Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Document.doc.scr

Overview

General Information

Sample name:Document.doc.scr
Analysis ID:1430701
MD5:ae811bd6440b425e6777f0ca001a9743
SHA1:70902540ead269971e149eaff568fb17d04156af
SHA256:86e17aa882c690ede284f3e445439dfe589d8f36e31cbc09d102305499d5c498
Infos:

Detection

LockBit ransomware, TrojanRansom
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Found ransom note / readme
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected LockBit ransomware
Yara detected TrojanRansom
Changes the wallpaper picture
Contains functionality to detect hardware virtualization (CPUID execution measurement)
Deletes itself after installation
Hides threads from debuggers
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Overwrites Mozilla Firefox settings
Tries to harvest and steal browser information (history, passwords, etc)
Uses an obfuscated file name to hide its real file extension (double extension)
Writes many files with high entropy
Writes to foreign memory regions
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Enables debug privileges
Enables security privileges
PE file contains an invalid checksum
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Potentially Suspicious Desktop Background Change Via Registry
Uses 32bit PE files
Yara signature match

Classification

Process Tree

  • System is w10x64
  • Document.doc.scr (PID: 6084 cmdline: "C:\Users\user\Desktop\Document.doc.scr" /S MD5: AE811BD6440B425E6777F0CA001A9743)
    • splwow64.exe (PID: 3652 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)
    • D4EC.tmp (PID: 5616 cmdline: "C:\ProgramData\D4EC.tmp" MD5: 294E9F64CB1642DD89229FFF0592856B)
      • cmd.exe (PID: 4824 cmdline: "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D4EC.tmp >> NUL MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
        • conhost.exe (PID: 2516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • ONENOTE.EXE (PID: 4852 cmdline: /insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{082B68BB-AD41-4487-9321-7D0501AE003B}.xps" 133583950932070000 MD5: 0061760D72416BCF5F2D9FA6564F0BEA)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
Document.doc.scrJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
    Document.doc.scrWindows_Ransomware_Lockbit_369e1e94unknownunknown
    • 0x1861d:$a2: 8B EC 53 56 57 33 C0 8B 5D 14 33 C9 33 D2 8B 75 0C 8B 7D 08 85 F6 74 33 55 8B 6D 10 8A 54 0D 00 02 D3 8A 5C 15 00 8A 54 1D 00
    • 0x4bc:$a3: 53 51 6A 01 58 0F A2 F7 C1 00 00 00 40 0F 95 C0 84 C0 74 09 0F C7 F0 0F C7 F2 59 5B C3 6A 07 58 33 C9 0F A2 F7 C3 00 00 04 00 0F 95 C0 84 C0 74 09 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ...

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    00000000.00000000.2009802642.0000000000D41000.00000020.00000001.01000000.00000003.sdmpJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
      00000000.00000000.2009802642.0000000000D41000.00000020.00000001.01000000.00000003.sdmpWindows_Ransomware_Lockbit_369e1e94unknownunknown
      • 0x1841d:$a2: 8B EC 53 56 57 33 C0 8B 5D 14 33 C9 33 D2 8B 75 0C 8B 7D 08 85 F6 74 33 55 8B 6D 10 8A 54 0D 00 02 D3 8A 5C 15 00 8A 54 1D 00
      • 0xbc:$a3: 53 51 6A 01 58 0F A2 F7 C1 00 00 00 40 0F 95 C0 84 C0 74 09 0F C7 F0 0F C7 F2 59 5B C3 6A 07 58 33 C9 0F A2 F7 C3 00 00 04 00 0F 95 C0 84 C0 74 09 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ...
      Process Memory Space: Document.doc.scr PID: 6084JoeSecurity_TrojanRansomYara detected TrojanRansomJoe Security

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        0.0.Document.doc.scr.d40000.0.unpackJoeSecurity_LockBit_ransomwareYara detected LockBit ransomwareJoe Security
          0.0.Document.doc.scr.d40000.0.unpackWindows_Ransomware_Lockbit_369e1e94unknownunknown
          • 0x1861d:$a2: 8B EC 53 56 57 33 C0 8B 5D 14 33 C9 33 D2 8B 75 0C 8B 7D 08 85 F6 74 33 55 8B 6D 10 8A 54 0D 00 02 D3 8A 5C 15 00 8A 54 1D 00
          • 0x4bc:$a3: 53 51 6A 01 58 0F A2 F7 C1 00 00 00 40 0F 95 C0 84 C0 74 09 0F C7 F0 0F C7 F2 59 5B C3 6A 07 58 33 C9 0F A2 F7 C3 00 00 04 00 0F 95 C0 84 C0 74 09 0F C7 F8 0F C7 FA 59 5B C3 0F 31 8B C8 C1 C9 ...

          Sigma Signatures

          System Summary

          barindex
          Sigma detected: Potentially Suspicious Desktop Background Change Via Registry
          Source: Registry Key setAuthor: Nasreddine Bencherchali (Nextron Systems), Stephen Lincoln @slincoln-aiq (AttackIQ): Data: Details: C:\ProgramData\kZd6jLIwz.bmp, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Document.doc.scr, ProcessId: 6084, TargetObject: HKEY_CURRENT_USER\Control Panel\Desktop\WallPaper

          Snort Signatures

          ⊘No Snort rule has matched

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Antivirus / Scanner detection for submitted sample
          Source: Document.doc.scrAvira: detected
          Multi AV Scanner detection for submitted file
          Source: Document.doc.scrReversingLabs: Detection: 71%
          Source: Document.doc.scrVirustotal: Detection: 78%Perma Link
          Machine Learning detection for sample
          Source: Document.doc.scrJoe Sandbox ML: detected
          Source: Document.doc.scrStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Videos\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Searches\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Saved Games\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Recent\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Pictures\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Pictures\Saved Pictures\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Pictures\Camera Roll\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\OneDrive\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Music\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Links\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Favorites\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Favorites\Links\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Downloads\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\ZGGKNSUKOP\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\UNKRLCVOHV\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\NYMMPCEIMA\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\NVWZAPQSQL\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\JDDHMPCDUJ\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\HMPPSXQPQV\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\GRXZDKKVDB\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\EOWRVPQCCS\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\EFOYFBOLXA\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\ZGGKNSUKOP\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\UNKRLCVOHV\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\NYMMPCEIMA\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\NVWZAPQSQL\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\JDDHMPCDUJ\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\HMPPSXQPQV\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\GRXZDKKVDB\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\EOWRVPQCCS\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\EFOYFBOLXA\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Contacts\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Extensions\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Sonar\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\RTTransfer\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Linguistics\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Headlights\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\Linguistics\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\VideoDecodeStats\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\dd432c4a-ba38-4070-9985-ed1b3bea85dc\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\assets\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\VirtualStore\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\Symbols\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_5172_761252224\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_5172_1791500899\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_2640_817343797\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\mozilla-temp-files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\Low\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_995017740\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_778675694\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_736602331\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_649288342\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_339006160\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_27162369\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1988346647\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1959985254\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1807723660\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1693012001\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1635976352\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1619438387\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1485273224\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1421574262\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1318414972\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1289371347\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1234978473\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1191663050\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1090636871\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrocef_low\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\SolidDocuments\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\SolidDocuments\Acrobat\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Publishers\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\SettingsContainer\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Microsoft.WindowsAlarms\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Licenses\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Fonts\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\PeerDistRepub\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\BackgroundTransferApi\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\Flighting\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{99fff775-938d-4e2c-9c06-5d56107a5383}\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{2737c7bb-35fb-4b44-baf9-033ca587595d}\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4e763a36-90d3-4d6c-9949-dd01f7e5d23f}\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ea91a05a-d98f-4429-81a9-272df0335447}\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{de0f148a-c476-467a-b7a3-14b0bb463140}\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{880da644-c864-4aed-9e06-5b089e06c09e}\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: Document.doc.scrStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
          Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2n source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: p.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.kZd6jLIwz source: Document.doc.scr, 00000000.00000003.2061156800.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2062462577.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068373022.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067060328.0000000001238000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001154000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.kZd6jLIwz source: Document.doc.scr, 00000000.00000003.2061156800.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2062462577.0000000001238000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: Document.doc.scr, 00000000.00000003.2064531991.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059520677.000000000111C000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ownload.errorIwz+ source: Document.doc.scr, 00000000.00000003.2074121235.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.kZd6jLIwzg source: Document.doc.scr, 00000000.00000003.2061156800.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2062462577.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068373022.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067060328.0000000001238000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\*# source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\kZd6jLIwz.README.txt`/ source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001154000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: Document.doc.scr, 00000000.00000003.2064531991.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068087626.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068615252.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059520677.000000000111C000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001154000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\kZd6jLIwz.README.txtb source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: _prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2n source: Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831s source: Document.doc.scr, 00000000.00000003.2064531991.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068087626.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2071652569.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068615252.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2071891357.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059520677.000000000111C000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\kZd6jLIwz.README.txt source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: ice\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\Zd6jLIwz.README.txtz source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorzg1 source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001154000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Zd6jLIwz.README.txtson source: Document.doc.scr, 00000000.00000003.2074121235.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2075417986.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2077533300.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2076804926.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2074863636.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2076053252.0000000001136000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.kZd6jLIwzxt source: Document.doc.scr, 00000000.00000003.2074121235.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2075417986.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2076804926.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2074863636.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2076053252.0000000001136000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Zd6jLIwz.README.txt@ source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\Zd6jLIwz.README.txt5 source: Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\g source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001154000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\kZd6jLIwz.README.txt source: Document.doc.scr, 00000000.00000003.2061156800.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2062462577.0000000001238000.00000004.00000020.00020000.00000000.sdmp
          Source: C:\ProgramData\D4EC.tmpCode function: 8_2_0040227C FindFirstFileExW,8_2_0040227C
          Source: C:\ProgramData\D4EC.tmpCode function: 8_2_0040152C FindFirstFileExW,FindClose,FindNextFileW,FindClose,8_2_0040152C
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Jump to behavior
          Source: Document.doc.scr, 00000000.00000003.2058457962.0000000001154000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/privacy-sdx.win32.bundle.js.map/e3b0c4429
          Source: Document.doc.scr, 00000000.00000003.2058198747.0000000001238000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/ui.win32.js.map/d6bb35bc608af2672a5b746ba
          Source: Document.doc.scr, 00000000.00000003.2058198747.0000000001238000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://clients3.google.com/generate_204
          Source: Document.doc.scr, 00000000.00000003.2058198747.0000000001238000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://github.com/react-native-community/react-native-netinfo
          Source: App1713921509308663900_6D1069C2-A1FE-4969-8A18-9CD73AF4AF15.log.11.drString found in binary or memory: https://login.windows.net
          Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001230000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2032462071.0000000001228000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org
          Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001238000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
          Source: Document.doc.scr, 00000000.00000003.2032462071.00000000011BF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefox
          Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001238000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
          Source: Document.doc.scr, 00000000.00000003.2061156800.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2092684104.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2019781196.0000000001156000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2119320978.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2103612240.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2122420148.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2123563496.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2035440830.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2020875656.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2128470332.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2097170059.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2096070849.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2094172163.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2033390092.0000000001126000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2033154751.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2106278279.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2128740161.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2122743679.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2096396555.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2119133098.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2128345601.0000000001137000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tox.chat/
          Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001230000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2032462071.0000000001228000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
          Source: Document.doc.scr, 00000000.00000003.2032462071.00000000011BF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/
          Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001238000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
          Source: Document.doc.scr, 00000000.00000003.2032462071.00000000011BF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/
          Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001238000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
          Source: Document.doc.scr, 00000000.00000003.2032462071.00000000011BF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
          Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001238000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
          Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001238000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
          Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001238000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
          Source: Document.doc.scr, 00000000.00000003.2032462071.0000000001238000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

