..L.e....C._...:rX.e.D<.Z...|=.k3....|..*.@...F.....!s...!..dD..@J...E..V.i.3Ke~=.=k...4r4nD....!....\......-.Q....H

                                                                                          C:\Users\user\Downloads\XZXHAVGRAG.xlsx.SEXJ (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.846461302300468
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:cD6NnrvWBxr9AJ4BTnT3H2tC5TmFpansVcOG9MUBgcmI0iJZ7R:cD6Nni/A6TnTMCQFpasV/G9MimiJhR
                                                                                          MD5:7B2B79BD6205DCD7869D81300DC4AAFF
                                                                                          SHA1:C34F894887E9D40B6CBFA4BF39222327CE04443D
                                                                                          SHA-256:5AE40F90E8256BE3D96601FA622BF977D2B7B7163D9DAC9F6CEB6CDFF13F3CE7
                                                                                          SHA-512:205A4580A852D64957973092040699E500FFBD1775BCDBE8E892D5932B4CCAD555CAAC71E343890A9E4206D0004E0707D39AA70E359341CAAE3ACFBE70A8AC7C
                                                                                          Malicious:false
                                                                                          Preview:.[.m'/OdZ... z]...}F:.Aob..{].&....=A...B..J.;x....5g...WR,:..{...?....@.X.y..W.._..@.w.x.Vpd......=...3.y^y.....A.....=..v..W..V.....V^.....~".Z..T[.y....yH.D.......J.......N..<.........kB.....)9..<u.wc.u......WqFl.x]..j.....S..V.j....^..f...v.[....Q.!q..|.&..Wb. ....8).j.>..u.}O.!op..t2...\.u..K}.*.6.WN.v...Bq.\..k...e........~.iuy....f..r3......wJ..TI.,(....q..u.......s@l.H2.......(...#,.d...|5..O.T.@(.Lu...$..9..#....R.......3SK.4.<:.Bs....2...{FdP@%.S(-..s.`...JM.#...............4.O.Y.CU....;..:5........<$..X.<.u....ye7........K..8.c._.{.......\...Z.'...w.I.2.zL..Hs}5.?..j...T)....`...D.D...\a..2D{.......<..I./...Q..,...+~lO..!..[.f!j,w.x.EF.m>B.%.1...D".....8..8...J....Z...B.Y.Y5.....I*n..o..=.=-.....P.K...o..3.A.#..v........n......s.W.,...j.O....B|7..`..6.....B....D\....V.|E(..,._.r..E./.s.^......(%.R..J.k..E...`!.+a..L.e....C._...:rX.e.D<.Z...|=.k3....|..*.@...F.....!s...!..dD..@J...E..V.i.3Ke~=.=k...4r4nD....!....\......-.Q....H

                                                                                          C:\Users\user\Downloads\YPSIACHYXW.jpg

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.843424203665852
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:pELD4OOdEkkvAHydS3HIBb4lEfGnlksAu76Wjekftw4wuy4pJW/sS:pELD2dE7vAHKPA4u+mep4w8JbS
                                                                                          MD5:5DB3A23342F6AEC49B70EB7D59A5AEC4
                                                                                          SHA1:BA6838D23B81A37C7FBF02F75BFC92B08354C9FF
                                                                                          SHA-256:1BDECE6A0C911C6DB8DA917B9FDA374825B68EE17446E4361CFAC501B7FC26C0
                                                                                          SHA-512:CB17DD42A5E4FCF1F91389BEA52027DC248522AD5A1A0EFF058DD8FD7B69B941B4EB508FB7E311A6B8E9E4BD17BE4FD8ACC6D38E5DA0B47FC036A63DC0341A28
                                                                                          Malicious:false
                                                                                          Preview:.....J..pB`..+v.j=q..u*..R->....:..X.O>f..H....RQ0......t|...........S..SO.3j....G...V.L.........Jw(....["...fT.pfG........._9<........;....9r...D.?.a.9...o}....i...A.!..)o.:..!.'...b.....F.g.#..]~.....?...O..z...Y...W.P!.V.0c...[...<.>...Hf..*.7.(A...C..z..Tc....r..6.....5"Nv.auu....V.s..^.n...6#"2.]...Tqe.".ZA..V.48.2-:...p.dLKC..?..!.q..f.p.....%.xU...T..I.....3....Xo.?.3.*......;.>....?~..z....^.Z...5..5...M.Y6&....c.i[2..j.......#.....K`p.$2....P.M...oE.[v..h...$.5.*....s..Q||&...%.....B..7...-.]...3......2.2C0x....-y.9...p..F.5...k-.#J.}..x..\&X.$..~.}w.....W%..G......W` .L.7.<..3.g...@...O.I.R..;!...9..7. K....5.........L`C..p.|./O(#5....j@...'..Dau..?..Q.$y,8X..T.p.]=.x.=;^.t.......za.........f.FW.0..a.,.2...* .2.B...Am..iF.y..*....@3...../K.Hm6.H<.z.9*J....;w.......q.....@.,.6.v.+j..v..+.x9....-.....(..+.*.-5R...tyT55b<.3..P..`.X.Q..+...!v..P...T..I..->.......~.L...Z.B.m.V.(j.{t.....b)i...q.._M5...E.*.i..!g=.V.P.kU.Q}.$o..I#Z

                                                                                          C:\Users\user\Downloads\YPSIACHYXW.jpg.BgMi (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Secret Key
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.843424203665852
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:pELD4OOdEkkvAHydS3HIBb4lEfGnlksAu76Wjekftw4wuy4pJW/sS:pELD2dE7vAHKPA4u+mep4w8JbS
                                                                                          MD5:5DB3A23342F6AEC49B70EB7D59A5AEC4
                                                                                          SHA1:BA6838D23B81A37C7FBF02F75BFC92B08354C9FF
                                                                                          SHA-256:1BDECE6A0C911C6DB8DA917B9FDA374825B68EE17446E4361CFAC501B7FC26C0
                                                                                          SHA-512:CB17DD42A5E4FCF1F91389BEA52027DC248522AD5A1A0EFF058DD8FD7B69B941B4EB508FB7E311A6B8E9E4BD17BE4FD8ACC6D38E5DA0B47FC036A63DC0341A28
                                                                                          Malicious:false
                                                                                          Preview:.....J..pB`..+v.j=q..u*..R->....:..X.O>f..H....RQ0......t|...........S..SO.3j....G...V.L.........Jw(....["...fT.pfG........._9<........;....9r...D.?.a.9...o}....i...A.!..)o.:..!.'...b.....F.g.#..]~.....?...O..z...Y...W.P!.V.0c...[...<.>...Hf..*.7.(A...C..z..Tc....r..6.....5"Nv.auu....V.s..^.n...6#"2.]...Tqe.".ZA..V.48.2-:...p.dLKC..?..!.q..f.p.....%.xU...T..I.....3....Xo.?.3.*......;.>....?~..z....^.Z...5..5...M.Y6&....c.i[2..j.......#.....K`p.$2....P.M...oE.[v..h...$.5.*....s..Q||&...%.....B..7...-.]...3......2.2C0x....-y.9...p..F.5...k-.#J.}..x..\&X.$..~.}w.....W%..G......W` .L.7.<..3.g...@...O.I.R..;!...9..7. K....5.........L`C..p.|./O(#5....j@...'..Dau..?..Q.$y,8X..T.p.]=.x.=;^.t.......za.........f.FW.0..a.,.2...* .2.B...Am..iF.y..*....@3...../K.Hm6.H<.z.9*J....;w.......q.....@.,.6.v.+j..v..+.x9....-.....(..+.*.-5R...tyT55b<.3..P..`.X.Q..+...!v..P...T..I..->.......~.L...Z.B.m.V.(j.{t.....b)i...q.._M5...E.*.i..!g=.V.P.kU.Q}.$o..I#Z

                                                                                          C:\Users\user\Downloads\YPSIACHYXW.mp3

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.844338247364076
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:O66Gpf7IcgcUDj///zYB1EoO2uqmzfvmKRcgCaWBy9Phvu4LWv7hb4OnVWGB:d6GVkcC3//9ou26W09PhVYJnVWw
                                                                                          MD5:B2A5AAAC66E574E00B92A1E56D46C9E6
                                                                                          SHA1:98790602BE0FCCC7BCBD054B0BABBFF4CFDBBF09
                                                                                          SHA-256:647EAB431424122680DFE6E5AD61DCC66D7CECCF0D584E803E190B8B86A4F520
                                                                                          SHA-512:543563A24E6F47D1808013E1C6B0A4ED1873E78275D7813C012F251BA8B1CF79A1E30CD87E8F01E9343E9567B34BFD11E856A9BA1FB804399B2B8EEAAA56A93D
                                                                                          Malicious:false
                                                                                          Preview:.k`.S..5=.9.j..N.....w..J..y..Nv.'..;.E9...,07X[.#..#d.n..XWH...A`.......@..!.......K..>^[.X...*...[m.1.K..n....*C_=^...9FK..O...3<.2N..*..t...I...U.-8..D.....\.A...P.l.l...=..3.....+-s..eQ.Q..0.o.I......nx"..G.......z.4L`.Iq.S..U.....8A..h..|B.....F.j.e...\n..sQ....>...Y@....t........_.."....}.*a..../....Ec...Ckxf....r2...........my..S{b.-.>...'.E6...N.9Z+.h.6.#.ah.o[_\Y.q..C8..<....#(.*.....7v\q2y....r}vec...'P.... ..6.....Q..-..|..0..{"e..(........_/z.......Mq .Yf...3..1Ac{..<.?nWr..A...t..IDp.p.%p....(.......S..?x[h....WA..6......1..J.....tu...E..E..yt.~..{..\Q..4....K..j.PP......7.....g.........]G86^]3...8.z ......w.....7.XW..TE......#E..Zz.....{J.T$...<4ZM*..-<..'\.HO..d.x..~@..h...?x..#.1;.>...".@qx..8*>Gl@...*..w.5.._j.....B..?c.8....]}.M.......|.'.\.~..+.....+..b..|..M........h....w*-D..o.P]A..r~#D.6.L|.7...p=...5j4............T..5.:l'$D.c}.-.".L..{...!..%.g...+J0.....j&..G....J.`H-.h...Q..........m....7.FN....ir......73.Z.vtI?:S~

