Windows Analysis Report
Document.doc.scr

Overview

General Information

Sample name: Document.doc.scr
Analysis ID: 1430701
MD5: ae811bd6440b425e6777f0ca001a9743
SHA1: 70902540ead269971e149eaff568fb17d04156af
SHA256: 86e17aa882c690ede284f3e445439dfe589d8f36e31cbc09d102305499d5c498
Infos:

Detection

LockBit ransomware, TrojanRansom
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Found ransom note / readme
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected LockBit ransomware
Yara detected TrojanRansom
Changes the wallpaper picture
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Deletes itself after installation
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Overwrites Mozilla Firefox settings
Tries to harvest and steal browser information (history, passwords, etc)
Uses an obfuscated file name to hide its real file extension (double extension)
Writes many files with high entropy
Writes to foreign memory regions
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Enables debug privileges
Enables security privileges
PE file contains an invalid checksum
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Potentially Suspicious Desktop Background Change Via Registry
Uses 32bit PE files
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Document.doc.scr Avira: detected
Multi AV Scanner detection for submitted file
Source: Document.doc.scr ReversingLabs: Detection: 71%
Source: Document.doc.scr Virustotal: Detection: 78% Perma Link
Machine Learning detection for sample
Source: Document.doc.scr Joe Sandbox ML: detected
Uses 32bit PE files
Source: Document.doc.scr Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Videos\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Searches\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Saved Games\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Recent\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Pictures\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Pictures\Saved Pictures\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Pictures\Camera Roll\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\OneDrive\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Music\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Links\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Favorites\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Favorites\Links\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Downloads\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\ZGGKNSUKOP\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\UNKRLCVOHV\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\NYMMPCEIMA\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\NVWZAPQSQL\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\JDDHMPCDUJ\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\HMPPSXQPQV\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\GRXZDKKVDB\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\EOWRVPQCCS\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\EFOYFBOLXA\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\ZGGKNSUKOP\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\UNKRLCVOHV\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\NYMMPCEIMA\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\NVWZAPQSQL\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\JDDHMPCDUJ\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\HMPPSXQPQV\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\GRXZDKKVDB\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\EOWRVPQCCS\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\EFOYFBOLXA\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Contacts\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Extensions\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Sonar\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\RTTransfer\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Linguistics\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Headlights\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\Linguistics\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\VideoDecodeStats\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\dd432c4a-ba38-4070-9985-ed1b3bea85dc\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\assets\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\VirtualStore\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\Symbols\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_5172_761252224\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_5172_1791500899\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_2640_817343797\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\mozilla-temp-files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\Low\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_995017740\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_778675694\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_736602331\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_649288342\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_339006160\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_27162369\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1988346647\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1959985254\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1807723660\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1693012001\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1635976352\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1619438387\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1485273224\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1421574262\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1318414972\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1289371347\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1234978473\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1191663050\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1090636871\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\Diagnostics\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrocef_low\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\SolidDocuments\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\SolidDocuments\Acrobat\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Publishers\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\SettingsContainer\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Microsoft.WindowsAlarms\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Licenses\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Fonts\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\PeerDistRepub\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\BackgroundTransferApi\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\Flighting\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{99fff775-938d-4e2c-9c06-5d56107a5383}\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{2737c7bb-35fb-4b44-baf9-033ca587595d}\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4e763a36-90d3-4d6c-9949-dd01f7e5d23f}\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ea91a05a-d98f-4429-81a9-272df0335447}\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{de0f148a-c476-467a-b7a3-14b0bb463140}\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{880da644-c864-4aed-9e06-5b089e06c09e}\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: Document.doc.scr Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2n source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: p.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.kZd6jLIwz source: Document.doc.scr, 00000000.00000003.2061156800.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2062462577.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068373022.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067060328.0000000001238000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001154000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.kZd6jLIwz source: Document.doc.scr, 00000000.00000003.2061156800.