          Spam, unwanted Advertisements and Ransom Demands

          barindex
          Found ransom note / readme
          Source: C:\Users\user\AppData\Local\Packages\Microsoft.UI.Xaml.2.0_8wekyb3d8bbwe\kZd6jLIwz.README.txtDropped file: !! ALL YOUR FILES HAS BEEN ENCRYPTED !!!You can't restore them without our encryptor.Don't try to use any public tools, you could damage the encrypted files and lose them forever.To make sure our encryptor works, contact us and encrypt one file for free.Download TOX messenger: https://tox.chat/Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6Jump to dropped file
          Yara detected LockBit ransomware
          Source: Yara matchFile source: Document.doc.scr, type: SAMPLE
          Source: Yara matchFile source: 0.0.Document.doc.scr.d40000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000000.00000000.2009802642.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
          Yara detected TrojanRansom
          Source: Yara matchFile source: Process Memory Space: Document.doc.scr PID: 6084, type: MEMORYSTR
          Changes the wallpaper picture
          Source: C:\Users\user\Desktop\Document.doc.scrKey value created or modified: HKEY_CURRENT_USER\Control Panel\Desktop WallPaper C:\ProgramData\kZd6jLIwz.bmpJump to behavior
          Modifies existing user documents (likely ransomware behavior)
          Source: C:\Users\user\Desktop\Document.doc.scrFile moved: C:\Users\user\Desktop\GRXZDKKVDB.pdfJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile moved: C:\Users\user\Desktop\NVWZAPQSQL\EFOYFBOLXA.xlsxJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile moved: C:\Users\user\Desktop\KLIZUSIQEN.mp3Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile moved: C:\Users\user\Desktop\GRXZDKKVDB\QCOILOQIKC.pngJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile moved: C:\Users\user\Desktop\EFOYFBOLXA\ZGGKNSUKOP.jpgJump to behavior
          Writes many files with high entropy
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{880da644-c864-4aed-9e06-5b089e06c09e}\Apps.ft.kZd6jLIwz entropy: 7.99649721103Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{116229A7-9A3B-2078-DB5F-B5A20811242C}.kZd6jLIwz entropy: 7.99523188518Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_.kZd6jLIwz entropy: 7.99554410232Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome.kZd6jLIwz entropy: 7.99573369008Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\308046B0AF4A39CB;PrivateBrowsingAUMID.kZd6jLIwz entropy: 7.99401658243Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\308046B0AF4A39CB.kZd6jLIwz entropy: 7.99566924346Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4e763a36-90d3-4d6c-9949-dd01f7e5d23f}\settingsconversions.txt.kZd6jLIwz entropy: 7.99742769817Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_help.kZd6jLIwz entropy: 7.99509484272Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{E8B84CFB-B069-BC13-F88F-170904F645E5}.kZd6jLIwz entropy: 7.99501574529Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{E7A33582-E908-3379-5368-5999454DCD83}.kZd6jLIwz entropy: 7.9953360237Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{DAA168DE-4306-C8BC-8C11-B596240BDDED}.kZd6jLIwz entropy: 7.99574508197Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{C804BBA7-FA5F-CBF7-8B55-2096E5F972CB}.kZd6jLIwz entropy: 7.99534531929Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{C1C6F8AC-40A3-0F5C-146F-65A9DC70BBB4}.kZd6jLIwz entropy: 7.99525185364Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{BD3F924E-55FB-A1BA-9DE6-B50F9F2460AC}.kZd6jLIwz entropy: 7.99483351484Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{BB044BFD-25B7-2FAA-22A8-6371A93E0456}.kZd6jLIwz entropy: 7.99529652587Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{923DD477-5846-686B-A659-0FCCD73851A8}.kZd6jLIwz entropy: 7.99564666808Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{8AA47365-B2B3-1961-69EB-F866E376B12F}.kZd6jLIwz entropy: 7.99424644168Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{8ABD94FB-E7D6-84A6-A997-C918EDDE0AE5}.kZd6jLIwz entropy: 7.99521020045Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{16988324-21C9-05B2-CA60-9B4EC72739D8}.kZd6jLIwz entropy: 7.99548201832Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_InternetExplorer_Default.kZd6jLIwz entropy: 7.99533203034Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{F1118828-A0CC-5FEB-85C9-DBFFDF98434A}.kZd6jLIwz entropy: 7.99499029175Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696428527628431800_6CD9E3BB-4D03-46BD-8615-75A902267162.log.kZd6jLIwz entropy: 7.99886958591Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt.kZd6jLIwz entropy: 7.99263829327Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_POWERPNT_EXE_15.kZd6jLIwz entropy: 7.99540409773Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_ONENOTE_EXE_15.kZd6jLIwz entropy: 7.99577592479Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_OUTLOOK_EXE_15.kZd6jLIwz entropy: 7.99453097905Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_OcPubMgr_exe_15.kZd6jLIwz entropy: 7.99568419068Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_MSPUB_EXE_15.kZd6jLIwz entropy: 7.99464541574Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_msoev_exe_15.kZd6jLIwz entropy: 7.99480104287Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_MSACCESS_EXE_15.kZd6jLIwz entropy: 7.99546256381Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_lync_exe_15.kZd6jLIwz entropy: 7.99582200782Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_EXCEL_EXE_15.kZd6jLIwz entropy: 7.99511059573Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_DATABASECOMPARE_EXE_15.kZd6jLIwz entropy: 7.99558329334Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsCalculator_8wekyb3d8bbwe!App.kZd6jLIwz entropy: 7.99478919663Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsAlarms_8wekyb3d8bbwe!App.kZd6jLIwz entropy: 7.99455623225Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_SkyDrive_Desktop.kZd6jLIwz entropy: 7.99493855377Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_WINWORD_EXE_15.kZd6jLIwz entropy: 7.99530224972Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SPREADSHEETCOMPARE_EXE_15.kZd6jLIwz entropy: 7.99487191119Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15.kZd6jLIwz entropy: 7.99453166118Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_RemoteDesktop.kZd6jLIwz entropy: 7.9947726418Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_MediaPlayer32.kZd6jLIwz entropy: 7.99462833027Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer.kZd6jLIwz entropy: 7.99569910214Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel.kZd6jLIwz entropy: 7.99535122519Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Computer.kZd6jLIwz entropy: 7.99392611384Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_AdministrativeTools.kZd6jLIwz entropy: 7.99550887738Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsSoundRecorder_8wekyb3d8bbwe!App.kZd6jLIwz entropy: 7.99575224475Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe.kZd6jLIwz entropy: 7.99540715086Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\MSEdge.kZd6jLIwz entropy: 7.99481120989Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Shell_RunDialog.kZd6jLIwz entropy: 7.99513027448Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Photos_8wekyb3d8bbwe!App.kZd6jLIwz entropy: 7.99445572812Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.kZd6jLIwz entropy: 7.99542044303Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_narrator_exe.kZd6jLIwz entropy: 7.99567743952Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_mspaint_exe.kZd6jLIwz entropy: 7.99453699242Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_msinfo32_exe.kZd6jLIwz entropy: 7.99495672881Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_msconfig_exe.kZd6jLIwz entropy: 7.99502118481Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_MdSched_exe.kZd6jLIwz entropy: 7.99465147905Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_magnify_exe.kZd6jLIwz entropy: 7.99569510728Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_iscsicpl_exe.kZd6jLIwz entropy: 7.99463264698Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_dfrgui_exe.kZd6jLIwz entropy: 7.99464874896Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_cmd_exe.kZd6jLIwz entropy: 7.99550873446Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_cleanmgr_exe.kZd6jLIwz entropy: 7.99505289123Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_osk_exe.kZd6jLIwz entropy: 7.99447542688Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_odbcad32_exe.kZd6jLIwz entropy: 7.9947430509Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WF_msc.kZd6jLIwz entropy: 7.99544654027Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WFS_exe.kZd6jLIwz entropy: 7.99512581065Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_SnippingTool_exe.kZd6jLIwz entropy: 7.99475432434Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_services_msc.kZd6jLIwz entropy: 7.99569765261Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_RecoveryDrive_exe.kZd6jLIwz entropy: 7.99458353054Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_quickassist_exe.kZd6jLIwz entropy: 7.99471681339Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_psr_exe.kZd6jLIwz entropy: 7.99465507322Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_printmanagement_msc.kZd6jLIwz entropy: 7.99496994215Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_notepad_exe.kZd6jLIwz entropy: 7.9947342424Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.kZd6jLIwz entropy: 7.99402821541Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.kZd6jLIwz entropy: 7.99557890385Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm.kZd6jLIwz entropy: 7.99430835507Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.kZd6jLIwz entropy: 7.99618659133Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.kZd6jLIwz entropy: 7.99421459035Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.kZd6jLIwz entropy: 7.99391676944Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.kZd6jLIwz entropy: 7.99647406611Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.kZd6jLIwz entropy: 7.99608561191Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm.kZd6jLIwz entropy: 7.99509943836Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.kZd6jLIwz entropy: 7.99401181452Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\a83301c6-790b-49f3-adc7-55a855f7fe79.kZd6jLIwz entropy: 7.99742212477Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4.kZd6jLIwz entropy: 7.99154559317Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835649.b06d08be-79e8-4bfe-b6aa-988ea3d35cbd.first-shutdown.jsonlz4.kZd6jLIwz entropy: 7.99095702593Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\C5FD1F724F49F95970FE8CD30C20519BF4582045.kZd6jLIwz entropy: 7.99860688566Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\DED23BB33EA3C88FAD1C0A1CD53916E0D8C424D3.kZd6jLIwz entropy: 7.99017281948Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F.kZd6jLIwz entropy: 7.9955367358Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\E707EC8A256322E87908664A49F800B7B48E0961.kZd6jLIwz entropy: 7.99073920348Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\E557A7C6ADAC24EDE9B88CACC662B8A371C1931D.kZd6jLIwz entropy: 7.99673880111Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.kZd6jLIwz entropy: 7.9915300862Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db.kZd6jLIwz entropy: 7.99654780243Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed\14645.kZd6jLIwz entropy: 7.99541544669Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\index.kZd6jLIwz entropy: 7.99928197778Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1.kZd6jLIwz entropy: 7.99930631339Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\index.kZd6jLIwz entropy: 7.99924656929Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1.kZd6jLIwz entropy: 7.99929530778Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1.kZd6jLIwz entropy: 7.99936441339Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\index.kZd6jLIwz entropy: 7.99929728515Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db-shm.kZd6jLIwz entropy: 7.99451929938Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.kZd6jLIwz entropy: 7.99853102707Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Aut2Exe_Aut2exe_x64_exe.kZd6jLIwz entropy: 7.99557202315Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Au3Info_exe.kZd6jLIwz entropy: 7.99455051294Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Windows NT_Accessories_wordpad_exe.kZd6jLIwz entropy: 7.99480537174Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Common Files_Microsoft Shared_Ink_mip_exe.kZd6jLIwz entropy: 7.99574752423Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Adobe_Acrobat DC_Acrobat_Acrobat_exe.kZd6jLIwz entropy: 7.99439451392Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_7-Zip_7zFM_exe.kZd6jLIwz entropy: 7.99502395244Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_7-Zip_7-zip_chm.kZd6jLIwz entropy: 7.99435731417Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_PowerShell_ISE_exe.kZd6jLIwz entropy: 7.99486593624Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_powershell_exe.kZd6jLIwz entropy: 7.99579522223Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Aut2Exe_Aut2exe_exe.kZd6jLIwz entropy: 7.99549903127Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Au3Info_x64_exe.kZd6jLIwz entropy: 7.99504688679Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_WindowsPowerShell_v1_0_powershell_exe.kZd6jLIwz entropy: 7.99528803523Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_odbcad32_exe.kZd6jLIwz entropy: 7.99468779606Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_SciTE_SciTE_exe.kZd6jLIwz entropy: 7.99562131905Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Extras.kZd6jLIwz entropy: 7.99487928885Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Examples.kZd6jLIwz entropy: 7.99486688171Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt_chm.kZd6jLIwz entropy: 7.99553413548Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoItX_AutoItX_chm.kZd6jLIwz entropy: 7.99577248057Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt3_x64_exe.kZd6jLIwz entropy: 7.99456548245Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt3_exe.kZd6jLIwz entropy: 7.9957579802Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt v3 Website_url.kZd6jLIwz entropy: 7.9955102908Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_Java_jre-1_8_bin_javacpl_exe.kZd6jLIwz entropy: 7.99600337201Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs.kZd6jLIwz entropy: 7.99967097263Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log.kZd6jLIwz entropy: 7.999638971Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs.kZd6jLIwz entropy: 7.99963721654Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{F38BF404-1D43-42F2-9305-67DE0B28FC23}_regedit_exe.kZd6jLIwz entropy: 7.99536600874Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_WindowsPowerShell_v1_0_PowerShell_ISE_exe.kZd6jLIwz entropy: 7.9958197686Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log.kZd6jLIwz entropy: 7.99967239048Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTracing_startedInBGMode.etl.kZd6jLIwz entropy: 7.99713942466Jump to dropped file
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm.kZd6jLIwz entropy: 7.99457451821Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\Document.doc.scr entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\AAAAAAAAAAAAAAAA (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\BBBBBBBBBBBBBBBB (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\CCCCCCCCCCCCCCCC (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\DDDDDDDDDDDDDDDD (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\EEEEEEEEEEEEEEEE (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\FFFFFFFFFFFFFFFF (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\GGGGGGGGGGGGGGGG (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\HHHHHHHHHHHHHHHH (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\IIIIIIIIIIIIIIII (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\JJJJJJJJJJJJJJJJ (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\KKKKKKKKKKKKKKKK (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\LLLLLLLLLLLLLLLL (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\MMMMMMMMMMMMMMMM (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\NNNNNNNNNNNNNNNN (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\OOOOOOOOOOOOOOOO (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\PPPPPPPPPPPPPPPP (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\QQQQQQQQQQQQQQQQ (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\RRRRRRRRRRRRRRRR (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\SSSSSSSSSSSSSSSS (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\TTTTTTTTTTTTTTTT (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\UUUUUUUUUUUUUUUU (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\VVVVVVVVVVVVVVVV (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\WWWWWWWWWWWWWWWW (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\XXXXXXXXXXXXXXXX (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\YYYYYYYYYYYYYYYY (copy) entropy: 7.99748731788Jump to dropped file
          Source: C:\ProgramData\D4EC.tmpFile created: C:\Users\user\Desktop\ZZZZZZZZZZZZZZZZ (copy) entropy: 7.99748731788Jump to dropped file