                                                                                          C:\Users\user\Downloads\YPSIACHYXW.mp3.qZmc (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.844338247364076
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:O66Gpf7IcgcUDj///zYB1EoO2uqmzfvmKRcgCaWBy9Phvu4LWv7hb4OnVWGB:d6GVkcC3//9ou26W09PhVYJnVWw
                                                                                          MD5:B2A5AAAC66E574E00B92A1E56D46C9E6
                                                                                          SHA1:98790602BE0FCCC7BCBD054B0BABBFF4CFDBBF09
                                                                                          SHA-256:647EAB431424122680DFE6E5AD61DCC66D7CECCF0D584E803E190B8B86A4F520
                                                                                          SHA-512:543563A24E6F47D1808013E1C6B0A4ED1873E78275D7813C012F251BA8B1CF79A1E30CD87E8F01E9343E9567B34BFD11E856A9BA1FB804399B2B8EEAAA56A93D
                                                                                          Malicious:false
                                                                                          Preview:.k`.S..5=.9.j..N.....w..J..y..Nv.'..;.E9...,07X[.#..#d.n..XWH...A`.......@..!.......K..>^[.X...*...[m.1.K..n....*C_=^...9FK..O...3<.2N..*..t...I...U.-8..D.....\.A...P.l.l...=..3.....+-s..eQ.Q..0.o.I......nx"..G.......z.4L`.Iq.S..U.....8A..h..|B.....F.j.e...\n..sQ....>...Y@....t........_.."....}.*a..../....Ec...Ckxf....r2...........my..S{b.-.>...'.E6...N.9Z+.h.6.#.ah.o[_\Y.q..C8..<....#(.*.....7v\q2y....r}vec...'P.... ..6.....Q..-..|..0..{"e..(........_/z.......Mq .Yf...3..1Ac{..<.?nWr..A...t..IDp.p.%p....(.......S..?x[h....WA..6......1..J.....tu...E..E..yt.~..{..\Q..4....K..j.PP......7.....g.........]G86^]3...8.z ......w.....7.XW..TE......#E..Zz.....{J.T$...<4ZM*..-<..'\.HO..d.x..~@..h...?x..#.1;.>...".@qx..8*>Gl@...*..w.5.._j.....B..?c.8....]}.M.......|.'.\.~..+.....+..b..|..M........h....w*-D..o.P]A..r~#D.6.L|.7...p=...5j4............T..5.:l'$D.c}.-.".L..{...!..%.g...+J0.....j&..G....J.`H-.h...Q..........m....7.FN....ir......73.Z.vtI?:S~

                                                                                          C:\Users\user\Downloads\ZBEDCJPBEY.png

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.847340033212312
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:6+11oAX8aboKXNU0IAQORHD3fgSjQi8RfQ5dTH5SQOGNx5H+yUMhbaDj0qw:joAMaBXO6D3omEAdD5rN/HWMaw
                                                                                          MD5:8F2398395352B2EB2FB79C748918E3B9
                                                                                          SHA1:7B6523040976615A2C0D8342968B44746AADA4FB
                                                                                          SHA-256:9ED0A75CB88CFA1F4F078B6287CA3B08556564324F68279E2037D7F0D1B24334
                                                                                          SHA-512:4F86BAB7AD156920B1CC4E40487F17F1DD7AC5FF00CCE5618F9BFC90F9326768C89B68226D9B706ADC86BF43780FB28E65D7D0116470BC1D39F6F7B05959D702
                                                                                          Malicious:false
                                                                                          Preview:.{}jW....4..<.h..YG.T.\.....@c...\Ek.7...6.........T._..9M..<.G.n$...]..C.k.R...P..aAi.ewu...]e.4b2.M.8.9.}(8.Ve...m/#......b.T.....{~G..gx.?...2.G...x...F...J......j...'.4.....d.>...........Tx..(...[J..Q).+\`....#m.Hz8x?.^u../...u^x!z.%..L.6.Y..Z...c...3..'.62.0.(6kk..U..p#.Z&*.R%..@(.G..E.>_..3..............a..a...d.L.VGB...n.!.^....@.V....xWV..a.G..f.Z.gJld.B...I.d.g(e>.."~...6N.m..?2,.4.LO.x.a..-...a...J".|.2..5N....n....0.dg=~>.1..X.4.D..#.7z7....H.<..t...1..f..|...u...u.L.q.&....:...c.._...>U...v.c`M....f.......?..7+b.&.]9~*.d.. .w...F-.......t......s.v+.z.....q.I 3..L...|u.f..4Z.....l....H7...!S......,...@k<../.l.O.e._./.Ky.....[..}..m. ...................NO..`C..g.....(x...<.9<.......F.h3q.l.E9......6.."..K..Vp.L=&D...X..._X..$.=5.%~rz..S.i.I.bH..!6W.W.).[o..o`..w..+<..*6.v...`..}.a`_+..Q..'W...D.t<.J....=..$q...B.N*-..M.j.*A..Y..1.U.X.#...:....m..@.m..)..1.Az}.E&k..C...].y..."...Q.m.l........i.."..4.....C.`..N..`.6%...x ....(

                                                                                          C:\Users\user\Downloads\ZBEDCJPBEY.png.UZoq (copy)

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1292
                                                                                          Entropy (8bit):7.847340033212312
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:6+11oAX8aboKXNU0IAQORHD3fgSjQi8RfQ5dTH5SQOGNx5H+yUMhbaDj0qw:joAMaBXO6D3omEAdD5rN/HWMaw
                                                                                          MD5:8F2398395352B2EB2FB79C748918E3B9
                                                                                          SHA1:7B6523040976615A2C0D8342968B44746AADA4FB
                                                                                          SHA-256:9ED0A75CB88CFA1F4F078B6287CA3B08556564324F68279E2037D7F0D1B24334
                                                                                          SHA-512:4F86BAB7AD156920B1CC4E40487F17F1DD7AC5FF00CCE5618F9BFC90F9326768C89B68226D9B706ADC86BF43780FB28E65D7D0116470BC1D39F6F7B05959D702
                                                                                          Malicious:false
                                                                                          Preview:.{}jW....4..<.h..YG.T.\.....@c...\Ek.7...6.........T._..9M..<.G.n$...]..C.k.R...P..aAi.ewu...]e.4b2.M.8.9.}(8.Ve...m/#......b.T.....{~G..gx.?...2.G...x...F...J......j...'.4.....d.>...........Tx..(...[J..Q).+\`....#m.Hz8x?.^u../...u^x!z.%..L.6.Y..Z...c...3..'.62.0.(6kk..U..p#.Z&*.R%..@(.G..E.>_..3..............a..a...d.L.VGB...n.!.^....@.V....xWV..a.G..f.Z.gJld.B...I.d.g(e>.."~...6N.m..?2,.4.LO.x.a..-...a...J".|.2..5N....n....0.dg=~>.1..X.4.D..#.7z7....H.<..t...1..f..|...u...u.L.q.&....:...c.._...>U...v.c`M....f.......?..7+b.&.]9~*.d.. .w...F-.......t......s.v+.z.....q.I 3..L...|u.f..4Z.....l....H7...!S......,...@k<../.l.O.e._./.Ky.....[..}..m. ...................NO..`C..g.....(x...<.9<.......F.h3q.l.E9......6.."..K..Vp.L=&D...X..._X..$.=5.%~rz..S.i.I.bH..!6W.W.).[o..o`..w..+<..*6.v...`..}.a`_+..Q..'W...D.t<.J....=..$q...B.N*-..M.j.*A..Y..1.U.X.#...:....m..@.m..)..1.Az}.E&k..C...].y..."...Q.m.l........i.."..4.....C.`..N..`.6%...x ....(

                                                                                          C:\Users\user\Favorites\Amazon.url

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):377
                                                                                          Entropy (8bit):7.439044396289365
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:ru4B3y7glfjHicGSbLGTzvtkUeX9e84CF6kHrP9uoCSXXEtM32rerMlvENn:rFY7gpjHicFb2BkUp84CF6c9zCSXUtpW
                                                                                          MD5:A08C215FC3B78DD41C6E7887C81C59C6
                                                                                          SHA1:378F97A442A9EBF801A0F0799447054DCC55FBC7
                                                                                          SHA-256:65C44023271058A9971D05CC52640FB615A13398D624A3DF195F6AE9EE0EF303
                                                                                          SHA-512:9EC68F19841CE9937149F4B9553C906511C37C94EA9B8020CB6C8E6C3E05F1FA5DEEA6812ECF2F46D4B4E472C7ACB34713DEEEDA2F198DAA8E74DAB40DC62301
                                                                                          Malicious:false
                                                                                          Preview:...>...N7.#.s.jj.4.........k:j...d>=...c:3Z..47d.H;4F3:...LZ.z...D..+...?r.........k{.x`Gw.amazon.com/....=Ax.G.k...~..oF-...S.s0..`F...B..{]"w...|..T..y@...'.....).E>.sjan...o...!\&...U...".(.m..V..T..B|.'..D...1...{...y*b........c.?..T^i.m'......)C...[&.\.^.....e.pE...8R....X.B/.....%..^.z.}..y.".&)..'(9....H..v...G...>S.=..c._.-..F....tP...N.0xABADCABA

