Indicators of CompromiseFiles with the following hashes were used in the first series of attacks:  cd8329f75b1393ead3e16c6c79ee1ab476e6487370481e5931feb63305f00983 – detected as VBS_KEYLOG.NYKW f46f0e8eed0361294200d64e87b3fb13f6a3797f99f5b588444534f27612a590 – archive file;