          System Summary

          barindex
          Malicious sample detected (through community Yara rule)
          Source: Document.doc.scr, type: SAMPLEMatched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
          Source: 0.0.Document.doc.scr.d40000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
          Source: 00000000.00000000.2009802642.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Lockbit_369e1e94 Author: unknown
          Initial sample is a PE file and has a suspicious name
          Source: initial sampleStatic PE information: Filename: Document.doc.scr
          Source: C:\ProgramData\D4EC.tmpCode function: 8_2_00402760 CreateFileW,ReadFile,NtClose,8_2_00402760
          Source: C:\ProgramData\D4EC.tmpCode function: 8_2_0040286C NtSetInformationProcess,NtSetInformationProcess,NtSetInformationProcess,8_2_0040286C
          Source: C:\ProgramData\D4EC.tmpCode function: 8_2_00402F18 CreateFileW,NtAllocateVirtualMemory,WriteFile,SetFilePointerEx,SetFilePointerEx,NtFreeVirtualMemory,NtClose,DeleteFileW,8_2_00402F18
          Source: C:\ProgramData\D4EC.tmpCode function: 8_2_00401DC2 NtProtectVirtualMemory,8_2_00401DC2
          Source: C:\ProgramData\D4EC.tmpCode function: 8_2_00401D94 NtSetInformationThread,8_2_00401D94
          Source: C:\ProgramData\D4EC.tmpCode function: 8_2_004016B4 NtAllocateVirtualMemory,NtAllocateVirtualMemory,8_2_004016B4
          Source: C:\Windows\splwow64.exeFile created: C:\Windows\system32\spool\PRINTERS\00002.SPL
          Source: C:\Users\user\Desktop\Document.doc.scrProcess token adjusted: Security
          Source: Document.doc.scrStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
          Source: Document.doc.scr, type: SAMPLEMatched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
          Source: 0.0.Document.doc.scr.d40000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
          Source: 00000000.00000000.2009802642.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, type: MEMORYMatched rule: Windows_Ransomware_Lockbit_369e1e94 reference_sample = d61af007f6c792b8fb6c677143b7d0e2533394e28c50737588e40da475c040ee, os = windows, severity = x86, creation_date = 2022-07-05, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Lockbit, fingerprint = 9cf4c112c0ee708ae64052926681e8351f1ccefeb558c41e875dbd9e4bdcb5f2, id = 369e1e94-3fbb-4828-bb78-89d26e008105, last_modified = 2022-07-18
          Source: classification engineClassification label: mal100.rans.phis.spyw.evad.winSCR@9/1690@0/0
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2516:120:WilError_03
          Source: C:\ProgramData\D4EC.tmpMutant created: \Sessions\1\BaseNamedObjects\Global\{649F4E29-16CB-DD42-8922-9FFF0592856B}
          Source: C:\Users\user\Desktop\Document.doc.scrMutant created: \Sessions\1\BaseNamedObjects\Global\559f5d4bd4c12afc7974358d21edb1f1
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Windows\splwow64.exeFile read: C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\SendToOneNote-manifest.ini
          Source: C:\Users\user\Desktop\Document.doc.scrKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: Document.doc.scrReversingLabs: Detection: 71%
          Source: Document.doc.scrVirustotal: Detection: 78%
          Source: unknownProcess created: C:\Users\user\Desktop\Document.doc.scr "C:\Users\user\Desktop\Document.doc.scr" /S
          Source: C:\Users\user\Desktop\Document.doc.scrProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
          Source: C:\Users\user\Desktop\Document.doc.scrProcess created: C:\ProgramData\D4EC.tmp "C:\ProgramData\D4EC.tmp"
          Source: C:\ProgramData\D4EC.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D4EC.tmp >> NUL
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE /insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{082B68BB-AD41-4487-9321-7D0501AE003B}.xps" 133583950932070000
          Source: C:\Users\user\Desktop\Document.doc.scrProcess created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrProcess created: C:\ProgramData\D4EC.tmp "C:\ProgramData\D4EC.tmp"Jump to behavior
          Source: C:\ProgramData\D4EC.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D4EC.tmp >> NUL
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: apphelp.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: cryptbase.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: userenv.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: wtsapi32.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: rstrtmgr.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: ncrypt.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: ntasn1.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: netapi32.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: wkscli.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: srvcli.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: samcli.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: netutils.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: logoncli.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: activeds.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: adsldpc.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: wininet.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: wsock32.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: mpr.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: gpedit.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: gpapi.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: dssec.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: dsuiext.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: framedynos.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: sspicli.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: dsrole.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: ntdsapi.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: authz.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: windows.storage.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: wldp.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: profapi.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: uxtheme.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: ntmarta.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: amsi.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: version.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: adsldp.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: sxs.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: dnsapi.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: iphlpapi.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: cryptsp.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: rsaenh.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: mscms.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: coloradapterclient.dllJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrSection loaded: textshaping.dllJump to behavior
          Source: C:\ProgramData\D4EC.tmpSection loaded: apphelp.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: rstrtmgr.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: ncrypt.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: ntasn1.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: windows.storage.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: wldp.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: kernel.appcore.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: uxtheme.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: propsys.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: profapi.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: edputil.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: urlmon.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: iertutil.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: srvcli.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: netutils.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: windows.staterepositoryps.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: sspicli.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: wintypes.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: appresolver.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: bcp47langs.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: slc.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: userenv.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: sppc.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: onecorecommonproxystub.dll
          Source: C:\ProgramData\D4EC.tmpSection loaded: onecoreuapcommonproxystub.dll
          Source: C:\Users\user\Desktop\Document.doc.scrKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CB8555CC-9128-11D1-AD9B-00C04FD8FDFF}\InprocServer32Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.iniJump to behavior
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
          Source: Document.doc.scrStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
          Source: Document.doc.scrStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
          Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2n source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: p.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.kZd6jLIwz source: Document.doc.scr, 00000000.00000003.2061156800.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2062462577.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068373022.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067060328.0000000001238000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001154000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.kZd6jLIwz source: Document.doc.scr, 00000000.00000003.2061156800.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2062462577.0000000001238000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: Document.doc.scr, 00000000.00000003.2064531991.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059520677.000000000111C000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ownload.errorIwz+ source: Document.doc.scr, 00000000.00000003.2074121235.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error.kZd6jLIwzg source: Document.doc.scr, 00000000.00000003.2061156800.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2062462577.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068373022.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067060328.0000000001238000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\*# source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\kZd6jLIwz.README.txt`/ source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001154000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: Document.doc.scr, 00000000.00000003.2064531991.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068087626.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068615252.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059520677.000000000111C000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001154000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\kZd6jLIwz.README.txtb source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: _prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2n source: Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831s source: Document.doc.scr, 00000000.00000003.2064531991.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068087626.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2071652569.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2068615252.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2071891357.000000000111C000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059520677.000000000111C000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\kZd6jLIwz.README.txt source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: ice\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\Zd6jLIwz.README.txtz source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorzg1 source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001154000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Zd6jLIwz.README.txtson source: Document.doc.scr, 00000000.00000003.2074121235.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2075417986.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2077533300.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2076804926.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2074863636.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2076053252.0000000001136000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.kZd6jLIwzxt source: Document.doc.scr, 00000000.00000003.2074121235.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2075417986.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067461982.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2067956854.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2076804926.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2074863636.0000000001134000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2069566644.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2076053252.0000000001136000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Zd6jLIwz.README.txt@ source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \Device\HarddiskVolume3\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\Zd6jLIwz.README.txt5 source: Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2059014906.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\g source: Document.doc.scr, 00000000.00000003.2061297414.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061842245.0000000001154000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: Document.doc.scr, 00000000.00000003.2061842245.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2061297414.0000000001137000.00000004.00000020.00020000.00000000.sdmp
          Source: Binary string: \\?\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\kZd6jLIwz.README.txt source: Document.doc.scr, 00000000.00000003.2061156800.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2062462577.0000000001238000.00000004.00000020.00020000.00000000.sdmp
          Source: Document.doc.scrStatic PE information: real checksum: 0x30e46 should be: 0x36685
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Videos\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Searches\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Saved Games\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Recent\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Pictures\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Pictures\Saved Pictures\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Pictures\Camera Roll\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\OneDrive\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Music\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Links\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Favorites\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Favorites\Links\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Downloads\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\ZGGKNSUKOP\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\UNKRLCVOHV\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\NYMMPCEIMA\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\NVWZAPQSQL\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\JDDHMPCDUJ\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\HMPPSXQPQV\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\GRXZDKKVDB\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\EOWRVPQCCS\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Documents\EFOYFBOLXA\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\ZGGKNSUKOP\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\UNKRLCVOHV\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\NYMMPCEIMA\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\NVWZAPQSQL\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\JDDHMPCDUJ\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\HMPPSXQPQV\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\GRXZDKKVDB\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\EOWRVPQCCS\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Desktop\EFOYFBOLXA\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\Contacts\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Mozilla\Extensions\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Sonar\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\RTTransfer\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\LogTransport2\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Linguistics\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Headlights\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\Linguistics\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\VideoDecodeStats\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\dd432c4a-ba38-4070-9985-ed1b3bea85dc\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\assets\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\Acrobat\DesktopNotification\NotificationsDB\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\VirtualStore\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\Symbols\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_5172_761252224\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_5172_1791500899\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\msedge_url_fetcher_2640_817343797\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\mozilla-temp-files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\Low\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_995017740\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_778675694\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_736602331\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_649288342\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_339006160\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_27162369\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1988346647\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1959985254\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1807723660\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1693012001\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1635976352\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1619438387\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1485273224\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1421574262\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1318414972\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1289371347\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1234978473\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1191663050\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\edge_BITS_6440_1090636871\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrocef_low\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\SolidDocuments\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\SolidDocuments\Acrobat\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Publishers\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\SettingsContainer\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Microsoft.WindowsAlarms\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Licenses\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Fonts\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\PeerDistRepub\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsMaps_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\AC\BackgroundTransferApi\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCamera_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsCalculator_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\Flighting\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{99fff775-938d-4e2c-9c06-5d56107a5383}\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{2737c7bb-35fb-4b44-baf9-033ca587595d}\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4e763a36-90d3-4d6c-9949-dd01f7e5d23f}\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ea91a05a-d98f-4429-81a9-272df0335447}\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{de0f148a-c476-467a-b7a3-14b0bb463140}\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{880da644-c864-4aed-9e06-5b089e06c09e}\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txtJump to behavior