                                                                                          C:\Users\user\Favorites\Bing.url

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):474
                                                                                          Entropy (8bit):7.5567404825469255
                                                                                          Encrypted:false
                                                                                          SSDEEP:12:SsdMz43clmkgGdWV+0T+tnwokZD0LAi0Fhmn:SsKz43clwOWV+02FkKLAi0Fhm
                                                                                          MD5:F11F705F475413B40D6CDEAF5083137A
                                                                                          SHA1:1817D2615590B291BB2FB307C4F219543C5A2E95
                                                                                          SHA-256:39046BE785D0DC5DBDA4949D98DFB813195D3D1540ED836195ACF264F7CA206F
                                                                                          SHA-512:B8CA1689B6EB0AF0CECE791FFDC61F7467749DEE25483E75DBE7885BC97117908B0D8A3817929D75392AB7F7A93CFF3DFF31D23059F0A6B5E1B6C02CA900FB06
                                                                                          Malicious:false
                                                                                          Preview:......F.k.....;.8..n..i....`".....`...g5R...zE.&.b^...xV........K....3C:w...q........=LX!...Xe.?...D./G.4{..e.S..C{ ...W..f..x_..".O..~...2.V>.9....\.q.C.......W.M......y,....c..E...vx0mages\bing.ico....7%d..._.&m.wh.-.g.....kM.@..j.}.$.tf...H...6_.u..R...;.k.G.....n......E.rh;.aJ...T|L.K.6".F..d.LF.....b.....S.......<.{..8G1.....s...0(9.*..2.L.G.]..6Ng.hi.F7.m..4.2qH.).....V...q...S.G.h)....b.h$E..\..|..W.l6..A.t.,....f.,0...C...'Z.5.e....G.F?0xABADCABA

                                                                                          C:\Users\user\Favorites\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Favorites\Facebook.url

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):379
                                                                                          Entropy (8bit):7.38640974539363
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:OgIC/yumoCmVmeguBzDwn3AIlc+2Ett3ATc640Z7cPq9/iak2bioBHVcIuBcjONV:LI4moVVm6zDmD3AQYZ78q1iakloBHV9A
                                                                                          MD5:0659C1A21BFC666838F52A0E0057406A
                                                                                          SHA1:719D207282EAD2AEBBD18D79FD9A1180AE061C56
                                                                                          SHA-256:9D1DE1E0964DAD5160A90E70297D182A44BB1626524D45686A9E4D58F15E2616
                                                                                          SHA-512:35359F70E4CAFAAC16970C4E2DFE3D5157E821A9278B226F6D91DB96F6152A1BF6381F559EAAC314D94F436E83A489B709112422BD1C1878A4A06646F7416775
                                                                                          Malicious:false
                                                                                          Preview:.HQ...H.....iUpb....,Mq....,M.<.%.j{\z]EUP1..x...A.P..bn.6E<I.2a.......+..$.`#..N.l_...&.^f0b..Q..<6...h....H]..Q.kM.k.!.O5..V'..B...w.W...Y.sV.w.X4...5..Y....v{.......J.p....G.X..H.2....iY....b.6;.wz.r...2...v...]^?..(.Hlj...A.....kN.Z.+m.D.A..y.$P).\..r...5..^G.1D[..a.z.......e|#F..A..!6...$P.."u.C...%..7.`.f0.6."Z.=.,.}t._U3....283x.)."t,$.v0..Vl. .0xABADCABA

                                                                                          C:\Users\user\Favorites\Google.url

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):377
                                                                                          Entropy (8bit):7.3804240634774025
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:i5ES9eYrF/iPnguSbOvwKhsGeoIW9Nls0HO6IV/Jx4Gl/Yb3vTGrbYuHn:NiFK/guEODsmpR1IVz4GGb3afHn
                                                                                          MD5:0BCB2EE65401CCDE6A2AA2D680975469
                                                                                          SHA1:7C842BCEEB7219692FBCC8D0D3DCEA1889D8FF03
                                                                                          SHA-256:93A727556396EA2DE0225DE729C2939DEE5DB1E0C1957D00C77AD9D75221F0C1
                                                                                          SHA-512:BA2B2706F01E4B3A61CDA0439F801D4FCCE444BFA1627697807070B0923490A0C500F8C078585336F53EEFC2C77461FC3580B7B836BB9C63937A3FBB47F8CD96
                                                                                          Malicious:false
                                                                                          Preview:..0#.m.TX...G....\..#.ce..L..2.D.7X.~A..7(.".2..|.. ..'...k..}.XZ.Z....p.;..V.4....]......(.w.google.com/...i.....gD.'G.v..EYVgF....!U0..N..-...!...o....U(..e.s.Bi.a>.v.._.s.1.......,.,.'...)._.U...C#s...C\.....-....}../.&..Do.T.(E`..9{T4.M..g"n....o..@TX..D.E.4....v>.t..I&=.0f3...+@l..g...?..'..!..U..bx..!.O8.....~..qv.vk?N;.E3&../..........b0xABADCABA

                                                                                          C:\Users\user\Favorites\Links\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Favorites\Live.url

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):375
                                                                                          Entropy (8bit):7.390854812200369
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:stKvpHZvycaui8p6bFwCbH+9UKUtutckNeoP9cZNZvipXOd7/Ff+rTI2n:55KrCp6h5bHEmtutcFw9cZfS+dVCM2n
                                                                                          MD5:F0FEFE44A0EA992187EAAE565B4B8121
                                                                                          SHA1:8A7A6BDB95E28073B40D0ED3AB5E6182AF9D53BB
                                                                                          SHA-256:5B7F9DE38BE250EDF9A64E5C1581B0707D22C54D420F4217DA9BB9CC00063CC4
                                                                                          SHA-512:7A278620CE9FFAB75829968BE3091B20A52B2580585754EAE53A9A20EC0DD534DEFF8D3A804DCD6C8379D6E3BC7FD03DF26716247A2F3D1909C2886B08B0BD8A
                                                                                          Malicious:false
                                                                                          Preview:...5{jO.}..,3.1V8.....j.'.,.JC..N..H.E1..x...mm. ^.k.=....x&I..c.34...[..ui...!N.....H..Lw.live.com/...i..m@..=O...d..o.l......k..l...x.Y...".4.s|..i..~s....O#.^.zXo.lnX.!...%.$P......0..l.F@v.....0..o.&.]p.1..~._..<..'-.F.~..,.../...JE;.r..._..$...k..F..76..dI`.!].9..F..Lj.v..........M....2Z*._....MP:P...7.}.........7..1r 4.T..if......v..hv.s*0xABADCABA

                                                                                          C:\Users\user\Favorites\NYTimes.url

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):378
                                                                                          Entropy (8bit):7.435544705801139
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:Pn0s5eyKPNHGz9vcQTR1fWePbaNzeURXtDG9dNe3Q4uobqpZQCoQLYkBn:v0scyaNHGz9FtpWePmzeWtKle3QTjpKY
                                                                                          MD5:55B1644394115E0ACA570D42B9B263B6
                                                                                          SHA1:3BA0F2FD85DC6A2705ECFA495FF037693A427060
                                                                                          SHA-256:F30ABECF531BD57DB0C51D59C3991426421A703345357ADE8AE4C7AEF961CD30
                                                                                          SHA-512:54078BDF6C9DF3C75BED542800D22A499115D9C8DF3CB9A7F1FAB319B52C97E4476FBB77643449F6CD31DB88E83AE6B373AD8F3FA3416FD062C0AC10566CFAFA
                                                                                          Malicious:false
                                                                                          Preview:..*HZ.v. ...uc...O.?...........9d..h...A..B.g.u...k(+>8..!;6i~..R.3....c.v..+[iv.&S...F.7j}w.nytimes.com/...~A.....i.1...l.."!.9.L_..^.TT....b.h..V...o..`....\..d~N....P.M.F.QG.x.R@...!.+v.=w.@.4/...p]..&.p.7mL!~..o.8.=.TI*..{..@i..N..=j..+..~".=.p}H..E.....P...%~.:;..S|t...0`o....*..Y.&#[*...c.l...%.Yw...T..}.....Ti...f(....f/.4Lz.R<.}.......Tp.0xABADCABA

                                                                                          C:\Users\user\Favorites\Reddit.url

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):377
                                                                                          Entropy (8bit):7.425987556763628
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:8b1HIylMa3XCiwA+h6z27qx7KB9mbIcqDK2vMr2ady5IAG5qqKNXqYV6TtvbZ9x+:8pNM8XCrqz27E7K85aq2ady5IpqquXqS
                                                                                          MD5:C4A38FE4DB8EB16F5E93C07726B18C85
                                                                                          SHA1:6F5E082784C7BE66768B9A0C454AF3B81E28B49F
                                                                                          SHA-256:872486452D01A7E95EEEF7D503231189868AA2430B3FD74402121CD4D5E37BDE
                                                                                          SHA-512:762BDCD0FFF78C8AFD4D1DB24957F69334D803DB3E14ADA146D7C9A072C1CA829B7AFE4E08A574A939EF36FCE4EDF2DE8A40240513F8DA427CEB460732271BD2
                                                                                          Malicious:false
                                                                                          Preview:.a..eA0........7.$.b[)p..W...h....C.RV.Gv....m..C\......&i5H..7....-l..~....h.*X...v~...Q..&w.reddit.com/..,.v.6.'.e..E[..?.8...K.....0>.....?......\..v.Aa^.....].}@.x...._s.....[.5.*...@..#..+....;.....$..R..%\.X...k....#.>.+m^9.,M...o.`.t.V..Ei..9..A..q..h.{7.N.cu?/s.2..6.r.6e.....)W..;.....JS.yR... ..8......3..z.}..9.2..~|.4#.d...E..gz.PoTY..y-0xABADCABA

                                                                                          C:\Users\user\Favorites\Twitter.url

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):378
                                                                                          Entropy (8bit):7.441382817164948
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:51VsbgEodM6XMXgy5ubk8HVMKhG38+dmQ61oCFez9JqCMut09Kz01rSn:51VsXiqXgC86J1dmF1oCFezDqCM20M0I
                                                                                          MD5:622B87DF92C15264FE569AC663BB9725
                                                                                          SHA1:6ED97D116098CCD1514FF1085D3038F444C36921
                                                                                          SHA-256:4CB07D205E7EC6AFD330EBC395C90B47806867D0F12125E87A99BBB17AC00A8B
                                                                                          SHA-512:1AF17BC9488F93C9B26B54E049E98384CBE98513DA96F30E1B90F6D01F98929B965C7F0AC1072B49F3BF2749AC058E1C83183D00C565597DBA5C9826CCB5DEFF
                                                                                          Malicious:false
                                                                                          Preview:u.D.......S...h...=...H-...@.X.......xo.#.......;,..6T....O..B.).Ce.w-.}#......<.u...........\w.twitter.com/....5.Aj.Q{.JH.....~.y-.v^<Eg...h.<y.u....|..".G|+1.A\......i..c.I\a..a...a...OM..8...[......78..... 5..W..\d.w....`..}.....N...&.....[...@. k.iJ..\..._.;1pt6.eY&.t....M.O.bY\>{?.......*\]..)..XR.aPp..N6,.t{.0....RIP._.D;.x%.t.L@.)........).L.S9d.b^>..0xABADCABA