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2062462577.0000000001238000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: Document.doc.scr, 00000000.00000003.2064531991.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059520677.000000000111C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ownload.errorIwz+ source: Document.doc.scr, 00000000.00000003.2074121235.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.kZd6jLIwzg source: Document.doc.scr, 00000000.00000003.2061156800.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2062462577.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068373022.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067060328.0000000001238000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\*# source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\kZd6jLIwz.README.txt`/ source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001154000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: Document.doc.scr, 00000000.00000003.2064531991.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068087626.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068615252.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059520677.000000000111C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001154000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\kZd6jLIwz.README.txtb source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: _prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2n source: Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831s source: Document.doc.scr, 00000000.00000003.2064531991.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068087626.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2071652569.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068615252.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2071891357.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059520677.000000000111C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\kZd6jLIwz.README.txt source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ice\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\Zd6jLIwz.README.txtz source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorzg1 source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001154000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Zd6jLIwz.README.txtson source: Document.doc.scr, 00000000.00000003.2074121235.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2075417986.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2077533300.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2076804926.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2074863636.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2076053252.0000000001136000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.kZd6jLIwzxt source: Document.doc.scr, 00000000.00000003.2074121235.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2075417986.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2076804926.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2074863636.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2076053252.0000000001136000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Zd6jLIwz.README.txt@ source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\Zd6jLIwz.README.txt5 source: Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\g source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001154000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\kZd6jLIwz.README.txt source: Document.doc.scr, 00000000.00000003.2061156800.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2062462577.0000000001238000.00000004.00000020.00020000.00000000.sdmp
Source: C:\ProgramData\D4EC.tmp Code function: 8_2_0040227C FindFirstFileExW, 8_2_0040227C
Source: C:\ProgramData\D4EC.tmp Code function: 8_2_0040152C FindFirstFileExW,FindClose,FindNextFileW,FindClose, 8_2_0040152C
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\ Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\ Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\ Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\ Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\ Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\ Jump to behavior
Source: Document.doc.scr, 00000000.00000003.2058457962.0000000001154000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/privacy-sdx.win32.bundle.js.map/e3b0c4429
Source: Document.doc.scr, 00000000.00000003.2058198747.0000000001238000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/ui.win32.js.map/d6bb35bc608af2672a5b746ba
Source: Document.doc.scr, 00000000.00000003.2058198747.0000000001238000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://clients3.google.com/generate_204
Source: Document.doc.scr, 00000000.00000003.2058198747.0000000001238000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://github.com/react-native-community/react-native-netinfo
Source: App1713921509308663900_6D1069C2-A1FE-4969-8A18-9CD73AF4AF15.log.11.dr String found in binary or memory: https://login.windows.net
Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001230000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2032462071.0000000001228000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001238000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Document.doc.scr, 00000000.00000003.2032462071.00000000011BF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefox
Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001238000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: Document.doc.scr, 00000000.00000003.2061156800.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2092684104.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2019781196.0000000001156000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2119320978.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2103612240.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2122420148.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2123563496.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2035440830.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2020875656.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2128470332.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2097170059.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2096070849.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2094172163.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2033390092.0000000001126000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2033154751.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2106278279.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2128740161.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2122743679.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2096396555.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2119133098.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2128345601.0000000001137000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://tox.chat/
Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001230000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2032462071.0000000001228000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: Document.doc.scr, 00000000.00000003.2032462071.00000000011BF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/
Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001238000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: Document.doc.scr, 00000000.00000003.2032462071.00000000011BF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/
Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001238000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: Document.doc.scr, 00000000.00000003.2032462071.00000000011BF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001238000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001238000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001238000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001238000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Spam, unwanted Advertisements and Ransom Demands