          Hooking and other Techniques for Hiding and Protection

          barindex
          Deletes itself after installation
          Source: C:\ProgramData\D4EC.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D4EC.tmp >> NUL
          Source: C:\ProgramData\D4EC.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D4EC.tmp >> NUL
          Uses an obfuscated file name to hide its real file extension (double extension)
          Source: Possible double extension: doc.scrStatic PE information: Document.doc.scr
          Source: C:\Users\user\Desktop\Document.doc.scrProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOXJump to behavior
          Source: C:\ProgramData\D4EC.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
          Source: C:\ProgramData\D4EC.tmpProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\ProgramData\D4EC.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
          Source: C:\ProgramData\D4EC.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
          Source: C:\ProgramData\D4EC.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
          Source: C:\ProgramData\D4EC.tmpProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\ProgramData\D4EC.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
          Source: C:\ProgramData\D4EC.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
          Source: C:\ProgramData\D4EC.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
          Source: C:\ProgramData\D4EC.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
          Source: C:\ProgramData\D4EC.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
          Source: C:\ProgramData\D4EC.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
          Source: C:\ProgramData\D4EC.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
          Source: C:\ProgramData\D4EC.tmpProcess information set: FAILCRITICALERRORS | NOALIGNMENTFAULTEXCEPT | NOGPFAULTERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX
          Source: C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXEProcess information set: NOALIGNMENTFAULTEXCEPT | NOOPENFILEERRORBOX

          Malware Analysis System Evasion

          barindex
          Contains functionality to detect hardware virtualization (CPUID execution measurement)
          Source: C:\ProgramData\D4EC.tmpCode function: 8_2_00401E28 8_2_00401E28
          Source: C:\ProgramData\D4EC.tmpCode function: 8_2_00401E28 rdtsc 8_2_00401E28
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\ProgramData\D4EC.tmpCode function: 8_2_0040227C FindFirstFileExW,8_2_0040227C
          Source: C:\ProgramData\D4EC.tmpCode function: 8_2_0040152C FindFirstFileExW,FindClose,FindNextFileW,FindClose,8_2_0040152C
          Source: C:\Windows\splwow64.exeThread delayed: delay time: 120000
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Local\Temp\acrord32_super_sbx\Jump to behavior
          Source: Document.doc.scr, 00000000.00000003.2132078796.00000000011A0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: hyper-v:wux:hyper-v~
          Source: Document.doc.scr, 00000000.00000003.2067796880.0000000001186000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 10/04/2023 14:08:59.672EXCEL (0x145C)0x7E8Microsoft ExcelTelemetry Eventb7vzqMediumSendEvent {"EventName":"Office.System.SystemHealthMetadataDeviceConsolidated","Flags":33777031581908737,"InternalSequenceNumber":149,"Time":"2023-10-04T14:08:57.331Z","Rule":"120600.4","Contract":"Office.Legacy.Metadata","Data.ProcTypeText":"x64","Data.ProcessorCount":2,"Data.NumProcShareSingleCore":1,"Data.NumProcShareSingleCache":1,"Data.NumProcPhysCores":2,"Data.ProcSpeedMHz":2000,"Data.IsLaptop":false,"Data.IsTablet":false,"Data.RamMB":4096,"Data.PowerPlatformRole":1,"Data.SysVolSizeMB":50000,"Data.DeviceManufacturer":"VMWare, Inc.","Data.DeviceModel":"VMware20,1","Data.DigitizerInfo":0,"Data.SusClientId":"097C77FB-5D5D-4868-860B-09F4E5B50A53","Data.WindowsSqmMachineId":"92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A","Data.ComputerSystemProductUuidHash":"LFm9Ltrk4S277wbAA8Obddw+Rm4=","Data.DeviceProcessorModel":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","Data.HasSpectreFix":true,"Data.BootDiskType":"SSD"}
          Source: Document.doc.scr, 00000000.00000003.2057593273.00000000011BE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: 10/04/2023 15:50:56.369OFFICECL (0xe04)0x250Telemetry EventbiyhqMediumSendEvent {"EventName": "Office.System.SystemHealthMetadataDeviceConsolidated", "Flags": 33777031581908737, "InternalSequenceNumber": 551, "Time": "2023-10-04T13:50:46Z", "Rule": "120600.4", "AriaTenantToken": "cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521", "Contract": "Office.Legacy.Metadata", "Data.ProcTypeText": "x64", "Data.ProcessorCount": 2, "Data.NumProcShareSingleCore": 1, "Data.NumProcShareSingleCache": 1, "Data.NumProcPhysCores": 2, "Data.ProcSpeedMHz": 2000, "Data.IsLaptop": false, "Data.IsTablet": false, "Data.RamMB": 4096, "Data.PowerPlatformRole": 1, "Data.SysVolSizeMB": 50000, "Data.DeviceManufacturer": "VMWare, Inc.", "Data.DeviceModel": "VMware20,1", "Data.DigitizerInfo": 0, "Data.SusClientId": "097C77FB-5D5D-4868-860B-09F4E5B50A53", "Data.WindowsSqmMachineId": "92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A", "Data.ComputerSystemProductUuidHash": "LFm9Ltrk4S277wbAA8Obddw+Rm4=", "Data.DeviceProcessorModel": "Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "Data.HasSpectreFix": true, "Data.BootDiskType": "SSD"}
          Source: C:\Users\user\Desktop\Document.doc.scrProcess information queried: ProcessInformation

          Anti Debugging

          barindex
          Hides threads from debuggers
          Source: C:\Users\user\Desktop\Document.doc.scrThread information set: HideFromDebuggerJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrThread information set: HideFromDebuggerJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrThread information set: HideFromDebuggerJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrThread information set: HideFromDebuggerJump to behavior
          Source: C:\ProgramData\D4EC.tmpThread information set: HideFromDebugger
          Source: C:\ProgramData\D4EC.tmpCode function: 8_2_00401E28 rdtsc 8_2_00401E28
          Source: C:\ProgramData\D4EC.tmpCode function: 8_2_00401474 LdrLoadDll,8_2_00401474
          Source: C:\Users\user\Desktop\Document.doc.scrProcess token adjusted: Debug
          Source: C:\Users\user\Desktop\Document.doc.scrProcess token adjusted: Debug
          Source: C:\Users\user\Desktop\Document.doc.scrProcess token adjusted: Debug

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Writes to foreign memory regions
          Source: C:\Users\user\Desktop\Document.doc.scrMemory written: C:\ProgramData\D4EC.tmp base: 401000Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrProcess created: C:\ProgramData\D4EC.tmp "C:\ProgramData\D4EC.tmp"Jump to behavior
          Source: C:\ProgramData\D4EC.tmpProcess created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D4EC.tmp >> NUL
          Source: C:\ProgramData\D4EC.tmpCode function: 8_2_00401E28 cpuid 8_2_00401E28
          Source: C:\ProgramData\D4EC.tmpCode function: EntryPoint,ExitProcess,GetModuleHandleW,GetCommandLineW,GetModuleHandleA,GetCommandLineW,GetLocaleInfoW,GetLastError,FreeLibrary,FreeLibrary,GetProcAddress,CreateWindowExW,DefWindowProcW,GetWindowTextW,LoadMenuW,LoadMenuW,DefWindowProcW,SetTextColor,GetTextCharset,TextOutW,SetTextColor,GetTextColor,CreateFontW,GetTextColor,CreateDIBitmap,SelectObject,GetTextColor,CreateFontW,8_2_00403983

          Lowering of HIPS / PFW / Operating System Security Settings

          barindex
          Overwrites Mozilla Firefox settings
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\to-be-removed\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\temporary\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events\kZd6jLIwz.README.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups\kZd6jLIwz.README.txtJump to behavior