                                                                                          C:\Users\user\Favorites\Wikipedia.url

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):380
                                                                                          Entropy (8bit):7.3106416877785545
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:fOcFqmAUmjDgNW5UjNx0WEG1eL0h6UlNc4xIaBistDUIs9OM36zQQVbR12UZe9al:fOcFqbnj5UjN92pUMTctDzM3AQM6UZe4
                                                                                          MD5:D723A146AE321270BEF059DA72BDE9F0
                                                                                          SHA1:B2FFEE9434C4459A96328F6BC8250300D494D103
                                                                                          SHA-256:4C5BFEBD45B36934D3377C1E2C56088A2F620F6CDA5C9F8CF27536A961F225C3
                                                                                          SHA-512:63ACB7C42A2CB47E0FC2034CC77ECE64ACB3DE9494A03DF5176EE82F81EC3E5A2BFE4F83F29A75B8BDC577141B24F2450821384A99341A149521C19F1B8684EF
                                                                                          Malicious:false
                                                                                          Preview:.. .\.[...J<<...}0..a+.0.......i.-.......P.X.W..:B......4:...2A........w.[..K.cT5k.l...O..."~...0.-!..]+.of>...*....-...C..\#f.mc.p....+....~.7...<c..b.p9....DXo....=8,..d|>c.c.B. .5............#.p@.3`.(.(O`.Uyl..<..b..Oj.{E...}Pe..(..b....nA.4"`..$..:b..J......G.>.i.......i.1x#..703..l.d...@..#.R....P...m...(_.....*..$H......6.*...6....WR.Q...m...R..0xABADCABA

                                                                                          C:\Users\user\Favorites\Youtube.url

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):378
                                                                                          Entropy (8bit):7.393685870131824
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:/t2ZEJzuj8c0AIWLInG/vWrb1s57IYZuld/cPVV6OQog9IGnC1QvzmSv5kav+xvn:18EJnc0+LQG/Eb1m7lZ6cVV6XoymSmS6
                                                                                          MD5:E01A3F522DBAC91718A7EFDDBB53282E
                                                                                          SHA1:1E43D3F15E02F6CA996BBE742D03CC04E3E9A867
                                                                                          SHA-256:F5487D88841A3ED407BCE4E238F32085B0484244CE09A7C9FB8E44FEB5D0EF84
                                                                                          SHA-512:B9117845F500D17BC247E84BB30EFB4C0FDE21F2D745FDA6D4D3177577DF5F402D49CF5623FF036771CE6C6DD28BDA827B569D6E13F92DC0D2275CAF5BDB94CD
                                                                                          Malicious:false
                                                                                          Preview:.....s<A.3.*x.. ....Qj...5....^T9F#|.V..k;........h.!0&._r.q/.]p)....i.?.......V...V.im."B!w.youtube.com/.....f\'.....[."w....:3......&,.....[.Z4..'./RY...e..`...oz].......9.k.6.k...8.....yA..i.. .8.......\.P]...s..>hV..!...U..s......J.V...5..J..x.*.@.6...fzXpv.b..^%*..g4....j.._C......5..._Z......kT....._...m@..*z.W...,.*.+h.4Y9.<.N..5w.>.8..`;.|.0xABADCABA

                                                                                          C:\Users\user\Links\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Music\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\NTUSER.DAT.Alka

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):266
                                                                                          Entropy (8bit):7.225702396026026
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:ZLC9giDcepTFRK0F5dRGjW/0d32UcBQlve/B5NHdeXOSn:JC9giD5/hGWYmUcK1enIn
                                                                                          MD5:EBDCDCD2DCE89375AA3FFCE2426E390A
                                                                                          SHA1:1DE6E759EF42067EDB5A8D770945167B6B3A7A96
                                                                                          SHA-256:06754E852685C0AC74639DE870F1B9A035E2C824B259A66154EC11D8D2605024
                                                                                          SHA-512:1F927FE52DDEDFA542B9680D9F0F24C7E3E9A5E77DA428D4534050C9A3586D553B7FB661A3CE73D203D0F31D3A6D1D685F9E2DCF8A7D4869E813B23D0D02F7DC
                                                                                          Malicious:false
                                                                                          Preview:...%)...D.7...$.c..:...k.....&.:Y.x...@.E/.....1.6...}...2.^.(.......S..9.n.}(4.z...sK.S9.$:..&?.bd.....`}.....j;>Yv..g.K......F...|3.O'...d..=:\..iq9.T...e....;(...%...c..r@#...4<w.P.pi......5.....tg.s#...^m.fE&..H..G.Q.P+..6M.T...Q.p.....".....0xABADCABA

                                                                                          C:\Users\user\NTUSER.DAT.OuTv

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):266
                                                                                          Entropy (8bit):7.129278559590892
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:y0jRqTNpLvWw9n/9zUab5wqiQxnVBnvw7xaWjLSn:y0m3J9nNbOEnXv0djLSn
                                                                                          MD5:86A720803AF23B62D34C1F7D8333B515
                                                                                          SHA1:A5383870F2DA3A0215C180B76FF29A57F92DCE6E
                                                                                          SHA-256:B4F7F7DE85410FB281E0C19BE4B9DEDA9FA84B227B6275129862E3D86EA6BD24
                                                                                          SHA-512:4326C3304CA9B2E0CFE3324B7E343ECA89EEE50092ACA6F4D21115718D06713311F2590A640220B6BBABC34BC8290B558F9F4601AD245C7203F93529D7524B1B
                                                                                          Malicious:false
                                                                                          Preview:P$.X..UL..{OW..;.\..uH.ri0O....$..w......H..<.d.s.A./.L........a.....f.6X....a....W....5[z..+S.z.......v..q7.....M#..H..#%r.EO..Q.Vo.._.Y*.H.....%..0~.f...H....W}..~..[..6..]..#.k......Y.C3..*B.}a..%.....$...;jM&.[[....&...s&....n.......r0xABADCABA

                                                                                          C:\Users\user\NTUSER.DAT.nwFb

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):266
                                                                                          Entropy (8bit):7.2655147661981445
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:ovutQo35ns5vXwSBg7IeQMVHa9CGXvxmqLcwT3zEOqn:y1PvRB1eQCHa9wkcwvEOqn
                                                                                          MD5:D0018D3A63A6F431A759E2E1F948AD90
                                                                                          SHA1:CD2E4174DF98F1F433C2E821A11E7B14101D87C4
                                                                                          SHA-256:2A09CFC09DE9F08A6EE6B696EFA4C1942B2968CE3E20835119AC4B16D8B7F13A
                                                                                          SHA-512:E1ED6221311AEB8C189E8E375D4776EFBBDF3411A2A2D9759E297D42D664BE174AE041D9E83F05A34AD958ADDE053B15DFD9ABEFAAC8C79F05A253DF80F77F20
                                                                                          Malicious:false
                                                                                          Preview:a.[......^.bY...=I....D.....|n..$..Q[.Y.$N...F..Y+.d....kRkA....R&.5..]..`.q;p....@..L.J.....Ef...|.-...>..R..:..m..-.{5...?...L...J....c..A..r.......S.7.2f......".?(..p.n..v.6.. ......>.....W.Q:<..z.......)f.3..&p+S.3...[i.Z.o...4.t.M....0xABADCABA

                                                                                          C:\Users\user\NTUSER.DAT.uaOw

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):266
                                                                                          Entropy (8bit):7.126440636650428
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:FL5K0pQsIb6YD/zpekB/D7e0szCTiU4xI0P2avfn:FL5vQD/pekJD7e0CS4W0P2gfn
                                                                                          MD5:56735A334B6CBC6CEE7E4E1C26EC74DC
                                                                                          SHA1:62C87B68633A469432CB8BC9C166124E44D32A6E
                                                                                          SHA-256:541D77D358CE63015ADD075573786A756135232EB5137A6EBB04DA81D43EE8AA
                                                                                          SHA-512:94928D07D2FB75CCF63700D0DC1362CD43621627037785D6B9E097A6A91E70BF9691F01872D116FD90B357891F50CB02F8DE53D77DECB2CC9F560046D3EAD596
                                                                                          Malicious:false
                                                                                          Preview:x.....t..]....x.3.........^.r. .X...g=.Qh.....Z..R:....J.._3..; . .Q..8{.G...{.Z..A<.i..1._..t...d....(...g....nZ2.j..W...O..o..b....C.j.f...H.D.....|?..N..........P=.Z...m.>...d]n.-j.=S...w....-%..........x.......].e\:....[J8W..:.....:MR.p'0xABADCABA