barindex
Found ransom note / readme
Source: C:\Users\user\AppData\Local\Packages\Microsoft.UI.Xaml.2.0_8wekyb3d8bbwe\kZd6jLIwz.README.txt Dropped file: !! ALL YOUR FILES HAS BEEN ENCRYPTED !!!You can't restore them without our encryptor.Don't try to use any public tools, you could damage the encrypted files and lose them forever.To make sure our encryptor works, contact us and encrypt one file for free.Download TOX messenger: https://tox.chat/Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6 Jump to dropped file
Yara detected LockBit ransomware
Source: Yara match File source: Document.doc.scr, type: SAMPLE
Source: Yara match File source: 0.0.Document.doc.scr.d40000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000000.2009802642.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Yara detected TrojanRansom
Source: Yara match File source: Process Memory Space: Document.doc.scr PID: 6084, type: MEMORYSTR
Changes the wallpaper picture
Source: C:\Users\user\Desktop\Document.doc.scr Key value created or modified: HKEY_CURRENT_USER\Control Panel\Desktop WallPaper C:\ProgramData\kZd6jLIwz.bmp Jump to behavior
Modifies existing user documents (likely ransomware behavior)
Source: C:\Users\user\Desktop\Document.doc.scr File moved: C:\Users\user\Desktop\GRXZDKKVDB.pdf Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File moved: C:\Users\user\Desktop\NVWZAPQSQL\EFOYFBOLXA.xlsx Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File moved: C:\Users\user\Desktop\KLIZUSIQEN.mp3 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File moved: C:\Users\user\Desktop\GRXZDKKVDB\QCOILOQIKC.png Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File moved: C:\Users\user\Desktop\EFOYFBOLXA\ZGGKNSUKOP.jpg Jump to behavior
Writes many files with high entropy
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{880da644-c864-4aed-9e06-5b089e06c09e}\Apps.ft.kZd6jLIwz entropy: 7.99649721103 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{116229A7-9A3B-2078-DB5F-B5A20811242C}.kZd6jLIwz entropy: 7.99523188518 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_.kZd6jLIwz entropy: 7.99554410232 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome.kZd6jLIwz entropy: 7.99573369008 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\308046B0AF4A39CB;PrivateBrowsingAUMID.kZd6jLIwz entropy: 7.99401658243 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\308046B0AF4A39CB.kZd6jLIwz entropy: 7.99566924346 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4e763a36-90d3-4d6c-9949-dd01f7e5d23f}\settingsconversions.txt.kZd6jLIwz entropy: 7.99742769817 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_help.kZd6jLIwz entropy: 7.99509484272 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{E8B84CFB-B069-BC13-F88F-170904F645E5}.kZd6jLIwz entropy: 7.99501574529 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{E7A33582-E908-3379-5368-5999454DCD83}.kZd6jLIwz entropy: 7.9953360237 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{DAA168DE-4306-C8BC-8C11-B596240BDDED}.kZd6jLIwz entropy: 7.99574508197 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{C804BBA7-FA5F-CBF7-8B55-2096E5F972CB}.kZd6jLIwz entropy: 7.99534531929 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{C1C6F8AC-40A3-0F5C-146F-65A9DC70BBB4}.kZd6jLIwz entropy: 7.99525185364 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{BD3F924E-55FB-A1BA-9DE6-B50F9F2460AC}.kZd6jLIwz entropy: 7.99483351484 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{BB044BFD-25B7-2FAA-22A8-6371A93E0456}.kZd6jLIwz entropy: 7.99529652587 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{923DD477-5846-686B-A659-0FCCD73851A8}.kZd6jLIwz entropy: 7.99564666808 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{8AA47365-B2B3-1961-69EB-F866E376B12F}.kZd6jLIwz entropy: 7.99424644168 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{8ABD94FB-E7D6-84A6-A997-C918EDDE0AE5}.kZd6jLIwz entropy: 7.99521020045 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{16988324-21C9-05B2-CA60-9B4EC72739D8}.kZd6jLIwz entropy: 7.99548201832 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_InternetExplorer_Default.kZd6jLIwz entropy: 7.99533203034 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{F1118828-A0CC-5FEB-85C9-DBFFDF98434A}.kZd6jLIwz entropy: 7.99499029175 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696428527628431800_6CD9E3BB-4D03-46BD-8615-75A902267162.log.kZd6jLIwz entropy: 7.99886958591 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt.kZd6jLIwz entropy: 7.99263829327 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_POWERPNT_EXE_15.kZd6jLIwz entropy: 7.99540409773 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_ONENOTE_EXE_15.kZd6jLIwz entropy: 7.99577592479 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_OUTLOOK_EXE_15.kZd6jLIwz entropy: 7.99453097905 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_OcPubMgr_exe_15.kZd6jLIwz entropy: 7.99568419068 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_MSPUB_EXE_15.kZd6jLIwz entropy: 7.99464541574 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_msoev_exe_15.kZd6jLIwz entropy: 7.99480104287 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_MSACCESS_EXE_15.kZd6jLIwz entropy: 7.99546256381 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_lync_exe_15.kZd6jLIwz entropy: 7.99582200782 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_EXCEL_EXE_15.kZd6jLIwz entropy: 7.99511059573 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_DATABASECOMPARE_EXE_15.kZd6jLIwz entropy: 7.99558329334 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsCalculator_8wekyb3d8bbwe!App.kZd6jLIwz entropy: 7.99478919663 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsAlarms_8wekyb3d8bbwe!App.kZd6jLIwz entropy: 7.99455623225 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_SkyDrive_Desktop.kZd6jLIwz entropy: 7.99493855377 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_WINWORD_EXE_15.kZd6jLIwz entropy: 7.99530224972 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SPREADSHEETCOMPARE_EXE_15.kZd6jLIwz entropy: 7.99487191119 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15.kZd6jLIwz entropy: 7.99453166118 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_RemoteDesktop.kZd6jLIwz entropy: 7.9947726418 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_MediaPlayer32.kZd6jLIwz entropy: 7.99462833027 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer.kZd6jLIwz entropy: 7.99569910214 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel.kZd6jLIwz entropy: 7.99535122519 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Computer.kZd6jLIwz entropy: 7.99392611384 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_AdministrativeTools.kZd6jLIwz entropy: 7.99550887738 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsSoundRecorder_8wekyb3d8bbwe!App.kZd6jLIwz entropy: 7.99575224475 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe.kZd6jLIwz entropy: 7.99540715086 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\MSEdge.kZd6jLIwz entropy: 7.99481120989 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Shell_RunDialog.kZd6jLIwz entropy: 7.99513027448 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Photos_8wekyb3d8bbwe!App.kZd6jLIwz entropy: 7.99445572812 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.kZd6jLIwz entropy: 7.99542044303 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_narrator_exe.kZd6jLIwz entropy: 7.99567743952 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_mspaint_exe.kZd6jLIwz entropy: 7.99453699242 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_msinfo32_exe.kZd6jLIwz entropy: 7.99495672881 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_msconfig_exe.kZd6jLIwz entropy: 7.99502118481 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_MdSched_exe.kZd6jLIwz entropy: 7.99465147905 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_magnify_exe.kZd6jLIwz