          Stealing of Sensitive Information

          barindex
          Tries to harvest and steal browser information (history, passwords, etc)
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\43bb9a55-74a2-452e-8233-6899a7f737b0.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.dbJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqliteJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.86be03dd-6b03-42f5-89cd-4606f43d25ad.health.jsonlz4.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shmJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\3c7034d6-bc52-43bb-9a23-5da34ee205e0.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835635.a669692a-f9c9-42c0-a803-7b87d3ff5834.new-profile.jsonlz4Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\b8f053a5-de16-4a2c-8120-1ab4aadd63e8Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqliteJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\events.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqliteJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqliteJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.01c0ecdb-8e59-4210-95f1-0fd0406e84ad.event.jsonlz4Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\search.json.mozlz4Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\AlternateServices.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840708.3c7034d6-bc52-43bb-9a23-5da34ee205e0.health.jsonlz4Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\previous.jsonlz4Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqliteJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.01c0ecdb-8e59-4210-95f1-0fd0406e84ad.event.jsonlz4.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\3c7034d6-bc52-43bb-9a23-5da34ee205e0Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore.jsonlz4Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.json.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shmJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shm.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\session-state.json.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\eventsJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.jsonJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqliteJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.json.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqliteJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\a83301c6-790b-49f3-adc7-55a855f7fe79Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqliteJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shmJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\.metadata-v2Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\state.json.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\AlternateServices.txt.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\previous.jsonlz4.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\7755ad51-2370-4623-9d21-15c89f2143db.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.jsonJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqliteJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.jsJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\containers.json.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\search.json.mozlz4.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\a83301c6-790b-49f3-adc7-55a855f7fe79.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\background-update.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835635.a669692a-f9c9-42c0-a803-7b87d3ff5834.new-profile.jsonlz4.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\containers.jsonJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\handlers.jsonJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.jsonJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\.metadata-v2.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\pkcs11.txt.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore.jsonlz4.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shmJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\pkcs11.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\ls-archive.sqlite.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\43bb9a55-74a2-452e-8233-6899a7f737b0Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835649.b06d08be-79e8-4bfe-b6aa-988ea3d35cbd.first-shutdown.jsonlz4Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.iniJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840748.a8c1f564-c2e2-4ef8-a85f-52a56488f193.main.jsonlz4Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqliteJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\session-state.jsonJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835643.9a3c31ca-35e4-421e-91e1-5f7b9bd27492.event.jsonlz4.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\times.jsonJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\yiaxs5ej.default\times.jsonJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\7755ad51-2370-4623-9d21-15c89f2143dbJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\SiteSecurityServiceState.txt.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqliteJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835643.9a3c31ca-35e4-421e-91e1-5f7b9bd27492.event.jsonlz4Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.86be03dd-6b03-42f5-89cd-4606f43d25ad.health.jsonlz4Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840708.3c7034d6-bc52-43bb-9a23-5da34ee205e0.health.jsonlz4.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\b8f053a5-de16-4a2c-8120-1ab4aadd63e8.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\state.jsonJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\ae04dde8-69a1-49f8-95f1-d533ed587ff6Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqliteJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.jsonJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4Jump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.jsonJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqliteJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqliteJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\handlers.json.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\times.json.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\webappsstore.sqlite-shmJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\shield-preference-experiments.jsonJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\ae04dde8-69a1-49f8-95f1-d533ed587ff6.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqliteJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\background-updateJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835649.b06d08be-79e8-4bfe-b6aa-988ea3d35cbd.first-shutdown.jsonlz4.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840748.a8c1f564-c2e2-4ef8-a85f-52a56488f193.main.jsonlz4.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.dbJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\shield-preference-experiments.json.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.jsonJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.kZd6jLIwzJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\SiteSecurityServiceState.txtJump to behavior
          Source: C:\Users\user\Desktop\Document.doc.scrFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shmJump to behavior

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
          DLL Side-Loading          		111
          Process Injection          		111
          Masquerading          		1
          OS Credential Dumping          		211
          Security Software Discovery          		Remote Services1
          Browser Session Hijacking          		Data ObfuscationExfiltration Over Other Network Medium1
          Data Encrypted for Impact
          CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
          DLL Side-Loading          		11
          Virtualization/Sandbox Evasion          		LSASS Memory1
          Process Discovery          		Remote Desktop Protocol1
          Data from Local System          		Junk DataExfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)111
          Process Injection          		Security Account Manager11
          Virtualization/Sandbox Evasion          		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
          Obfuscated Files or Information          		NTDS4
          File and Directory Discovery          		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
          DLL Side-Loading          		LSA Secrets122
          System Information Discovery          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
          File Deletion          		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 signatures2 2 Behavior Graph ID: 1430701 Sample: Document.doc.scr Startdate: 24/04/2024 Architecture: WINDOWS Score: 100 40 Malicious sample detected (through community Yara rule) 2->40 42 Antivirus / Scanner detection for submitted sample 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 6 other signatures 2->46 8 Document.doc.scr 32 1002 2->8         started        12 ONENOTE.EXE 2->12         started        process3 file4 24 3870112724rsegmnoi...es.sqlite.kZd6jLIwz, data 8->24 dropped 26 3870112724rsegmnoi...qlite-shm.kZd6jLIwz, data 8->26 dropped 28 C:\Users\user\...\kZd6jLIwz.README.txt, ASCII 8->28 dropped 30 171 other files (168 malicious) 8->30 dropped 48 Overwrites Mozilla Firefox settings 8->48 50 Tries to harvest and steal browser information (history, passwords, etc) 8->50 52 Writes to foreign memory regions 8->52 54 4 other signatures 8->54 14 D4EC.tmp 8->14         started        18 splwow64.exe 8->18         started        signatures5 process6 file7 32 C:\Users\user\...\ZZZZZZZZZZZZZZZZ (copy), data 14->32 dropped 34 C:\Users\user\...\YYYYYYYYYYYYYYYY (copy), data 14->34 dropped 36 C:\Users\user\...\XXXXXXXXXXXXXXXX (copy), data 14->36 dropped 38 24 other malicious files 14->38 dropped 56 Contains functionality to detect hardware virtualization (CPUID execution measurement) 14->56 58 Writes many files with high entropy 14->58 60 Hides threads from debuggers 14->60 62 Deletes itself after installation 14->62 20 cmd.exe 14->20         started        signatures8 process9 process10 22 conhost.exe 20->22         started       

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          Document.doc.scr71%ReversingLabsWin32.Ransomware.Lockbit
          Document.doc.scr79%VirustotalBrowse
          Document.doc.scr100%AviraBDS/ZeroAccess.Gen7
          Document.doc.scr100%Joe Sandbox ML

          Dropped Files

          ⊘No Antivirus matches

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          https://tox.chat/0%Avira URL Cloudsafe
          https://tox.chat/0%VirustotalBrowse

          Domains and IPs

          Contacted Domains

          ⊘No contacted domains info

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/ui.win32.js.map/d6bb35bc608af2672a5b746baDocument.doc.scr, 00000000.00000003.2058198747.0000000001238000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            https://artifacts.dev.azure.com/office/_apis/symbol/symsrv/privacy-sdx.win32.bundle.js.map/e3b0c4429Document.doc.scr, 00000000.00000003.2058457962.0000000001154000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              https://tox.chat/Document.doc.scr, 00000000.00000003.2061156800.0000000001238000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2092684104.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2019781196.0000000001156000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2119320978.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2103612240.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2122420148.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2123563496.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2035440830.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2020875656.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2128470332.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2097170059.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2096070849.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2094172163.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2033390092.0000000001126000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2033154751.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2106278279.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2128740161.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2122743679.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2096396555.0000000001154000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2119133098.0000000001137000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2128345601.0000000001137000.00000004.00000020.00020000.00000000.sdmptrue
              • 0%, Virustotal, Browse
              • Avira URL Cloud: safe
              		unknown
              https://login.windows.netApp1713921509308663900_6D1069C2-A1FE-4969-8A18-9CD73AF4AF15.log.11.drfalse
                		high
                https://github.com/react-native-community/react-native-netinfoDocument.doc.scr, 00000000.00000003.2058198747.0000000001238000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  https://support.mozilla.orgDocument.doc.scr, 00000000.00000003.2032462071.0000000001230000.00000004.00000020.00020000.00000000.sdmp, Document.doc.scr, 00000000.00000003.2032462071.0000000001228000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    https://clients3.google.com/generate_204Document.doc.scr, 00000000.00000003.2058198747.0000000001238000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high
                      https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-brDocument.doc.scr, 00000000.00000003.2032462071.0000000001238000.00000004.00000020.00020000.00000000.sdmpfalse
                        		high
                        https://support.mozilla.org/products/firefoxDocument.doc.scr, 00000000.00000003.2032462071.00000000011BF000.00000004.00000020.00020000.00000000.sdmpfalse
                          		high
                          https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBLDocument.doc.scr, 00000000.00000003.2032462071.0000000001238000.00000004.00000020.00020000.00000000.sdmpfalse
                            		high

                            World Map of Contacted IPs

                            ⊘No contacted IP infos

                            General Information

                            Joe Sandbox version:40.0.0 Tourmaline
                            Analysis ID:1430701
                            Start date and time:2024-04-24 03:16:49 +02:00
                            Joe Sandbox product:CloudBasic
                            Overall analysis duration:0h 7m 27s
                            Hypervisor based Inspection enabled:false
                            Report type:full
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                            Number of analysed new started processes analysed:18
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Sample name:Document.doc.scr
                            Detection:MAL
                            Classification:mal100.rans.phis.spyw.evad.winSCR@9/1690@0/0
                            EGA Information:
                            • Successful, ratio: 100%
                            HCA Information:
                            • Successful, ratio: 100%
                            • Number of executed functions: 18
                            • Number of non-executed functions: 1
                            Cookbook Comments:
                            • Found application associated with file extension: .scr

                            Warnings

                            • Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, printfilterpipelinesvc.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
                            • Excluded IPs from analysis (whitelisted): 52.109.0.91, 52.109.0.140, 52.113.194.132, 20.190.190.194, 20.190.190.195, 40.126.62.130, 20.190.190.130, 20.190.190.193, 40.126.62.131, 20.190.190.131, 20.190.190.196, 23.40.26.94, 20.42.65.93
                            • Excluded domains from analysis (whitelisted): onedscolprdeus20.eastus.cloudapp.azure.com, slscr.update.microsoft.com, osiprod-wus-buff-azsc-000.westus.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ecs-office.s-0005.s-msedge.net, roaming.officeapps.live.com, wus-azsc-000.roaming.officeapps.live.com, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, wus-azsc-config.officeapps.live.com, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, ecs.office.com, self-events-data.trafficmanager.net, prdv4a.aadg.msidentity.com, fs.microsoft.com, prod.configsvc1.live.com.akadns.net, us2.roaming1.live.com.akadns.net, www.tm.v4.a.prd.aadg.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, s-0005.s-msedge.net, config.officeapps.live.com, us.configsvc1.live.com.akadns.net, ecs.office.trafficma
                            • Not all processes where analyzed, report is missing behavior information
                            • Report size exceeded maximum capacity and may have missing behavior information.
                            • Report size getting too big, too many NtCreateFile calls found.
                            • Report size getting too big, too many NtCreateKey calls found.
                            • Report size getting too big, too many NtDeviceIoControlFile calls found.
                            • Report size getting too big, too many NtEnumerateKey calls found.
                            • Report size getting too big, too many NtOpenFile calls found.
                            • Report size getting too big, too many NtOpenKeyEx calls found.
                            • Report size getting too big, too many NtQueryAttributesFile calls found.
                            • Report size getting too big, too many NtQueryValueKey calls found.
                            • Report size getting too big, too many NtQueryVolumeInformationFile calls found.
                            • Report size getting too big, too many NtReadFile calls found.
                            • Report size getting too big, too many NtSetInformationFile calls found.
                            • Report size getting too big, too many NtWriteFile calls found.