                                                                                          C:\Users\user\OneDrive\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Pictures\Camera Roll\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Pictures\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Pictures\Saved Pictures\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Recent\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Saved Games\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Searches\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):1125
                                                                                          Entropy (8bit):7.820840617777886
                                                                                          Encrypted:false
                                                                                          SSDEEP:24:0GkqmpEzgfAb+kPjGGUg/ZF3TuL7Vnup0vaQaqamTeTO2ZCS:0tpEzmkh1/ZF+ZPaQaqamTSXAS
                                                                                          MD5:82056BCA217BAC1CBDE396AA023405E7
                                                                                          SHA1:33A5084E83291733198D7086BFDA6123816B62A8
                                                                                          SHA-256:A7B857FBADE509CC5C4A0042758477FDBCFE45B4185347C18B454E7019B63964
                                                                                          SHA-512:F364E7CCF16FF33E8D68D1D0BA6BA7AE1C8223D794197D96A79009C9A1971AEDE6B124D1AF7A2B70BC71E92DFB1BA15B8E6C7C519ECC2B3F7F276A3B090424FE
                                                                                          Malicious:false
                                                                                          Preview:....F....|.@.J.. \.#Y..+W.".].8...(..xv.HT.........$l9......On..h....v'.Q.A....?..e..-j...t.....R).Qd*P....`.....F.V...v=D..=.......P&..H...../..=.w._..0$.}`..yO......(......g.}.QCC.O........U..[.n.A.Lq7..<.K..'S....q=P;2...`...73..d.[.L.^...?i....)Z.......{.G..E0..ENz..D.....+..3l.g..*..d..Ye..Pi.KHyKq,3.).>.wx.V'JE....dX...o...;.<..uB........*l.|.z.....s.).JJ&..|...}.z......^Z.......62..B.....`..x....t.o.u...oD.......Q..=.-t.........12.TR.8.....!3d..H....,V....*KB0.G.Zt?.e>a0.=LM.F.'.w..VQ...Bn.,...........x,.&j3_.2...3s.."..9,...O.X......MR-...J$.q.....W..K.T.....K....+[..S........1-.J..e.-e*..[K..{.+...v..d.Z../...BD.....+$T3D8.M..D>...^f..7..0.p.R..aO..$^.Y...2..bV.v....').o...........)C.v>....3N.>]......yS.h.e.&ip...7...C8\.._,...*..}}b'[.+....... ...1....2..4.:nA8.=.s.g.O.u.",@.$H.x.i.o.'.Zescription>.N.)..z.|}q.....q...r{...0W..G.-.5vzz4..._w.A.A.q....0.MH.@.....1..L.m..q.1..".x..u.....C3q.....E.sa,..hM.rV.....f.......".%!.H/....Yy.n...

                                                                                          C:\Users\user\Videos\Decryptfiles.txt

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:ASCII text, with very long lines (3354), with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):4135
                                                                                          Entropy (8bit):4.775456847281065
                                                                                          Encrypted:false
                                                                                          SSDEEP:96:cvNlHaKqE9VKYfpSrTMBfmR5oTNCrMCMGRxTUmu7EPB:Qn6FEnVmjoorrRW8B
                                                                                          MD5:1DED71A6285395655E24462B884B408E
                                                                                          SHA1:499F8D1C895EE0469E47382798BE68F0151C469E
                                                                                          SHA-256:8FA11C40DC8DBEE362C96C879F0B4C5199B32FD7FE8BE464956D15C57D73CB19
                                                                                          SHA-512:09EEB6601AA9BBF085F262BA824E2A6527FD85570A57307558634BED93E3770FD66F723E39B4187C6221E9A005EA902045B3DF897BCF0E7F0A8CE281B6096D50
                                                                                          Malicious:false
                                                                                          Preview:ATTENTION!....Don't worry, you can return your files! ..All your files like photos, videos and other important documents are encrypted with a strong encryption algorithm and unique key...The only method of recovering files is to purchase a decrypt tool and your key...Do not try to recover your files without a decrypt tool, you may damage them making them impossible to recover....we advise you contact us in less than 72 hours, otherwise there is a possibility that your files will never be returned...We will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.....Check your email 'Spam' or 'Junk' folder if you don't get answer within 6 hours.....Contact us..email: edfr789@tutanota.com.. edfr789@tutamail.com....ID :B4CD234FC4C864C8B684E3BBDCB9D8B494C0C4BBC2E542069F1BEF9CB7C4201A4AA214C0C539D0C21330F6714D7D0BFCDD3DF4A56F38B0E55E2AA84CC0CF56982B20D179918E57D2246E71DDAF6FEC56B1EA9F319ED2087AB4A86B8E550D31327C837D1C2B7F6F50ECB51553E

                                                                                          C:\Users\user\_curlrc.gKvy

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):292
                                                                                          Entropy (8bit):7.216427937956277
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:ctCcGTaMZwj2ZC5ZLl2494O3L/BB46Oz161gweATJMxeSn:7TThZC5ZL19NL9Oz1FiMxFn
                                                                                          MD5:4E9D1BE65C766D766D8ABD82B296FA82
                                                                                          SHA1:A8FB109F914DD329187652C16EE4FCD010C4FBD0
                                                                                          SHA-256:D6256569A45946C621ABE9324FA23566BFF32B7CAA290518273F2F7A39D790AF
                                                                                          SHA-512:7C677987984F68E93D965E930487641CD2487462F5A7A58579C8B5E3F127F57DD61F38305AA195EABECDCDF3719A298094E47B2EF0210D5D0AD6E80D3386F516
                                                                                          Malicious:false
                                                                                          Preview:RA..4."..H..;.v...........X....J.jAK.1...vs......U.|.mi{Q.....a..k.&.....d.7I.l..XU.J...b!.=b|...v...h.UY.E.......)Q".....T....Su._(m..%:]2..l.3..f.nL...|7..J..v.o.R>..[f@..E....p...C.....5....e..K..Ol...U.l.../.t......L..eJr.....2.s.....*..T.T4.l..)0!.n..W.\3..HWe..Y.0xABADCABA

                                                                                          C:\Users\user\ntuser.dat.LOG1.FTNG

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):266
                                                                                          Entropy (8bit):7.229388298249132
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:DLAU3nRp8h0JaIh8qGJUWZUu5F3uK6Eo2iCp1xn:z8QhFGJUe15F3uKFo2zn
                                                                                          MD5:DD0F4A09A04D8E96A380A40578500DB6
                                                                                          SHA1:75F94D01C2BF586904C702E98579762B0E7B4B73
                                                                                          SHA-256:FB1E79DA4B4D925AB67110FD1A6EAAEE7CBC176F99A3489175ADA47EE51628FB
                                                                                          SHA-512:92EDB6BAB922EC9529DDF1A3A8DD6F6F69845FA4DDAF96547F04419DFD56D2E3D5D687E9FF9C70D9092065DB48F8895ABC71F9266F4343DC2FD014A24B7BB918
                                                                                          Malicious:false
                                                                                          Preview:.me...f...Aye..4.]o.[x;a._2.u...@.s[j...Ulw..u..P........ .(0q....>.d. .~S.p.*..0.4.m...r..j.pin.J..@....+....)OR....z...OE..]1..u<.\R.}.z...@p[......[.......X.c...F...7...t..-y.<...U./..RQ..nr(Vs.q...+..........hud...}...?.6.@..-......T\.0xABADCABA

                                                                                          C:\Users\user\ntuser.dat.LOG1.TBeD

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):266
                                                                                          Entropy (8bit):7.237902067070523
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:XuGZ+p8Q5i++gDed7Ar3z41O9ljQ0aN5gD4XWwnn:XBQ5n+1Av41O9l6e4mIn
                                                                                          MD5:0EB8C2DDEC85DC16619B2BC1E2E3ED4A
                                                                                          SHA1:6F8C7384AB27AFE6900A8F791BF6443BD5399C7B
                                                                                          SHA-256:E7FB0C5A0F8CB3FF19BCD8682195712AB6860FD287C13C41CFBBC9B5DF11B0CC
                                                                                          SHA-512:57188987A8477D1728BF11C476C67FFD8CA73F3E27310748A2F16A596E6F6D1BAC7BD700724BF7A32E146DBBD0CC1ABD382072A9667207FCC962A0D543B15631
                                                                                          Malicious:false
                                                                                          Preview::p.}. <\.T.]..P...2N..t.@...9..cuL..6(..I.............)v..-.Z..s.,.)..Ot3...eP..<-sR....j......]..//_.6......zJa.....b.`V;... ...dD..}..1..O.c.`..!S.,Y.1T.*...`...t$3.#.>x.....r......v.:.KQ..}...d.P0.&W.....g..c...L.8?...q`.t.....Mf.5.Y%.0xABADCABA

                                                                                          C:\Users\user\ntuser.dat.LOG1.aOSl

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):266
                                                                                          Entropy (8bit):7.173446251176816
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:4B/nP6C18kVnEaGfjBZH+zO23/9wlOrF30t+KI94n:4B/P6C18kVndEH+zOi/9wlOrFkt+pWn
                                                                                          MD5:3C26B0BC70D70445334173C2B7B7F032
                                                                                          SHA1:8C7E0CE1C5FA312B2491342C256220AA714EBCB2
                                                                                          SHA-256:4FC99EA88AB9750D1B2DC2D1C05CC7F1C709D5934D9E8A1CB7BD1707B62D23DD
                                                                                          SHA-512:DA9FD81761F6EEAC5F51E437A818B6EF9A48C31753D7FBCC52CFD47E562A989D359EB553003B78C0298FF533119EB01B6A0CF7EFFB8BD54FA653D546387A8AD4
                                                                                          Malicious:false
                                                                                          Preview:~..i,.).1d.!V.I.s.'...B..R..\..n...........c#..Y.y..Pc...a..Ao.05..[M.....A.....M...f...U..F...c..tBW.%<).A...=S...^...8..z..^......YnG..Y.."......y..6.0..3....[um..2)..$i..a.fo..S...J.r.Pf|$wR...a\.qK..t..Z...>'..HH.1.A9.u.a+...?./.._.-....c.w..0xABADCABA

                                                                                          C:\Users\user\ntuser.dat.LOG1.sDel

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):266
                                                                                          Entropy (8bit):7.223555144172843
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:oZsvLuRol8yjAeZPOJuFlunuXXJuYelGgXO//pl1Tcwn:o66iayjF+uquJuU4oFcwn
                                                                                          MD5:7C18E4EED21169B20D5AE156E34392DA
                                                                                          SHA1:5AC4E3F6C79ABCDD4CE2F13FBA2E2E2C9E1ED4AA
                                                                                          SHA-256:2DFDEBC23AD9FC05124A55FEDFAB6488F121E985EC181415E8AAEC68ED4F4409
                                                                                          SHA-512:E8E0CEB4AC45554A19E5F9E435D1D90D529DFB0246DCE1FB922A1F5E6E9C4AC6FCCE26005CC4C70B65ACFF9C68C243A5B35BF0197418A293FC28DC423AD3C5CA
                                                                                          Malicious:false
                                                                                          Preview:......gDQ..1....%..Q_.. .)v.Km.1 ...v.V...@.z...y.i]........?F0.j...?.?.hJ.1)..)..l...a.R?.....;.H..9.y...].....e~..$.K^C..P..+f..)..H,"+.....]....3......l~)........2....n..._...N:..'t........m.lM...7~....).,....w.>.*.Cr}....O.|..)0xABADCABA