entropy: 7.99569510728 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_iscsicpl_exe.kZd6jLIwz entropy: 7.99463264698 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_dfrgui_exe.kZd6jLIwz entropy: 7.99464874896 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_cmd_exe.kZd6jLIwz entropy: 7.99550873446 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_cleanmgr_exe.kZd6jLIwz entropy: 7.99505289123 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_osk_exe.kZd6jLIwz entropy: 7.99447542688 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_odbcad32_exe.kZd6jLIwz entropy: 7.9947430509 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WF_msc.kZd6jLIwz entropy: 7.99544654027 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WFS_exe.kZd6jLIwz entropy: 7.99512581065 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_SnippingTool_exe.kZd6jLIwz entropy: 7.99475432434 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_services_msc.kZd6jLIwz entropy: 7.99569765261 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_RecoveryDrive_exe.kZd6jLIwz entropy: 7.99458353054 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_quickassist_exe.kZd6jLIwz entropy: 7.99471681339 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_psr_exe.kZd6jLIwz entropy: 7.99465507322 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_printmanagement_msc.kZd6jLIwz entropy: 7.99496994215 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_notepad_exe.kZd6jLIwz entropy: 7.9947342424 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.kZd6jLIwz entropy: 7.99402821541 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.kZd6jLIwz entropy: 7.99557890385 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm.kZd6jLIwz entropy: 7.99430835507 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.kZd6jLIwz entropy: 7.99618659133 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.kZd6jLIwz entropy: 7.99421459035 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.kZd6jLIwz entropy: 7.99391676944 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.kZd6jLIwz entropy: 7.99647406611 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.kZd6jLIwz entropy: 7.99608561191 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm.kZd6jLIwz entropy: 7.99509943836 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.kZd6jLIwz entropy: 7.99401181452 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\a83301c6-790b-49f3-adc7-55a855f7fe79.kZd6jLIwz entropy: 7.99742212477 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4.kZd6jLIwz entropy: 7.99154559317 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835649.b06d08be-79e8-4bfe-b6aa-988ea3d35cbd.first-shutdown.jsonlz4.kZd6jLIwz entropy: 7.99095702593 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\C5FD1F724F49F95970FE8CD30C20519BF4582045.kZd6jLIwz entropy: 7.99860688566 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\DED23BB33EA3C88FAD1C0A1CD53916E0D8C424D3.kZd6jLIwz entropy: 7.99017281948 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F.kZd6jLIwz entropy: 7.9955367358 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\E707EC8A256322E87908664A49F800B7B48E0961.kZd6jLIwz entropy: 7.99073920348 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\E557A7C6ADAC24EDE9B88CACC662B8A371C1931D.kZd6jLIwz entropy: 7.99673880111 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.kZd6jLIwz entropy: 7.9915300862 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db.kZd6jLIwz entropy: 7.99654780243 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed\14645.kZd6jLIwz entropy: 7.99541544669 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\index.kZd6jLIwz entropy: 7.99928197778 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1.kZd6jLIwz entropy: 7.99930631339 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\index.kZd6jLIwz entropy: 7.99924656929 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1.kZd6jLIwz entropy: 7.99929530778 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1.kZd6jLIwz entropy: 7.99936441339 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\index.kZd6jLIwz entropy: 7.99929728515 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db-shm.kZd6jLIwz entropy: 7.99451929938 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.kZd6jLIwz entropy: 7.99853102707 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Aut2Exe_Aut2exe_x64_exe.kZd6jLIwz entropy: 7.99557202315 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Au3Info_exe.kZd6jLIwz entropy: 7.99455051294 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Windows NT_Accessories_wordpad_exe.kZd6jLIwz entropy: 7.99480537174 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Common Files_Microsoft Shared_Ink_mip_exe.kZd6jLIwz entropy: 7.99574752423 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Adobe_Acrobat DC_Acrobat_Acrobat_exe.kZd6jLIwz entropy: 7.99439451392 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_7-Zip_7zFM_exe.kZd6jLIwz entropy: 7.99502395244 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_7-Zip_7-zip_chm.kZd6jLIwz entropy: 7.99435731417 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_PowerShell_ISE_exe.kZd6jLIwz entropy: 7.99486593624 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_powershell_exe.kZd6jLIwz entropy: 7.99579522223 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Aut2Exe_Aut2exe_exe.kZd6jLIwz entropy: 7.99549903127 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Au3Info_x64_exe.kZd6jLIwz entropy: 7.99504688679 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_WindowsPowerShell_v1_0_powershell_exe.kZd6jLIwz entropy: 7.99528803523 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_odbcad32_exe.kZd6jLIwz entropy: 7.99468779606 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_SciTE_SciTE_exe.kZd6jLIwz entropy: 7.99562131905 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Extras.kZd6jLIwz entropy: 7.99487928885 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Examples.kZd6jLIwz entropy: 7.99486688171 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt_chm.kZd6jLIwz entropy: 7.99553413548 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoItX_AutoItX_chm.kZd6jLIwz entropy: 7.99577248057 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt3_x64_exe.kZd6jLIwz entropy: 7.99456548245 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt3_exe.kZd6jLIwz entropy: 7.9957579802 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt v3 Website_url.kZd6jLIwz entropy: 7.9955102908 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_Java_jre-1_8_bin_javacpl_exe.kZd6jLIwz entropy: 7.99600337201 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs.kZd6jLIwz entropy: 7.99967097263 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log.kZd6jLIwz entropy: 7.999638971 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs.kZd6jLIwz entropy: 7.99963721654 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{F38BF404-1D43-42F2-9305-67DE0B28FC23}_regedit_exe.kZd6jLIwz entropy: 7.99536600874 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_WindowsPowerShell_v1_0_PowerShell_ISE_exe.kZd6jLIwz entropy: 7.9958197686 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log.kZd6jLIwz entropy: 7.99967239048 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTracing_startedInBGMode.etl.kZd6jLIwz entropy: 7.99713942466 Jump to dropped file