                            Simulations

                            Behavior and APIs

                            TimeTypeDescription
                            03:18:12API Interceptor109x Sleep call for process: splwow64.exe modified

                            Joe Sandbox View / Context

                            IPs

                            ⊘No context

                            Domains

                            ⊘No context

                            ASNs

                            ⊘No context

                            JA3 Fingerprints

                            ⊘No context

                            Dropped Files

                            ⊘No context

                            Created / dropped Files

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\AAAAAAAAAAA (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Reputation:low
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\BBBBBBBBBBB (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Reputation:low
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\CCCCCCCCCCC (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Reputation:low
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\DDDDDDDDDDD (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Reputation:low
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\EEEEEEEEEEE (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Reputation:low
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\FFFFFFFFFFF (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Reputation:low
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\GGGGGGGGGGG (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Reputation:low
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\HHHHHHHHHHH (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Reputation:low
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\IIIIIIIIIII (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Reputation:low
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\JJJJJJJJJJJ (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Reputation:low
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\KKKKKKKKKKK (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\LLLLLLLLLLL (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\MMMMMMMMMMM (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\NNNNNNNNNNN (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\OOOOOOOOOOO (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\PPPPPPPPPPP (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\QQQQQQQQQQQ (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\RRRRRRRRRRR (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\SSSSSSSSSSS (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\TTTTTTTTTTT (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\UUUUUUUUUUU (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\VVVVVVVVVVV (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\WWWWWWWWWWW (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\XXXXXXXXXXX (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\YYYYYYYYYYY (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\ZZZZZZZZZZZ (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:xWaxz4ePINryyrFS56ru4gkJFrXNWwnArwnF:xWu6rfIkK4gcLw/ry
                            MD5:B99A6BF325A5F793534CB3615DF7EB4B
                            SHA1:570E800DC7DA22ABE9B997F531853BA322447C8B
                            SHA-256:AE9E1A65E45E123C42D9513F7E7C346A93597E8EBE7F644CA510FC90B85CC2C1
                            SHA-512:7182DDE6D8CFFCBCB3C1C2BB09F8E894F10697EC86C5B817A1B3AF49158813D505BF09F299757B3B4C3D4B12ACB7C742B30C61179F7A2575624EE2DA10D301C8
                            Malicious:false
                            Preview:s.....87.F.]..Q".........v...i....G......D.r.e......r%YP....vS...."..o+.(.C(n./......7...|....#6..6......?...q.9......=...(

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\AAAAAAAAAAA (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\BBBBBBBBBBB (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\CCCCCCCCCCC (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\DDDDDDDDDDD (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\EEEEEEEEEEE (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\FFFFFFFFFFF (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\GGGGGGGGGGG (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\HHHHHHHHHHH (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\IIIIIIIIIII (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\JJJJJJJJJJJ (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\KKKKKKKKKKK (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\LLLLLLLLLLL (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\MMMMMMMMMMM (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\NNNNNNNNNNN (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\OOOOOOOOOOO (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\PPPPPPPPPPP (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\QQQQQQQQQQQ (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\RRRRRRRRRRR (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\SSSSSSSSSSS (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\TTTTTTTTTTT (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\UUUUUUUUUUU (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\VVVVVVVVVVV (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\WWWWWWWWWWW (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\XXXXXXXXXXX (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\YYYYYYYYYYY (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\ZZZZZZZZZZZ (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.507199735976317
                            Encrypted:false
                            SSDEEP:3:ejK15FTGVq/9GGVNb386tqyiZ/5hzFhzVrksZiice3:ejGbTG478byizlbzVIsci53
                            MD5:CACB70CD6589799B440282433035DD40
                            SHA1:BA4822E03DEC58245C7588EF06184941EF0DB918
                            SHA-256:2E36F8777B3B275ED5C2329E6452D2525D658080EFAF8D6E9DEF91490B805FB7
                            SHA-512:0E244ABB8353A0B90BF3A8B989A573F5010096D47A866931BCF5FFAC81A16CD7FE9186999DFBEDECC0B1362EC9510247109B920180E45204F9445356D6FDD2DF
                            Malicious:false
                            Preview:..h...9L....Z..vc.d....X.u....Z.g.....<..g...,}#..7...../.`...<.s.g.C..;.>..?...$...Vp.~.........}......7...a..X...

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\AAAAAAAAAAA (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\BBBBBBBBBBB (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\CCCCCCCCCCC (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\DDDDDDDDDDD (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\EEEEEEEEEEE (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\FFFFFFFFFFF (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\GGGGGGGGGGG (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\HHHHHHHHHHH (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\IIIIIIIIIII (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\JJJJJJJJJJJ (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\KKKKKKKKKKK (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\LLLLLLLLLLL (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\MMMMMMMMMMM (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\NNNNNNNNNNN (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\OOOOOOOOOOO (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\PPPPPPPPPPP (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\QQQQQQQQQQQ (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\RRRRRRRRRRR (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\SSSSSSSSSSS (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\TTTTTTTTTTT (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\UUUUUUUUUUU (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\VVVVVVVVVVV (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\WWWWWWWWWWW (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\XXXXXXXXXXX (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\YYYYYYYYYYY (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\ZZZZZZZZZZZ (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.516851770843267
                            Encrypted:false
                            SSDEEP:3:3Hw6l8osknevnP8sY+i/j8zKjxqQM3/YaEYHe6zCueWBkKx/9:3Hw6lIkunP5Y+i78ujsQMPYaX+QBko9
                            MD5:27DE9CA3461A189342A85F09DA408693
                            SHA1:09093EBD1AE24C4779D44851548FC9C4175DB90D
                            SHA-256:0A3248B5C93C34D3389B4ECAB43DCF16E2449534EBD767EEBCCCCA9292A51635
                            SHA-512:22DB4E975D359E5EB1FF5321A04527561800FA3DDEC81A731779934D7CEC964D839E62334134BACFDFCF9568E0005080FEAE5674E9742D137F7BE17AB1C3D6D6
                            Malicious:false
                            Preview:.....P/y...._....=.`3.B{...*...o.G.A......+..,..W..n......zK.....H..X....8..~.N..9}.<x9_4.gW......].I{;.25..f....&@..S....!X

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\AAAAAAAAAAA (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\BBBBBBBBBBB (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\CCCCCCCCCCC (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\DDDDDDDDDDD (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\EEEEEEEEEEE (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\FFFFFFFFFFF (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\GGGGGGGGGGG (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\HHHHHHHHHHH (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\IIIIIIIIIII (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\JJJJJJJJJJJ (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\KKKKKKKKKKK (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\LLLLLLLLLLL (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\MMMMMMMMMMM (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\NNNNNNNNNNN (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\OOOOOOOOOOO (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\PPPPPPPPPPP (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\QQQQQQQQQQQ (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\RRRRRRRRRRR (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\SSSSSSSSSSS (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\TTTTTTTTTTT (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\UUUUUUUUUUU (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\VVVVVVVVVVV (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\WWWWWWWWWWW (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\XXXXXXXXXXX (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\YYYYYYYYYYY (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\ZZZZZZZZZZZ (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):129
                            Entropy (8bit):6.495496053772234
                            Encrypted:false
                            SSDEEP:3:ha9xNuPOWi/dcquzzgFMP8JbGc93KQ4c++lPun:I3Wi/cfedic96Q4cPu
                            MD5:3CCD27C81FA2777C4139293148E2708E
                            SHA1:63055C2852196E513C2D76E182DE08532EC9D404
                            SHA-256:5F43ECC9D77DB10A88B57B011D325773807CDA92748E1D7F7030BF3C8D44A33D
                            SHA-512:CDE1FE1ADCF00C3FB9D05AB574BBF2B174D0810EC7B141E38464796BFD026B339632B289FAB7B884358DF6DDD2BAE5EF95212A6A15ADB17B4DD31E0DFDF64CAF
                            Malicious:false
                            Preview:..a...s......7..O...Y]..i.B......!Yy.i.K.....q$.2...G...~...X..C.Yw...#H..WZ.e....}.iI..x..,H..rpT.d..k...+..o.....C...sE

                            C:\$WinREAgent\Scratch\kZd6jLIwz.README.txt (copy)