                                                                                          C:\Users\user\ntuser.dat.LOG2.dGQK

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:OpenPGP Public Key
                                                                                          Category:dropped
                                                                                          Size (bytes):266
                                                                                          Entropy (8bit):7.205836935442775
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:cMU4LODRQwCTINDFC8ZHuebWQfVdcjWGJNzJ5WH+Hn:PU4A9NFCIHueaQtGjWIfS2n
                                                                                          MD5:46806FBF1922ED0F1D8B438216B11619
                                                                                          SHA1:7F88EF536C06100BA66C16D98248C96271F68C6A
                                                                                          SHA-256:879C88291710774A4B4875410271CF76A12A4669F470233A347784D0FA059C98
                                                                                          SHA-512:D7091A29ABFA48707276F31C0575BB0FAF06F4400826619213C4F08CACBADD84A08D2B2D48D7C9CAE8E3DA0132C7C17036C040703347110D9E5F590C3A60CE46
                                                                                          Malicious:false
                                                                                          Preview:.T4.'l..[.S...~4....?-.7.zh..9..!y.<...3../..v.m..h.R.W....Z.)...[w.HjY-..Y[RB.........q"@-..T.9b.....t......Y.....@..e.t..6..?../kQ.l\.U..=...$......k..X....6I..J..M.:..A'...@..W`.1Xu#.^..d.U...n.Q.#.*.RnE..,.qc~.m......_.{(.+.<.....%^S..~ "0xABADCABA

                                                                                          C:\Users\user\ntuser.dat.LOG2.fQdX

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):266
                                                                                          Entropy (8bit):7.1715431029562255
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:/BpllfA1qI67CRvbtP1sasvrnXHL05EhC9gn2K4e8VlsEy4imn:ppIqHkx5qY5Is64/lBrnn
                                                                                          MD5:EDEB7DDF9A9375596C98950A5C1CDC9D
                                                                                          SHA1:B5776FC71F53D2EB34064A3D70101C18C3BF1B5B
                                                                                          SHA-256:2A9BE85D0F5C41EAEC3B0CCF8B731432ABD12166091FAA780171A32B500BF23C
                                                                                          SHA-512:D0F4FEBE7E7ED172DB1535425C807E6A3F7261974934ADE2A1E1ED8CD1AB9ABA8812A4A4DF08D4DFA73F53DBE35A1C41CD7A3154A1B165B7BD2D9F7353386F41
                                                                                          Malicious:false
                                                                                          Preview:cA<..yE...o._.k.z.Zc........7...?......r...p.....d...}.........3..U+'...`KmZ^..s........W......n.+..\..C.".u......H.{\VB....A.>.gD,...7..K#%.8..:....#.8.n.J.z"?...t.}Aoe........].6;.0.'U..3..K...vL.>4..g\P..D...cLD..o.._.6|...X..h..e..p...0xABADCABA

                                                                                          C:\Users\user\ntuser.dat.LOG2.qtcN

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):266
                                                                                          Entropy (8bit):7.196099753240587
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:MC6X0oFWSiv0Fea1kg7h4jFdhVBlYTZiSe0hdHn:MC6LFWSiv8F1kUh4j/BlYh5rHn
                                                                                          MD5:50353F033933BF96A87A4A6688E83844
                                                                                          SHA1:E43B8A928E40CBE4C8E2B029FE951232862B831A
                                                                                          SHA-256:2EB1E188FEA78A4574774FD31E52DE2445A3BE62068A4877E4B8E9F8992AC896
                                                                                          SHA-512:B926851D1095477826712CA5E186ED742A69EFC6569466AA1FCA27889559B8E82570AEA0D5E3C52BC3BBF8F6E2EAEF98D1D8DA8270FCFF0E288DC83EF684C3DC
                                                                                          Malicious:false
                                                                                          Preview:i(..V.X....!.....s.i.+02.h..tG...`.......Z....gW..;K..r]J.1..s...@........Z...{.W......c4.....(..X..t.K.r#zu..+}_jc...<.H.5.0.<.{...N);..8i.....\.g.q6..."......_O..!e..:~..).....G.......=U.l..{.?d.H-.n.I...~....5.od,<;R.p._.^.v.No.].w.X.B.....0xABADCABA

                                                                                          C:\Users\user\ntuser.dat.LOG2.ybLY

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:modified
                                                                                          Size (bytes):266
                                                                                          Entropy (8bit):7.262920946890275
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:e7+Lh3r9LaX9DxpC0GY4/9DXqmfCryB0KmLwUwLkSn:dRVqFpCTD6mfCq0KmLwbLkSn
                                                                                          MD5:8AC8BFA13B306D113ACA7E0FE37F6EBD
                                                                                          SHA1:ABC3850D1D959C7FF7532628467DF968786AED7C
                                                                                          SHA-256:AC33640658294F29023953CB216964F95584C620105FA8CFC54C9D3CA550C956
                                                                                          SHA-512:39E1F145101C642D771F97797765D6CDFFDFD079DB4B8D38785E097E7F53FF3BDCFF9E7CF4449BCF6765B166E98E41F1033588349422F86C28D15C4FA08D555C
                                                                                          Malicious:false
                                                                                          Preview:.....f.........7..o./.........E1..L..O..%X^&aOz.F..#.Hu..yF.."d.T....m.S4......g.%.!..('.{3..........M0u....j..cAs`.yC..$.F.];?.g..lW..>o.a.OR.N\Y@..\..Y.N..\.......:....K...T.5..!.....PP...a9MVu.jXMF..D..|.Q'.I}......a..*.KI...7.....r#...k<0xABADCABA

                                                                                          C:\Users\user\ntuser.ini

                                                                                          Download File
                                                                                          Process:C:\Users\user\Desktop\Crawl.exe
                                                                                          File Type:data
                                                                                          Category:dropped
                                                                                          Size (bytes):286
                                                                                          Entropy (8bit):7.28947639619488
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:F1yL45wbX122TvWYWS2dV3RsYtDIOOEL7FIm8IGDQTHYJJviXLYn:FAkwhhTvWRdV6YtUOLFttGAY3Nn
                                                                                          MD5:0C3CBC3CB3FFAB875BA7A9916E6D22C3
                                                                                          SHA1:2DF491B845A546B221B02A6D9659BFAD1C7FB6EE
                                                                                          SHA-256:772F166A6B162F8FD42CB7E6E8009C0CEE9393CEF0A51485533867A15A9ABE1F
                                                                                          SHA-512:20B801369EA8BD0946634CEC12EA75C5544E0FB7ED5BEA62CE60BEF2DD98F97E04C99C1A291250E1E63BF5CADBD70ACC7D2108914926F0113F6C8B4BB7875E04
                                                                                          Malicious:false
                                                                                          Preview:....#....V.......'.N....a.-...&.\.......LA..".v.....r..<.Us.............Z.D.......[...,.R\....$j..^c..^M^.?...J.w..m...7..?zVy....9.J.B...J>&i&..9.c.........<-G.r.f..H.._MX.t+w.|...o]|\v.....>.q.....(....}.,j.J...)....K05....8.F..i ..G.7.. ..:.(*H.Xx.......s.3.0xABADCABA

                                                                                          \Device\ConDrv

                                                                                          Download File
                                                                                          Process:C:\Windows\System32\wbem\WMIC.exe
                                                                                          File Type:ASCII text, with CRLF, CR line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):48
                                                                                          Entropy (8bit):4.305255793112395
                                                                                          Encrypted:false
                                                                                          SSDEEP:3:8yzGc7C1RREal:nzGtRV
                                                                                          MD5:6ED2062D4FB53D847335AE403B23BE62
                                                                                          SHA1:C3030ED2C3090594869691199F46BE7A9A12E035
                                                                                          SHA-256:43B5390113DCBFA597C4AAA154347D72F660DB5F2A0398EB3C1D35793E8220B9
                                                                                          SHA-512:C9C302215394FEC0B38129280A8303E0AF46BA71B75672665D89828C6F68A54E18430F953CE36B74F50DC0F658CA26AC3572EA60F9E6714AFFC9FB623E3C54FC
                                                                                          Malicious:false
                                                                                          Preview:ERROR:...Description = Initialization failure...

                                                                                          \Device\Null

                                                                                          Download File
                                                                                          Process:C:\Windows\SysWOW64\PING.EXE
                                                                                          File Type:ASCII text, with CRLF line terminators
                                                                                          Category:dropped
                                                                                          Size (bytes):275
                                                                                          Entropy (8bit):4.825671547285939
                                                                                          Encrypted:false
                                                                                          SSDEEP:6:PzXULmWxHLTpUrraGbsW3CNcwAFeMmvVOIHJFxMVlmJHaVFtIk3:P+pTpcraGbsTDAFSkIrxMVlmJHaVPN
                                                                                          MD5:048DC6B94735C4768D20ED5E3F14F565
                                                                                          SHA1:6B92CCD1E038396F675090384C6E8DFC742614ED
                                                                                          SHA-256:6D0C347234F09E710D6B842ED14CD27792E71E5B906E9E806E77AFE8FF08E1BE
                                                                                          SHA-512:88DF2342FFD4D303BEF828A12F7BEB505DC06E0BE6E91FF7FDA74DE31FAA289089557C036293EE3B0EE55A62D62CC804953C0D89591E662A0B513525AA40093E
                                                                                          Malicious:false
                                                                                          Preview:..Pinging 1.1.1.1 with 32 bytes of data:..Reply from 1.1.1.1: bytes=32 time=6ms TTL=51....Ping statistics for 1.1.1.1:.. Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 6ms, Maximum = 6ms, Average = 6ms..