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm.kZd6jLIwz entropy: 7.99457451821 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\Document.doc.scr entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\AAAAAAAAAAAAAAAA (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\BBBBBBBBBBBBBBBB (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\CCCCCCCCCCCCCCCC (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\DDDDDDDDDDDDDDDD (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\EEEEEEEEEEEEEEEE (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\FFFFFFFFFFFFFFFF (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\GGGGGGGGGGGGGGGG (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\HHHHHHHHHHHHHHHH (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\IIIIIIIIIIIIIIII (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\JJJJJJJJJJJJJJJJ (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\KKKKKKKKKKKKKKKK (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\LLLLLLLLLLLLLLLL (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\MMMMMMMMMMMMMMMM (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\NNNNNNNNNNNNNNNN (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\OOOOOOOOOOOOOOOO (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\PPPPPPPPPPPPPPPP (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\QQQQQQQQQQQQQQQQ (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\RRRRRRRRRRRRRRRR (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\SSSSSSSSSSSSSSSS (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\TTTTTTTTTTTTTTTT (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\UUUUUUUUUUUUUUUU (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\VVVVVVVVVVVVVVVV (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\WWWWWWWWWWWWWWWW (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\XXXXXXXXXXXXXXXX (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\YYYYYYYYYYYYYYYY (copy) entropy: 7.99748731788 Jump to dropped file
Source: C:\ProgramData\D4EC.tmp File created: C:\Users\user\Desktop\ZZZZZZZZZZZZZZZZ (copy) entropy: 7.99748731788 Jump to dropped file

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: Document.doc.scr, type: SAMPLE Matched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
Source: 0.0.Document.doc.scr.d40000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
Source: 00000000.00000000.2009802642.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: Document.doc.scr
Contains functionality to call native functions
Source: C:\ProgramData\D4EC.tmp Code function: 8_2_00402760 CreateFileW,ReadFile,NtClose, 8_2_00402760
Source: C:\ProgramData\D4EC.tmp Code function: 8_2_0040286C NtSetInformationProcess,NtSetInformationProcess,NtSetInformationProcess, 8_2_0040286C
Source: C:\ProgramData\D4EC.tmp Code function: 8_2_00402F18 CreateFileW,NtAllocateVirtualMemory,WriteFile,SetFilePointerEx,SetFilePointerEx,NtFreeVirtualMemory,NtClose,DeleteFileW, 8_2_00402F18
Source: C:\ProgramData\D4EC.tmp Code function: 8_2_00401DC2 NtProtectVirtualMemory, 8_2_00401DC2
Source: C:\ProgramData\D4EC.tmp Code function: 8_2_00401D94 NtSetInformationThread, 8_2_00401D94
Source: C:\ProgramData\D4EC.tmp Code function: 8_2_004016B4 NtAllocateVirtualMemory,NtAllocateVirtualMemory, 8_2_004016B4
Creates files inside the system directory
Source: C:\Windows\splwow64.exe File created: C:\Windows\system32\spool\PRINTERS\00002.SPL
Enables security privileges
Source: C:\Users\user\Desktop\Document.doc.scr Process token adjusted: Security
Uses 32bit PE files
Source: Document.doc.scr Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: Document.doc.scr, type: SAMPLE Matched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
Source: 0.0.Document.doc.scr.d40000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
Source: 00000000.00000000.2009802642.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY Matched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
Source: classification engine Classification label: mal100.rans.phis.spyw.evad.winSCR@9/1690@0/0
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2516:120:WilError_03
Source: C:\ProgramData\D4EC.tmp Mutant created: \Sessions\1\BaseNamedObjects\Global\{649F4E29-16CB-DD42-8922-9FFF0592856B}
Source: C:\Users\user\Desktop\Document.doc.scr Mutant created: \Sessions\1\BaseNamedObjects\Global\559f5d4bd4c12afc7974358d21edb1f1
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Windows\splwow64.exe File read: C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\SendToOneNote-manifest.ini
Source: C:\Users\user\Desktop\Document.doc.scr Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Document.doc.scr ReversingLabs: Detection: 71%
Source: Document.doc.scr Virustotal: Detection: 78%
Source: unknown Process created: C:\Users\user\Desktop\Document.doc.scr "C:\Users\user\Desktop\Document.doc.scr" /S
Source: C:\Users\user\Desktop\Document.doc.scr Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Users\user\Desktop\Document.doc.scr Process created: C:\ProgramData\D4EC.tmp "C:\ProgramData\D4EC.tmp"
Source: C:\ProgramData\D4EC.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D4EC.tmp >> NUL
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE /insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{082B68BB-AD41-4487-9321-7D0501AE003B}.xps" 133583950932070000
Source: C:\Users\user\Desktop\Document.doc.scr Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Process created: C:\ProgramData\D4EC.tmp "C:\ProgramData\D4EC.tmp" Jump to behavior
Source: C:\ProgramData\D4EC.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D4EC.tmp >> NUL
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: logoncli.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: activeds.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: adsldpc.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: gpedit.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: dssec.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: dsuiext.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: framedynos.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: dsrole.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: ntdsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: authz.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: adsldp.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: sxs.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: mscms.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: coloradapterclient.dll Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Section loaded: textshaping.dll Jump to behavior
Source: C:\ProgramData\D4EC.tmp Section loaded: apphelp.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: rstrtmgr.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: ncrypt.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: ntasn1.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: windows.storage.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: wldp.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: kernel.appcore.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: uxtheme.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: propsys.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: profapi.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: edputil.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: urlmon.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: iertutil.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: srvcli.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: netutils.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: windows.staterepositoryps.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: sspicli.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: wintypes.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: appresolver.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: bcp47langs.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: slc.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: userenv.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: sppc.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: onecorecommonproxystub.dll
Source: C:\ProgramData\D4EC.tmp Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Desktop\Document.doc.scr Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