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\ProgramData\kZd6jLIwz.ico

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
                            Category:dropped
                            Size (bytes):15086
                            Entropy (8bit):4.262047636092361
                            Encrypted:false
                            SSDEEP:192:jpBaAlHSa2vU9G/8MMBD7O1lXFMB8VMJP7:jpjmkMYD7IFMRx7
                            MD5:88D9337C4C9CFE2D9AFF8A2C718EC76B
                            SHA1:CE9F87183A1148816A1F777BA60A08EF5CA0D203
                            SHA-256:95E059EF72686460884B9AEA5C292C22917F75D56FE737D43BE440F82034F438
                            SHA-512:ABAFEA8CA4E85F47BEFB5AA3EFEE9EEE699EA87786FAFF39EE712AE498438D19A06BB31289643B620CB8203555EA4E2B546EF2F10D3F0087733BC0CEACCBEAFD
                            Malicious:false
                            Preview:......00.... ..%..6... .... ......%........ .h....6..(...0...`..... ......%............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\.curlrc.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):239
                            Entropy (8bit):7.07372103179226
                            Encrypted:false
                            SSDEEP:6:k9pRgM6K/IgRIBlRYbUu0dicPo8aC6ztDsY80T/f/9FZtOoRg:0pRbV/HUn4Uu0dicwFCRYTT/N3tJRg
                            MD5:BC7FBEB8B33A08F3EFA344F933941011
                            SHA1:4C9DD18F4D1FD00084B248DDB6C7A020E1F9270E
                            SHA-256:A4719C989A34D9C27CF50D555A2BB1E5ACDD7FE6A1AEE36D053B43245670D04B
                            SHA-512:FD2B6010394492ADD85BA6C51D489BB4DFF6206205E8C84D6957F84AE80F5B10E3C38EBA5E52DE3FBA855791D10CF40E92CE1A040722B8DDEE5219ECE74FD6A7
                            Malicious:false
                            Preview:t."+...*.D.}...x....n!.`FI...w.C.$y..B@,......[Pj.0.L^E$...N...........`.+./........13.E.fo^...)..a.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\CURRENT.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):248
                            Entropy (8bit):7.171622923150525
                            Encrypted:false
                            SSDEEP:6:iPuIAYULmBHraumaht5DKcPo8aC6ztDsY80T/f/9FZtOoRg:EdULmdLrwFCRYTT/N3tJRg
                            MD5:325BC83182EEC26FAA3C7B01858B5EB9
                            SHA1:3BF5326B868380C4F5A406D68EE20627D4F713A6
                            SHA-256:FA68B18E5B40A670A0C66C7B8AFFA9672740EBE444C6C3CD5BBC67D11405EFBE
                            SHA-512:0EE88B1545DB8C89F02494F23E38A19DD09196B7C9315CA084B7EAC839339496D2ACFD77BDB9DA95EA65C0CCF5CDA27C6E71D064C79779DD841C7193287208B7
                            Malicious:false
                            Preview:.@0>....)..uaD.}...g.@...n..`F....w.@.$y..B@.._.>..Q."o...9......[Tb.{Z... .....p..B.DHaMw.....3.%.@;..A.(...b.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):45286
                            Entropy (8bit):7.995615177783473
                            Encrypted:true
                            SSDEEP:768:X6n2MExZCzHfviw+nAxpq0KX+I8Xcc/b/Pj/jIoS0wxCrl+OumGDAtyY/2bghzjf:q2MEWH3iw+AXq0KXgssbXLS0p+ORG8t3
                            MD5:D6C6B55D24A88F544D557A8B95834E2D
                            SHA1:EBEB246CF15B7243B1AAFAA632680AE0BD43DD3B
                            SHA-256:E48548C3AE11C9DB292E0A565551D55186E05D0F5D30C536A1D987254D88F784
                            SHA-512:D75D9A9E85B33ED5207EF1051DF786F133346C8E4793EE4790B795732EFE7608C5268FBA091CFF89A4BB77B12D474C0C0DD2E1BBEDE7A1B2A2150888020F69A8
                            Malicious:false
                            Preview:...`....ca...U..KC........p.j.&....3.j..F$..[.6I.G.2. .......n'*.<.+.<.......E..t?x.c.j5.X.Z9\H.:.v.f.a~oN\.D...G..0...st.F...{G.K}.\.......E.$..L...[a....3.>.....E...@.H....;..v\@.t....6W....Ok..,..@..h6._.0.H...{.+z....xu...+......lr".k..Q...h..e..X..Sk...@...e...M...m..(t.$.O.E..h.fLx.b....,=.r'o..H.oV.'..{.$....1@....,6|a...n".X.|.9.?1..Y.*9D*9..6. ..].....q.I8...........'../}8..R.co..G;{.7...a..rV....O9.P....6.MK.<j....5JBYl.M._.;.>..6..W.i.p.|...i.9.{r2.....n...\.;mL..N......u....H..Xf6d...r..%.'...m'..[&..qO.e..K.y..4]C~....].....d..|2.....?*.mR.....].jb..6.e.../....A..o...T.lk......0".....\.gb.x`...'..$...!2. ..5.iz.zC.x.JPC.....k...t.1.l....P6..D.`/r.0X......Cz...%.. q.]p..E.ee..z...*........-..]..EsJi#.../...E....:.4..p..p.1.. .K.C..V.b<_`"...p...e._q.c.......N.q[t...Q.......e....aW@1Je+\..l*2.2.....h.F..%.<G..O..%a*..=.........l......T..elLt.>=lg.....K...[y..n...z.T..)_.%.D0tZ[L..D#.e....*...&Z..s..RM..L...|.|.>w.9....

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_1.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):270566
                            Entropy (8bit):7.999417769424649
                            Encrypted:true
                            SSDEEP:6144:k/gAj5dNJ9Gv7cEcf7y0s2kXBEp9harDN1xzOg4z11gMAW+:UgAjR7CwmPEfhGDp4zXgMAR
                            MD5:FBEB313E89D10C3E43D30D3E279B64AB
                            SHA1:FFBAB96C272B0578B1D5ACD5A7109DE125F5FBE8
                            SHA-256:C87C98C994303A01EA0BFE0114FBEEE3E8407DAE17FFFB04FA760661E6946891
                            SHA-512:9E5A303DC2E9FC9D6FA96ACC3FC370AA3392E5E36563616C4C7ECC489ED37C71ECBD419AB628AFB7EFFE16302B38FC48F5AC1AF71E4E983D825F503134372441
                            Malicious:false
                            Preview:n.&T.@...f~.]1tS..j...5....T[..G..wv.M..7.\......Jg.Gmj......Bc1n.&kY-\\.hD....l.'..........3.... .t.....t.X......i.P@A.N............`Q... .......[...9.....0Y.|..l...m..,7.ow........S..2..g..k.2J..F...`o#.E.......7....V1..,..D...y.F.5..c.m....f..r..j..]...gN?~.....'Zt.....;&.s..Gp.u......D y.rz#.m.n.......m......1ef\}U.%y.....7..._..%..%..%aU.).4gCj..0...P..tyE..".j..Z..Lh...@2.}5E.. TCO.K.e&.....0S:..U.[.%!..o.......y....N1a.;~......i....ek&..9s(..k.........1......h..&...~...e..%..9.Bx....y..%XaDq..........~|..zT..Y.J)~...`CDe{.y.MgV..p.f.A9..:.._.'..#....E.....o-.....V..Ns.}..../....(...RF@..tH.@}L.#......4..:.o...rO...V.4i...~.'.d..h..O.n.L...>..a.3........F...~...~cOL...]*(....m#-..=.<.X/L.cp.....r.%.0...:.N..$[.].........P5...&.Q0....KsD.\D..%n#... s...&9.. .}YI.mk8..h..K_a..ftH..3...|....1..C....gj.*n.:..P.....7...G....B...#.&......?.<..../J.%.o.....!.X.E.?.u.%.9h..S..SK..9d.;.1..4.H...H..g>aU....q..S...by.....l.m1(..@y.G{..).%j.G...q;.

