Notorious STOP Ransomware continues its distribution with minor modifications. Since the end of February 2019, new extensions appeared: .kropun, .kropun1, .kroput or .kroput1. At the same time, it distributes the AZORult trojan-stealer, which steals confidential information. It is capable of stealing various user data: information from files, browser history, passwords, cookies, online banking credentials, crypto-currency wallets, and more. Virus modifies the hosts file to block Windows updates, antivirus programs, and sites related to security news, selling antivirus software. This version of STOP Ransomware still uses following e-mail addresses: email@example.com and firstname.lastname@example.org.