Source: Document.doc.scr Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Document.doc.scr Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2n source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: p.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.kZd6jLIwz source: Document.doc.scr, 00000000.00000003.2061156800.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2062462577.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068373022.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067060328.0000000001238000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001154000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.kZd6jLIwz source: Document.doc.scr, 00000000.00000003.2061156800.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2062462577.0000000001238000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: Document.doc.scr, 00000000.00000003.2064531991.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059520677.000000000111C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ownload.errorIwz+ source: Document.doc.scr, 00000000.00000003.2074121235.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.kZd6jLIwzg source: Document.doc.scr, 00000000.00000003.2061156800.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2062462577.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068373022.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067060328.0000000001238000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\*# source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\kZd6jLIwz.README.txt`/ source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001154000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: Document.doc.scr, 00000000.00000003.2064531991.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068087626.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068615252.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059520677.000000000111C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001154000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\kZd6jLIwz.README.txtb source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: _prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2n source: Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831s source: Document.doc.scr, 00000000.00000003.2064531991.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068087626.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2071652569.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068615252.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2071891357.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059520677.000000000111C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\kZd6jLIwz.README.txt source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ice\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\Zd6jLIwz.README.txtz source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorzg1 source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001154000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Zd6jLIwz.README.txtson source: Document.doc.scr, 00000000.00000003.2074121235.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2075417986.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2077533300.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2076804926.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2074863636.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2076053252.0000000001136000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.kZd6jLIwzxt source: Document.doc.scr, 00000000.00000003.2074121235.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2075417986.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2076804926.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2074863636.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2076053252.0000000001136000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Zd6jLIwz.README.txt@ source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\Zd6jLIwz.README.txt5 source: Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\g source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001154000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\kZd6jLIwz.README.txt source: Document.doc.scr, 00000000.00000003.2061156800.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2062462577.0000000001238000.00000004.00000020.00020000.00000000.sdmp
PE file contains an invalid checksum
Source: Document.doc.scr Static PE information: real checksum: 0x30e46 should be: 0x36685
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Videos\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Searches\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Saved Games\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Recent\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Pictures\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Pictures\Saved Pictures\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Pictures\Camera Roll\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\OneDrive\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Music\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Links\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Favorites\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Favorites\Links\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Downloads\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\ZGGKNSUKOP\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\UNKRLCVOHV\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\NYMMPCEIMA\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\NVWZAPQSQL\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\JDDHMPCDUJ\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\HMPPSXQPQV\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\GRXZDKKVDB\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\EOWRVPQCCS\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Documents\EFOYFBOLXA\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\ZGGKNSUKOP\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\UNKRLCVOHV\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\NYMMPCEIMA\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\NVWZAPQSQL\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\JDDHMPCDUJ\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\HMPPSXQPQV\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\GRXZDKKVDB\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\EOWRVPQCCS\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Desktop\EFOYFBOLXA\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\Contacts\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Mozilla\Extensions\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Sonar\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\RTTransfer\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Linguistics\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Headlights\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\Linguistics\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\VideoDecodeStats\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\dd432c4a-ba38-4070-9985-ed1b3bea85dc\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\assets\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\VirtualStore\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\Symbols\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_5172_761252224\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_5172_1791500899\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_2640_817343797\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\mozilla-temp-files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\Low\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_995017740\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_778675694\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_736602331\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_649288342\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_339006160\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_27162369\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1988346647\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1959985254\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1807723660