                                                                                          Static File Info

                                                                                          General

                                                                                          File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                          Entropy (8bit):6.5971053798287205
                                                                                          TrID:
                                                                                          • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                          • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                          • DOS Executable Generic (2002/1) 0.02%
                                                                                          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                          File name:Crawl.exe
                                                                                          File size:892'416 bytes
                                                                                          MD5:2d2c7ee748d941798466b19b53da88bb
                                                                                          SHA1:7c0cf86f123f2896795add3ecc7bafc30fdc87bc
                                                                                          SHA256:066dc9a1134b1db77c1574a52002f53b28cc29d0a3769bd5156d1e0e0a51a91a
                                                                                          SHA512:9f5a9b6ce25222219f6ef07ac85e5fdf834215dcac81006629b21667aeb4ef9a809e336a66ead9fdcde0af8f51fa7d459b4875bf4023d6cee1eb189eba341912
                                                                                          SSDEEP:12288:CfT9qqQfsr85q5+OeO+OeNhBBhhBB2Lq/5/1G9ba6qCX0GuE3mczIedIHEXNuQ8k:CfT9q1fsr85hJCX0GuWIEXAihyh3LEk
                                                                                          TLSH:5A151822718AFCF6C47101B02B7BA7D6932DED150764C5DBA7C42B29997C1C23E32B99
                                                                                          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{h..............x.......x..p....x.......o.......o.......o.......o.......x.......x..........p....o.......o...............o.....

                                                                                          File Icon

                                                                                          Icon Hash:17170f6d2b2d2d13

                                                                                          Static PE Info

                                                                                          General

                                                                                          Entrypoint:0x45dc6a
                                                                                          Entrypoint Section:.text
                                                                                          Digitally signed:false
                                                                                          Imagebase:0x400000
                                                                                          Subsystem:windows gui
                                                                                          Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                          DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                          Time Stamp:0x677CD61C [Tue Jan 7 07:22:04 2025 UTC]
                                                                                          TLS Callbacks:
                                                                                          CLR (.Net) Version:
                                                                                          OS Version Major:6
                                                                                          OS Version Minor:0
                                                                                          File Version Major:6
                                                                                          File Version Minor:0
                                                                                          Subsystem Version Major:6
                                                                                          Subsystem Version Minor:0
                                                                                          Import Hash:938340415ae85022dbf6430abec6436a

                                                                                          Entrypoint Preview

                                                                                          Instruction
                                                                                          call 00007FD11052F667h
                                                                                          jmp 00007FD11052E9A9h
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          cmp cl, 00000040h
                                                                                          jnc 00007FD11052EB47h
                                                                                          cmp cl, 00000020h
                                                                                          jnc 00007FD11052EB38h
                                                                                          shrd eax, edx, cl
                                                                                          shr edx, cl
                                                                                          ret
                                                                                          mov eax, edx
                                                                                          xor edx, edx
                                                                                          and cl, 0000001Fh
                                                                                          shr eax, cl
                                                                                          ret
                                                                                          xor eax, eax
                                                                                          xor edx, edx
                                                                                          ret
                                                                                          int3
                                                                                          cmp cl, 00000040h
                                                                                          jnc 00007FD11052EB47h
                                                                                          cmp cl, 00000020h
                                                                                          jnc 00007FD11052EB38h
                                                                                          shld edx, eax, cl
                                                                                          shl eax, cl
                                                                                          ret
                                                                                          mov edx, eax
                                                                                          xor eax, eax
                                                                                          and cl, 0000001Fh
                                                                                          shl edx, cl
                                                                                          ret
                                                                                          xor eax, eax
                                                                                          xor edx, edx
                                                                                          ret
                                                                                          int3
                                                                                          push ebx
                                                                                          push esi
                                                                                          mov eax, dword ptr [esp+18h]
                                                                                          or eax, eax
                                                                                          jne 00007FD11052EB4Ah
                                                                                          mov ecx, dword ptr [esp+14h]
                                                                                          mov eax, dword ptr [esp+10h]
                                                                                          xor edx, edx
                                                                                          div ecx
                                                                                          mov ebx, eax
                                                                                          mov eax, dword ptr [esp+0Ch]
                                                                                          div ecx
                                                                                          mov edx, ebx
                                                                                          jmp 00007FD11052EB73h
                                                                                          mov ecx, eax
                                                                                          mov ebx, dword ptr [esp+14h]
                                                                                          mov edx, dword ptr [esp+10h]
                                                                                          mov eax, dword ptr [esp+0Ch]
                                                                                          shr ecx, 1
                                                                                          rcr ebx, 1
                                                                                          shr edx, 1
                                                                                          rcr eax, 1
                                                                                          or ecx, ecx
                                                                                          jne 00007FD11052EB26h
                                                                                          div ebx
                                                                                          mov esi, eax
                                                                                          mul dword ptr [esp+18h]
                                                                                          mov ecx, eax
                                                                                          mov eax, dword ptr [esp+14h]
                                                                                          mul esi
                                                                                          add edx, ecx
                                                                                          jc 00007FD11052EB40h
                                                                                          cmp edx, dword ptr [esp+10h]
                                                                                          jnbe 00007FD11052EB3Ah
                                                                                          jc 00007FD11052EB39h
                                                                                          cmp eax, dword ptr [esp+0Ch]
                                                                                          jbe 00007FD11052EB33h
                                                                                          dec esi
                                                                                          xor edx, edx
                                                                                          mov eax, esi
                                                                                          pop esi
                                                                                          pop ebx
                                                                                          retn 0010h
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          int3
                                                                                          push esi

                                                                                          Data Directories

                                                                                          NameVirtual AddressVirtual Size Is in Section
                                                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0xb4bdc0xa0.rdata
                                                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0xbe0000x171e0.rsrc
                                                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0xd60000x870c.reloc
                                                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0xa62200x70.rdata
                                                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_TLS0xa63800x18.rdata
                                                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0xa62900x40.rdata
                                                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_IAT0x8b0000x238.rdata
                                                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                          Sections

                                                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                          .text0x10000x896340x89800c179a78ec82cfcd2d16d839b312fb1dfFalse0.46205965909090907data6.664845307163586IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                          .rdata0x8b0000x2a8f80x2aa0044f7c668b71c1e9c3ec4d09d7cd60c4aFalse0.5006758614369502data5.799159937713704IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                          .data0xb60000x7f6c0x5e00284ad9d5642ab76993ffc99bec49449aFalse0.1619847074468085data4.903009158845333IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                          .rsrc0xbe0000x171e00x17200012bf598da40fa0aace5ddc3a224a980False0.11898226351351351data4.028874280754401IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                          .reloc0xd60000x870c0x8800be37470646a8f4b49a8fea6045ee90a4False0.5807387408088235data6.5324970978569645IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                          Resources

                                                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                          RT_ICON0xbe5700x115aPNG image data, 256 x 256, 8-bit colormap, non-interlacedEnglishUnited States0.33340837460603334
                                                                                          RT_ICON0xbf6d00xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishUnited States0.09408315565031983
                                                                                          RT_ICON0xc05780x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishUnited States0.11507220216606498
                                                                                          RT_ICON0xc0e200x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishUnited States0.12427745664739884
                                                                                          RT_ICON0xc13880x90bPNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.791792656587473
                                                                                          RT_ICON0xc1c980x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States0.03235710911667454
                                                                                          RT_ICON0xc5ec00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.04595435684647303
                                                                                          RT_ICON0xc84680x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.075046904315197
                                                                                          RT_ICON0xc95100x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.15070921985815602
                                                                                          RT_ICON0xc9a000x115aPNG image data, 256 x 256, 8-bit colormap, non-interlacedEnglishUnited States0.33340837460603334
                                                                                          RT_ICON0xcab600xea8Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colorsEnglishUnited States0.09408315565031983
                                                                                          RT_ICON0xcba080x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colorsEnglishUnited States0.11507220216606498
                                                                                          RT_ICON0xcc2b00x568Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colorsEnglishUnited States0.12427745664739884
                                                                                          RT_ICON0xcc8180x90bPNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.791792656587473
                                                                                          RT_ICON0xcd1280x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896EnglishUnited States0.03235710911667454
                                                                                          RT_ICON0xd13500x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600EnglishUnited States0.04595435684647303
                                                                                          RT_ICON0xd38f80x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224EnglishUnited States0.075046904315197
                                                                                          RT_ICON0xd49a00x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088EnglishUnited States0.15070921985815602
                                                                                          RT_MENU0xd4e900x4adataEnglishUnited States0.8648648648648649
                                                                                          RT_DIALOG0xd4ef00x130dataEnglishUnited States0.5921052631578947
                                                                                          RT_STRING0xd50200x3cdataEnglishUnited States0.6833333333333333
                                                                                          RT_ACCELERATOR0xd4ee00x10dataEnglishUnited States1.25
                                                                                          RT_GROUP_ICON0xc99780x84dataEnglishUnited States0.6590909090909091
                                                                                          RT_GROUP_ICON0xd4e080x84dataEnglishUnited States0.6515151515151515
                                                                                          RT_MANIFEST0xd50600x17dXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5931758530183727

