However, the previous version didn’t change the background at all – it simply left the ransom note we observed previously (Figure 4).  During analysis and threat intel gathering, we discovered two main packers used for HelloXD ransomware binaries, as well as for other malware samples linked to the potential author (Figure 5).