\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1693012001\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1635976352\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1619438387\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1485273224\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1421574262\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1318414972\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1289371347\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1234978473\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1191663050\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1090636871\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\Diagnostics\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrocef_low\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\SolidDocuments\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\SolidDocuments\Acrobat\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Publishers\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\SettingsContainer\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Microsoft.WindowsAlarms\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Licenses\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Fonts\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\PeerDistRepub\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\BackgroundTransferApi\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\Flighting\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{99fff775-938d-4e2c-9c06-5d56107a5383}\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{2737c7bb-35fb-4b44-baf9-033ca587595d}\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4e763a36-90d3-4d6c-9949-dd01f7e5d23f}\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ea91a05a-d98f-4429-81a9-272df0335447}\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{de0f148a-c476-467a-b7a3-14b0bb463140}\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{880da644-c864-4aed-9e06-5b089e06c09e}\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Deletes itself after installation
Source: C:\ProgramData\D4EC.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D4EC.tmp >> NUL
Source: C:\ProgramData\D4EC.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D4EC.tmp >> NUL
Uses an obfuscated file name to hide its real file extension (double extension)
Source: Possible double extension: doc.scr Static PE information: Document.doc.scr
Source: C:\Users\user\Desktop\Document.doc.scr Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX Jump to behavior
Source: C:\ProgramData\D4EC.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\D4EC.tmp Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\ProgramData\D4EC.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\D4EC.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\D4EC.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\D4EC.tmp Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\ProgramData\D4EC.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\D4EC.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\D4EC.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\D4EC.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\D4EC.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\D4EC.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\D4EC.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\ProgramData\D4EC.tmp Process information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE Process information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Source: C:\ProgramData\D4EC.tmp Code function: 8_2_00401E28 8_2_00401E28
Contains functionality for execution timing, often used to detect debuggers
Source: C:\ProgramData\D4EC.tmp Code function: 8_2_00401E28 rdtsc 8_2_00401E28
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\ProgramData\D4EC.tmp Code function: 8_2_0040227C FindFirstFileExW, 8_2_0040227C
Source: C:\ProgramData\D4EC.tmp Code function: 8_2_0040152C FindFirstFileExW,FindClose,FindNextFileW,FindClose, 8_2_0040152C
Source: C:\Windows\splwow64.exe Thread delayed: delay time: 120000
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\ Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\ Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\ Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\ Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\ Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\ Jump to behavior
Source: Document.doc.scr, 00000000.00000003.2132078796.00000000011A0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: hyper-v:wux:hyper-v~
Source: Document.doc.scr, 00000000.00000003.2067796880.0000000001186000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 10/04/2023 14:08:59.672EXCEL (0x145C)0x7E8Microsoft ExcelTelemetry Eventb7vzqMediumSendEvent {"EventName":"Office.System.SystemHealthMetadataDeviceConsolidated","Flags":33777031581908737,"InternalSequenceNumber":149,"Time":"2023-10-04T14:08:57.331Z","Rule":"120600.4","Contract":"Office.Legacy.Metadata","Data.ProcTypeText":"x64","Data.ProcessorCount":2,"Data.NumProcShareSingleCore":1,"Data.NumProcShareSingleCache":1,"Data.NumProcPhysCores":2,"Data.ProcSpeedMHz":2000,"Data.IsLaptop":false,"Data.IsTablet":false,"Data.RamMB":4096,"Data.PowerPlatformRole":1,"Data.SysVolSizeMB":50000,"Data.DeviceManufacturer":"VMWare, Inc.","Data.DeviceModel":"VMware20,1","Data.DigitizerInfo":0,"Data.SusClientId":"097C77FB-5D5D-4868-860B-09F4E5B50A53","Data.WindowsSqmMachineId":"92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","Data.ComputerSystemProductUuidHash":"LFm9Ltrk4S277wbAA8Obddw+Rm4=","Data.DeviceProcessorModel":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","Data.HasSpectreFix":true,"Data.BootDiskType":"SSD"}
Source: Document.doc.scr, 00000000.00000003.2057593273.00000000011BE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 10/04/2023 15:50:56.369OFFICECL (0xe04)0x250Telemetry EventbiyhqMediumSendEvent {"EventName": "Office.System.SystemHealthMetadataDeviceConsolidated", "Flags": 33777031581908737, "InternalSequenceNumber": 551, "Time": "2023-10-04T13:50:46Z", "Rule": "120600.4", "AriaTenantToken": "cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521", "Contract": "Office.Legacy.Metadata", "Data.ProcTypeText": "x64", "Data.ProcessorCount": 2, "Data.NumProcShareSingleCore": 1, "Data.NumProcShareSingleCache": 1, "Data.NumProcPhysCores": 2, "Data.ProcSpeedMHz": 2000, "Data.IsLaptop": false, "Data.IsTablet": false, "Data.RamMB": 4096, "Data.PowerPlatformRole": 1, "Data.SysVolSizeMB": 50000, "Data.DeviceManufacturer": "VMWare, Inc.", "Data.DeviceModel": "VMware20,1", "Data.DigitizerInfo": 0, "Data.SusClientId": "097C77FB-5D5D-4868-860B-09F4E5B50A53", "Data.WindowsSqmMachineId": "92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A", "Data.ComputerSystemProductUuidHash": "LFm9Ltrk4S277wbAA8Obddw+Rm4=", "Data.DeviceProcessorModel": "Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "Data.HasSpectreFix": true, "Data.BootDiskType": "SSD"}
Source: C:\Users\user\Desktop\Document.doc.scr Process information queried: ProcessInformation

Anti Debugging
barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\Document.doc.scr Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Thread information set: HideFromDebugger Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr Thread information set: HideFromDebugger Jump to behavior
Source: C:\ProgramData\D4EC.tmp Thread information set: HideFromDebugger
Contains functionality for execution timing, often used to detect debuggers
Source: C:\ProgramData\D4EC.tmp Code function: 8_2_00401E28 rdtsc 8_2_00401E28
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\ProgramData\D4EC.tmp Code function: 8_2_00401474 LdrLoadDll, 8_2_00401474
Enables debug privileges
Source: C:\Users\user\Desktop\Document.doc.scr Process token adjusted: Debug
Source: C:\Users\user\Desktop\Document.doc.scr Process token adjusted: Debug
Source: C:\Users\user\Desktop\Document.doc.scr Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion
barindex
Writes to foreign memory regions
Source: C:\Users\user\Desktop\Document.doc.scr Memory written: C:\ProgramData\D4EC.tmp base: 401000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Document.doc.scr Process created: C:\ProgramData\D4EC.tmp "C:\ProgramData\D4EC.tmp" Jump to behavior
Source: C:\ProgramData\D4EC.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D4EC.tmp >> NUL
Contains functionality to query CPU information (cpuid)
Source: C:\ProgramData\D4EC.tmp Code function: 8_2_00401E28 cpuid 8_2_00401E28
Contains functionality to query locales information (e.g. system language)
Source: C:\ProgramData\D4EC.tmp Code function: EntryPoint,ExitProcess,GetModuleHandleW,GetCommandLineW,GetModuleHandleA,GetCommandLineW,GetLocaleInfoW,GetLastError,FreeLibrary,FreeLibrary,GetProcAddress,CreateWindowExW,DefWindowProcW,GetWindowTextW,LoadMenuW,LoadMenuW,DefWindowProcW,SetTextColor,GetTextCharset,TextOutW,SetTextColor,GetTextColor,CreateFontW,GetTextColor,CreateDIBitmap,SelectObject,GetTextColor,CreateFontW, 8_2_00403983

Lowering of HIPS / PFW / Operating System Security Settings
barindex
Overwrites Mozilla Firefox settings
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events\kZd6jLIwz.README.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups\kZd6jLIwz.README.txt Jump to behavior

Stealing of Sensitive Information
barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\43bb9a55-74a2-452e-8233-6899a7f737b0.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.86be03dd-6b03-42f5-89cd-4606f43d25ad.health.jsonlz4.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\3c7034d6-bc52-43bb-9a23-5da34ee205e0.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835635.a669692a-f9c9-42c0-a803-7b87d3ff5834.new-profile.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\b8f053a5-de16-4a2c-8120-1ab4aadd63e8 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\events.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.01c0ecdb-8e59-4210-95f1-0fd0406e84ad.event.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\search.json.mozlz4 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\AlternateServices.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840708.3c7034d6-bc52-43bb-9a23-5da34ee205e0.health.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\previous.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.01c0ecdb-8e59-4210-95f1-0fd0406e84ad.event.jsonlz4.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\3c7034d6-bc52-43bb-9a23-5da34ee205e0 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shm.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\session-state.json.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\events Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.json.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\a83301c6-790b-49f3-adc7-55a855f7fe79 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\.metadata-v2 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\state.json.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\AlternateServices.txt.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\previous.jsonlz4.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\7755ad51-2370-4623-9d21-15c89f2143db.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\containers.json.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\search.json.mozlz4.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\a83301c6-790b-49f3-adc7-55a855f7fe79.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\background-update.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835635.a669692a-f9c9-42c0-a803-7b87d3ff5834.new-profile.jsonlz4.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\containers.json Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\handlers.json Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.json Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\.metadata-v2.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\pkcs11.txt.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore.jsonlz4.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\pkcs11.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\43bb9a55-74a2-452e-8233-6899a7f737b0 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835649.b06d08be-79e8-4bfe-b6aa-988ea3d35cbd.first-shutdown.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840748.a8c1f564-c2e2-4ef8-a85f-52a56488f193.main.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\session-state.json Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835643.9a3c31ca-35e4-421e-91e1-5f7b9bd27492.event.jsonlz4.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\times.json Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\7755ad51-2370-4623-9d21-15c89f2143db Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\SiteSecurityServiceState.txt.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835643.9a3c31ca-35e4-421e-91e1-5f7b9bd27492.event.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.86be03dd-6b03-42f5-89cd-4606f43d25ad.health.jsonlz4 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840708.3c7034d6-bc52-43bb-9a23-5da34ee205e0.health.jsonlz4.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\b8f053a5-de16-4a2c-8120-1ab4aadd63e8.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\state.json Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\ae04dde8-69a1-49f8-95f1-d533ed587ff6 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4 Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\handlers.json.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\times.json.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\shield-preference-experiments.json Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\ae04dde8-69a1-49f8-95f1-d533ed587ff6.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\background-update Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835649.b06d08be-79e8-4bfe-b6aa-988ea3d35cbd.first-shutdown.jsonlz4.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840748.a8c1f564-c2e2-4ef8-a85f-52a56488f193.main.jsonlz4.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\shield-preference-experiments.json.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.kZd6jLIwz Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\SiteSecurityServiceState.txt Jump to behavior
Source: C:\Users\user\Desktop\Document.doc.scr File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1430701 Sample: Document.doc.scr Startdate: 24/04/2024 Architecture: WINDOWS Score: 100 40 Malicious sample detected (through community Yara rule) 2->40 42 Antivirus / Scanner detection for submitted sample 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 6 other signatures 2->46 8 Document.doc.scr 32 1002 2->8         started        12 ONENOTE.EXE 2->12         started        process3 file4 24 3870112724rsegmnoi...es.sqlite.kZd6jLIwz, data 8->24 dropped 26 3870112724rsegmnoi...qlite-shm.kZd6jLIwz, data 8->26 dropped 28 C:\Users\user\...\kZd6jLIwz.README.txt, ASCII 8->28 dropped 30 171 other files (168 malicious) 8->30 dropped 48 Overwrites Mozilla Firefox settings 8->48 50 Tries to harvest and steal browser information (history, passwords, etc) 8->50 52 Writes to foreign memory regions 8->52 54 4 other signatures 8->54 14 D4EC.tmp 8->14         started        18 splwow64.exe 8->18         started        signatures5 process6 file7 32 C:\Users\user\...\ZZZZZZZZZZZZZZZZ (copy), data 14->32 dropped 34 C:\Users\user\...\YYYYYYYYYYYYYYYY (copy), data 14->34 dropped 36 C:\Users\user\...\XXXXXXXXXXXXXXXX (copy), data 14->36 dropped 38 24 other malicious files 14->38 dropped 56 Contains functionality to detect hardware virtualization (CPUID execution measurement) 14->56 58 Writes many files with high entropy 14->58 60 Hides threads from debuggers 14->60 62 Deletes itself after installation 14->62 20 cmd.exe 14->20         started        signatures8 process9 process10 22 conhost.exe 20->22         started       
⊘No contacted IP infos