                                                                                          Imports

                                                                                          DLLImport
                                                                                          KERNEL32.dllInitializeCriticalSectionEx, FindClose, WaitForSingleObject, GetModuleHandleA, OpenProcess, HeapSize, CreateToolhelp32Snapshot, CreateEventW, Sleep, GetTempPathA, FormatMessageW, CopyFileA, GetLastError, Process32NextW, SetEvent, TerminateThread, TlsAlloc, Process32FirstW, HeapReAlloc, LeaveCriticalSection, RaiseException, ResetEvent, HeapAlloc, QueueUserAPC, DecodePointer, GetProcAddress, LocalFree, DeleteCriticalSection, GetProcessHeap, CreateProcessW, WideCharToMultiByte, SleepEx, TlsGetValue, TlsFree, FormatMessageA, IsDebuggerPresent, WriteConsoleW, CreateFileW, SetStdHandle, InitializeCriticalSectionAndSpinCount, WaitForMultipleObjects, GetModuleFileNameW, TerminateProcess, GetCurrentProcess, FindNextFileW, EnterCriticalSection, HeapFree, TlsSetValue, CloseHandle, FindFirstFileW, SetEnvironmentVariableA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetOEMCP, IsValidCodePage, FindNextFileA, FindFirstFileExA, SetFilePointerEx, SetLastError, QueryPerformanceCounter, QueryPerformanceFrequency, WaitForSingleObjectEx, GetCurrentThreadId, GetNativeSystemInfo, InitializeConditionVariable, WakeConditionVariable, WakeAllConditionVariable, SleepConditionVariableCS, SleepConditionVariableSRW, InitializeSRWLock, ReleaseSRWLockExclusive, AcquireSRWLockExclusive, TryEnterCriticalSection, GetSystemTimeAsFileTime, GetModuleHandleW, EncodePointer, MultiByteToWideChar, LCMapStringEx, GetStringTypeW, GetCPInfo, OutputDebugStringW, InitializeSListHead, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetCurrentProcessId, RtlUnwind, InterlockedPushEntrySList, FreeLibrary, LoadLibraryExW, CreateThread, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, ExitProcess, GetModuleFileNameA, GetStdHandle, WriteFile, GetCommandLineA, GetCommandLineW, GetACP, GetFileType, CompareStringW, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, FlushFileBuffers, GetConsoleCP, GetConsoleMode, DeleteFileW, MoveFileExW, ReadFile, ReadConsoleW, SetEndOfFile
                                                                                          USER32.dllwsprintfW
                                                                                          ADVAPI32.dllLookupPrivilegeValueW, AdjustTokenPrivileges, RegCloseKey, RegGetValueA, RegCreateKeyExW, RegSetValueExW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyW, RegQueryValueExW
                                                                                          SHELL32.dllSHGetKnownFolderPath
                                                                                          ole32.dllCoTaskMemFree
                                                                                          WS2_32.dllWSACleanup, WSAStartup
                                                                                          bcrypt.dllBCryptOpenAlgorithmProvider, BCryptGenRandom, BCryptCloseAlgorithmProvider

                                                                                          Possible Origin

                                                                                          Language of compilation systemCountry where language is spokenMap
                                                                                          EnglishUnited States

                                                                                          Network Behavior

                                                                                          ICMP Packets

                                                                                          TimestampSource IPDest IPChecksumCodeType
                                                                                          Jan 7, 2025 13:32:48.568839073 CET192.168.2.41.1.1.14d5aEcho
                                                                                          Jan 7, 2025 13:32:48.575074911 CET1.1.1.1192.168.2.4555aEcho Reply
                                                                                          Jan 7, 2025 13:32:51.157778978 CET192.168.2.41.1.1.14d59Echo
                                                                                          Jan 7, 2025 13:32:51.165088892 CET1.1.1.1192.168.2.45559Echo Reply
                                                                                          Jan 7, 2025 13:32:53.127249002 CET192.168.2.41.1.1.14d58Echo
                                                                                          Jan 7, 2025 13:32:53.133599043 CET1.1.1.1192.168.2.45558Echo Reply

                                                                                          Statistics

                                                                                          CPU Usage

                                                                                          Click to jump to process

                                                                                          Memory Usage

                                                                                          Click to jump to process

                                                                                          High Level Behavior Distribution

                                                                                          Click to dive into process behavior distribution

                                                                                          Behavior

                                                                                          Click to jump to process

                                                                                          System Behavior

                                                                                          General

                                                                                          Target ID:0
                                                                                          Start time:07:31:57
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Users\user\Desktop\Crawl.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Desktop\Crawl.exe"
                                                                                          Imagebase:0xe70000
                                                                                          File size:892'416 bytes
                                                                                          MD5 hash:2D2C7EE748D941798466B19B53DA88BB
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:low
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:1
                                                                                          Start time:07:32:02
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:c:\eHFmDS\eHFm\..\..\Windows\eHFm\eHFm\..\..\system32\eHFm\eHFm\..\..\wbem\eHFm\eHFmD\..\..\wmic.exe shadowcopy delete
                                                                                          Imagebase:0x7ff736420000
                                                                                          File size:576'000 bytes
                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:2
                                                                                          Start time:07:32:03
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff7699e0000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:10
                                                                                          Start time:07:32:14
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Users\user\Desktop\Crawl.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Desktop\Crawl.exe"
                                                                                          Imagebase:0xe70000
                                                                                          File size:892'416 bytes
                                                                                          MD5 hash:2D2C7EE748D941798466B19B53DA88BB
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:low
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:11
                                                                                          Start time:07:32:20
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:c:\wyFgSM\wyFg\..\..\Windows\wyFg\wyFg\..\..\system32\wyFg\wyFg\..\..\wbem\wyFg\wyFgS\..\..\wmic.exe shadowcopy delete
                                                                                          Imagebase:0x7ff736420000
                                                                                          File size:576'000 bytes
                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:12
                                                                                          Start time:07:32:20
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff7699e0000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:16
                                                                                          Start time:07:32:23
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Users\user\Desktop\Crawl.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:"C:\Users\user\Desktop\Crawl.exe"
                                                                                          Imagebase:0xe70000
                                                                                          File size:892'416 bytes
                                                                                          MD5 hash:2D2C7EE748D941798466B19B53DA88BB
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:low
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:18
                                                                                          Start time:07:32:28
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:c:\pKqXjm\pKqX\..\..\Windows\pKqX\pKqX\..\..\system32\pKqX\pKqX\..\..\wbem\pKqX\pKqXj\..\..\wmic.exe shadowcopy delete
                                                                                          Imagebase:0x7ff736420000
                                                                                          File size:576'000 bytes
                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:19
                                                                                          Start time:07:32:28
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff71e800000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:23
                                                                                          Start time:07:32:42
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\System32\notepad.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:"C:\Windows\system32\NOTEPAD.EXE" C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Decryptfiles.txt
                                                                                          Imagebase:0x7ff6e07b0000
                                                                                          File size:201'216 bytes
                                                                                          MD5 hash:27F71B12CB585541885A31BE22F61C83
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:moderate
                                                                                          Has exited:false

                                                                                          General

                                                                                          Target ID:26
                                                                                          Start time:07:32:46
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:c:\bIEBzl\bIEB\..\..\Windows\bIEB\bIEB\..\..\system32\bIEB\bIEB\..\..\wbem\bIEB\bIEBz\..\..\wmic.exe shadowcopy delete
                                                                                          Imagebase:0x7ff736420000
                                                                                          File size:576'000 bytes
                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Reputation:high
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:27
                                                                                          Start time:07:32:46
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe"
                                                                                          Imagebase:0x7ff71e800000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:28
                                                                                          Start time:07:32:46
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff7699e0000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:29
                                                                                          Start time:07:32:46
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff7699e0000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:30
                                                                                          Start time:07:32:47
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\SysWOW64\PING.EXE
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:ping 1.1.1.1 -n 1 -w 3000
                                                                                          Imagebase:0xd30000
                                                                                          File size:18'944 bytes
                                                                                          MD5 hash:B3624DD758CCECF93A1226CEF252CA12
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:31
                                                                                          Start time:07:32:49
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:c:\rEFsaw\rEFs\..\..\Windows\rEFs\rEFs\..\..\system32\rEFs\rEFs\..\..\wbem\rEFs\rEFsa\..\..\wmic.exe shadowcopy delete
                                                                                          Imagebase:0x7ff736420000
                                                                                          File size:576'000 bytes
                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:32
                                                                                          Start time:07:32:49
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe"
                                                                                          Imagebase:0xdc0000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:33
                                                                                          Start time:07:32:49
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff7699e0000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:34
                                                                                          Start time:07:32:49
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff7699e0000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:35
                                                                                          Start time:07:32:49
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\SysWOW64\PING.EXE
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:ping 1.1.1.1 -n 1 -w 3000
                                                                                          Imagebase:0xd30000
                                                                                          File size:18'944 bytes
                                                                                          MD5 hash:B3624DD758CCECF93A1226CEF252CA12
                                                                                          Has elevated privileges:true
                                                                                          Has administrator privileges:true
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:36
                                                                                          Start time:07:32:51
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\System32\wbem\WMIC.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:c:\JQLOTM\JQLO\..\..\Windows\JQLO\JQLO\..\..\system32\JQLO\JQLO\..\..\wbem\JQLO\JQLOT\..\..\wmic.exe shadowcopy delete
                                                                                          Imagebase:0x7ff736420000
                                                                                          File size:576'000 bytes
                                                                                          MD5 hash:C37F2F4F4B3CD128BDABCAEB2266A785
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:37
                                                                                          Start time:07:32:51
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\SysWOW64\cmd.exe
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\user\Desktop\Crawl.exe"
                                                                                          Imagebase:0xdc0000
                                                                                          File size:236'544 bytes
                                                                                          MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:38
                                                                                          Start time:07:32:51
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff7699e0000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:39
                                                                                          Start time:07:32:51
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\System32\conhost.exe
                                                                                          Wow64 process (32bit):false
                                                                                          Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          Imagebase:0x7ff7699e0000
                                                                                          File size:862'208 bytes
                                                                                          MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          General

                                                                                          Target ID:40
                                                                                          Start time:07:32:51
                                                                                          Start date:07/01/2025
                                                                                          Path:C:\Windows\SysWOW64\PING.EXE
                                                                                          Wow64 process (32bit):true
                                                                                          Commandline:ping 1.1.1.1 -n 1 -w 3000
                                                                                          Imagebase:0xd30000
                                                                                          File size:18'944 bytes
                                                                                          MD5 hash:B3624DD758CCECF93A1226CEF252CA12
                                                                                          Has elevated privileges:false
                                                                                          Has administrator privileges:false
                                                                                          Programmed in:C, C++ or other language
                                                                                          Has exited:true

                                                                                          Disassembly

                                                                                          ⊘No disassembly