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Cache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:OpenPGP Public Key
                            Category:dropped
                            Size (bytes):458
                            Entropy (8bit):7.585803700789407
                            Encrypted:false
                            SSDEEP:12:kWCBOsbeEwA+/e4CEt+75dHLnwFCRYTT/N3tJRg:kWsxee+KEt+75drHYTT9TRg
                            MD5:33D83FB19520AD85B12EC24F76DE12F3
                            SHA1:D7E81001FF90D09707FCCDA8A3C7A0689EDC19A9
                            SHA-256:91E381B0E7C92E065977890CBA4DAAF91C40E855383A83CBF20C1F6187194536
                            SHA-512:CC2E444D1D0A4E8F1595CA6C5A8E78BC6AA8456040821E9B01CF532B14414FDDD757D01EAEBA1E2AB5CAE87BB2FFFB1B40B83B5A8A3E3796030285BCB21075CA
                            Malicious:false
                            Preview:...P..f.?.8a....G\..f...Wo$.9.&..j%.{...,j.Mn(.=..m.eD.j.O..8.JO....../..={.M.:.a...o..%~q...:..}.V.Z.IK....T.a.,.._.PVV.7.6Cb..N.L.Z.$T% R...cM.0.t...wy..K...E...............`$R..Y........2..pB(....D.}....-..p.....w......Fn{...B@.`(7.....Q.,g.t. ....._@3..k....2pn..d.vc.?.lf.xnX.vl....m.{...&.Q.d#e..p.4..s.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\076dd576a8178299_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):466
                            Entropy (8bit):7.538217163312332
                            Encrypted:false
                            SSDEEP:12:WONxzYDLLlkmS/mzsEq78wYuIpjfYwFCRYTT/N3tJRg:WOgLLlkm45EKRsprKYTT9TRg
                            MD5:7AA94C674E212F6E5F15636FEE35E129
                            SHA1:4CD05322B7293E0DDC018FBFCFFD9014F4560DFB
                            SHA-256:A4B342C21EF8E57A031A2E9AAABACD9AAFC3F7AC560E0029F0F9CB0325694993
                            SHA-512:55F63D881CEFCE4F2DF2D7AACACD15BF2DC29992DF3E6A85E60735EE48436BAA88D87717F3DD746C11D22F8607FA9022EAEC5F1BA301D182E94078F9059570BF
                            Malicious:false
                            Preview:...t.$}.%f..r.......#...%c.Q...a.?..v.k...Zl...D.(.i.1...^.OW......(...Q..D8$.._...teB.A...{.dn..Xw..k;d.......dj%...\(.*....-.E.5i.uu..V.L....-N...a.(-..... ...P....W...FanC..}...2d# }.R..U"...2^0....>;.V.K...D.}....;.5..V?..J)....W.Z&y..B@.2(7.....R.,g..n....e..La.>l.m...v..2.q.}..6-..pu...'}.%....5R.c..q..~.p.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):420
                            Entropy (8bit):7.420010133597762
                            Encrypted:false
                            SSDEEP:12:bvWO9VCfaivJiCmDWayKdVwFCRYTT/N3tJRg:bvWAivJZzEYTT9TRg
                            MD5:CF9C8E55D68B469A5A77FC7E84C96604
                            SHA1:C4554532861928F8D24D23257C6E363B2D74DA8E
                            SHA-256:FBEA7FDB328F244E78EC23E55AE77CB1DD8673677FBFFC38F52774E53C04CB51
                            SHA-512:02D1063C372BAD1C2162537EB54A259D2D18E8AECCE2058E6C85B16CBA256D93DE3AFD5503548851B3A8CFABCF92BB3341AEF0DF0EFC850300BDBAD6E1060823
                            Malicious:false
                            Preview:V..w:.L...)y....p..&....*8...iA..X.EElyk..T..o..).et)....<n.T.xB......D&...4.y3F.l..f.F..Vl$.D."...PA....K.*...V....G.PJ..D.........`z+..%%.Z&[e....e.d...!.%.f..Yr..HNw..D.}.....i...]~.p.)...u.@.$y..B@.`(4.....R..l..(E.X...T5T.|p..6.....m.#Pl).>.eH.P??.3.e....b#F."......Ll.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):498
                            Entropy (8bit):7.602251230422242
                            Encrypted:false
                            SSDEEP:12:uL4cFWmcsWMY1O4r7KvRB3hLw8cAiJGoJkkGwFCRYTT/N3tJRg:ucc0muMY1Ou7cRLZxiJGoJk/YTT9TRg
                            MD5:AEB5C2114388D42E244D44ACF09F5B3B
                            SHA1:73BCD499FA8EBD3E2FCC32288AA9B7D23430E65E
                            SHA-256:70E14D4A3616223BDA9383C21915A570E3168BB2D07BE6D6B4E57AD47A6F0E8E
                            SHA-512:801BEE46A94B3167ABD78C0A13781BFA525E192E1B299D008D9998A935F00B6A308D409F0140C53079915A308843AF68A95A0FA4622571382B27373F7CFF5489
                            Malicious:false
                            Preview:.;G.._.&...&v..,k..d..;..ad.q=...`jgo....!..e.;a.{.a$..n/.d.9...J"OI||.=..OS..X.+.)...q..V..22..-...f..z.2.O.......H.&f..V..)u=.W.... +.../.\..#..Z?...........G.......o..'>8...7...U..N...+v...b..x].:.....I.2...1..wq.W.P.z;.2.g.@..6..[i...bJ...D.S...F.l...g.rlJ#...O9xAI=.~B`.`(e.....R.,d.t...W.w.'........LW..C..p.U..B}.{.V.. .M.../...X.AR#.6m..K...".fr.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0a71ed411241f66a_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):445
                            Entropy (8bit):7.522151528336857
                            Encrypted:false
                            SSDEEP:12:ZMOydA+htxM3360Vl//Pq6pLwFCRYTT/N3tJRg:ZPUEv3BpzYTT9TRg
                            MD5:0F720588F4B17B4C7C222E15C671626C
                            SHA1:5CC1099F9D4EF3556E8BC18C8A3A8A0EB19BFDB4
                            SHA-256:082C3E64355D4915ADF2969B42D053203A3F30D8E5E5463439C14294263B8F7D
                            SHA-512:3CC52278DE8AAF1057C09A6630331094138A6546D46E660AA5D7147527D04F579E962F3FD235BBDFF2CABCD95FB11FFC7F21CE0AC43D4EB7F4C1D93EC23B1DDD
                            Malicious:false
                            Preview:+K...(.ZF..m.H.6.c ....$..+{....M9.......r.(....8$7....z.6`}..r..{.S .&.I.8...m.v#C/5.....'................a....9.f.<.WM..,.Hk...:@.=.U.;.hb...T.o..$....1Ij}...].lv...\.B../...X*..6...Y<3L}o.D.}....q.I.a.*.3N}..r0..`..]@.`z7.....R./g.t.jT07.....[..0{K...d>.._..4,Gky.._D.....%...L.C. ..._4E|V...1.q.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0b05805acd0d1882_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):442
                            Entropy (8bit):7.4244046253500375
                            Encrypted:false
                            SSDEEP:12:0q6mLFHsyQ0OG3ZhFCyUKNK2j3bowFCRYTT/N3tJRg:0q6mLhsyWgZhNJ3b6YTT9TRg
                            MD5:581877F326BA20A36C631839EAF5F40C
                            SHA1:AB05BADF94AE11C54E5E83F4AFAB7975F90152A6
                            SHA-256:BB20F71402D204FDAFDEC62CC0C435224AA0B3624AF4674ED08D1692C2B0CF07
                            SHA-512:B9D2309C4D4CE40083E0BDC3FAEDE7DC34A9F62FD2DB1926298F319487E16E6904147A199C7982A61A531C9928D9B8B47660F4D599204E31BA5E7A142A8AFB97
                            Malicious:false
                            Preview:..."..o2v..0.W.Ik..8azs._.wSeZo...p.A......f5......!....... .{!.'I f..7Q@,.T...aB$....N.lX.{;.....X.{&.P...=!..s,..w...x....)..../...../.e.D....>.t..n..r.v..t.jI...7}..h.q.y...j.6...D.|1!.7,.....XJ.h**...W..&y..B@.2(7.....R.,g..)d...Z~Y.G....^../.s....X.d'.h#.f....v..E..(v.sC..m^.....C/.7p.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):461
                            Entropy (8bit):7.484641599225594
                            Encrypted:false
                            SSDEEP:12:QmvUAW1MWLYdsW0SL0xswDn6AUxFHdmRnwFCRYTT/N3tJRg:QlP1MYW7D26txFgHYTT9TRg
                            MD5:ABA4A943A1F28D84339D06A036BE37C4
                            SHA1:4514D093E68BB24AF426C62C517809BA3A0DE9D0
                            SHA-256:55B8C8C2A131AFA6381FA2200923F11A1AAFFB0399B442D1C88B4170E00CB296
                            SHA-512:D48A4DD9A86DAEBBE65AC479AF24B2B580E3AEA36AD0AB7502F88B75AD42CE81A059156D4159C2354DDCCC643CE0E9B66CC8CBA1D57F73BBB9DF06B2BFD7457C
                            Malicious:false
                            Preview:.......A[....VT...2>%P.N.7...V.~.Zd(..3se3..^E..P^......$.. _Yvc.{!.c../.....[:mgy.~.DQW.>....8j........0|.7.(.O..f'.5.../....3..T.=....4.|..k.O_.~e...<.....Z....@.cbY....~....Hf...~..6Y.6{W..h[..dw......D.}........7.mwH...fmvA.{L.]@.`z7.....R./g.tG..3.3....:..S.cU.iq5...........Yp.U.s....}.q.m.I....#....>T...q.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):467
                            Entropy (8bit):7.5213678407220455
                            Encrypted:false
                            SSDEEP:12:1NaiIN2lZub688F9sv6btc0tc+ynwFCRYTT/N3tJRg:1NyN8DXW0tNEYTT9TRg
                            MD5:17DE06A44AC3B1B5646DFA6259F773E0
                            SHA1:C2BBAC67988F4D480C43B05BDA6191877ACA109E
                            SHA-256:2A933001482DAAD1300E0ACF5C6322871A880D9FB0AB0E0ABCDF2BDE1A434F87
                            SHA-512:85B36E132B9929525240FAEF674D6452278CA237E625481BCDDB735862D4B06BAE1D3B02F25592569C4399F32D9FB5A5DE177E3811503F6CDB6FBF84543A3BF7
                            Malicious:false
                            Preview:>..+..n4......N...X......&g....|.R.c.>x.V...F...U..K.).@.....xL.t...}.......Kk...GW.h...a...j..U..KSb.'.....A9....Z...FS..&.....`.U..J...2..9;Y....x>.L....E.E......Q|q6.q..Q.|..y..%..U)/.@m.Y.Q...x...E~.....D.}...!.v..g..u~}....k-A.{..]@.`z7.....R./g.t....M5..HC+.(B.f..s.....v0.Qn.>..(Qbd9.r...#.|Eq..T...u7!DdD..cIq.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):461
                            Entropy (8bit):7.538193035176209
                            Encrypted:false
                            SSDEEP:12:GbZHNzGRo7CT5fAToscXHGwFCRYTT/N3tJRg:BCe1okCYTT9TRg
                            MD5:4622F63B3355AD60A9FEAF55554567B9
                            SHA1:26AA80347A0C37921EF6E0A7CD085B6F344F591B
                            SHA-256:6927A85BF3ABCF6BEA17BF1BCB6D7FEB75FB0712F397DB78CD448BB269D782D9
                            SHA-512:C2215F5780BFE80B5565D03EE5306DF1CD0FD2CE65635B82BA5E7961C4612FDE7749C0DB1D7D5AA3214B55F9FBA4E4650D9284129F78A766CEC3DD35E07EF9BE
                            Malicious:false
                            Preview:.o..F]wC....kW.r...eh?..Dj` ....n2...M.Q../..!..X|.a.'.l!..6B.._d..W.....8B.k.)B.............L...cV...~uQM.M.7e.m9.Y......./.D".Z,~......\.... .qE.......D.x..T.t......d.....MS.0a?7.lo.......Yc.c.|Z5.2>.D.}....$..g..`..UK).@.D.#({L.>B`.`(e.....R.,d.t.......k.>.....a.#....cT.....|..Z....rW.. .'_...=..x...X.R.D.`.r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\27d6cd255a96bfd9_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):469
                            Entropy (8bit):7.503517029605798
                            Encrypted:false
                            SSDEEP:12:Y1so/7gRGGAStmsLOt95aBATMwFCRYTT/N3tJRg:Gso/7qU5a2T2YTT9TRg
                            MD5:1B79EB783D3416003971203ACFAB5F4F
                            SHA1:D4C013D72B5215CA64E0AA7962E7CD62EE243187
                            SHA-256:D836F62F564F52DECE4F87BF71473BAB5EAFF2324D65F70E870216EA8D6BEA50
                            SHA-512:E8F00F71C1DCC63D7F13C63962DEA6562F4A231584E665C0709CA058E91AC81BFF5AD780FB28F0C962F721CFE9E14C28CC44C49076F19DB734C09BBEA2115DC2
                            Malicious:false
                            Preview:..N......+....m/..t.:+d...m8....D#.u..r..6BJ.Z.b.x.!;"..!8...(...FW2....D....zm...w\..7..+..._.BO.lED...7p.....b..L.>..C>..h.].%...R...`J...CR......$.]....4T...p.....Se.-.g....w.Qd..D..d..>`@.G....o..z.`N..*..e...D.}....w...$kO.YgyE.fR......>B`.`(e.....R.,d.t....t....5...7!2 ".....t....[.......O.[>...b..t.N..8..W..@Tb.hr.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\28daa88523128699_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):460
                            Entropy (8bit):7.56841795466257
                            Encrypted:false
                            SSDEEP:12:izGRjAeCMN4MqdwmDFhtOr+awFCRYTT/N3tJRg:izjeCMqdZDDtOr+wYTT9TRg
                            MD5:F3204AD9B5D7C7FB5E55E0F3A86EE9D2
                            SHA1:7EF01BC7D0C5E876FFCB301459D71DDA7C444A9C
                            SHA-256:A1B7ED28A000BFBF92C152CEA128ECABCFEF6029B7DED6C1D689980D4ACCD85B
                            SHA-512:B63AC24A031A3714DF0A2F9535CD360DF6A39AEAFC341689C2DE6B49BD4C3681E102CDA1CEA72AE10D0BD178D06E89E3F1D0702B16823EDB49BFBA09A5C61E87
                            Malicious:false
                            Preview:+?..3.].....5......l.9..'o.Aa.......vQ.H..`o,.........G >.I*........$`...X...GX......&_.. ...ol....\*..8.DO..%Msa.?......#.-.X%.g.....F...%..Y......7j:...8...%*Z.....rAJ[..^.NW.....6...~|.1.P...Wi'A'"}..D.}....,..<.] .tP#...rW...{L.]@.`z7.....R./g.t5Fd.>C.4...x.md...[.C@.g....G.d%....&.~t.+..5D.......[.b..t.z.qq.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):432
                            Entropy (8bit):7.514636549925281
                            Encrypted:false
                            SSDEEP:12:KJ3GbLq+jarmPpDlYBYKUn7DzRpwFCRYTT/N3tJRg:KJoLljaExRKkVYTT9TRg
                            MD5:4F8A9DAB49364D4D6DC77D403FD85BA2
                            SHA1:7C48C5CF0C1441A0E65B5EDAD0027F93481CFFCA
                            SHA-256:5C0AD00AC5F04FDEB6962E1EBCC2454C8DECCEEC88259417BC2575E3AFA0E5B6
                            SHA-512:88A4525ACBECFF4D9E18317F8F74A13931051B8AB39C60A505DA7B22C9EC9CB5E725ECEC83BB9E677BD2C3AC5E0DCECAA2F16D3842A5D274739C635283683CD2
                            Malicious:false
                            Preview:.v.3.5...g.W........{....\`...$..}..!...Zv...........%.G.E1.)-.....};.....$.Y..T.j..9.....y#....H.... o>..(}..q..........T.._..b=..Ro..............*.....H.Ws.<sy.h....?.}.F.D.}..Y."....*JCX.~d..~.UA.I...@.`(7.....Q.,g.t. .A.f.q.Jf.3.<D*Mm.goJ.DH!RZ6u.r..W..].T.^"...Q..L.O;..j.{..R..s.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2d207d5589cabc48_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):487
                            Entropy (8bit):7.561397402039877
                            Encrypted:false
                            SSDEEP:12:4QiPmvZtDOVBdpY7oj3j2XtwFCRYTT/N3tJRg:4PmvfwBdAQjwBYTT9TRg
                            MD5:75178ADFF0F7CEF5E607AEA71CBC05A5
                            SHA1:C513148D34394B2321AB5A7E21C25FDD7D57871C
                            SHA-256:5BA83335986B0E579C20640E398A54E223DD3731B24A298CB07E6126C6984F0C
                            SHA-512:CA782FC69B7B4883248AA0D5AF47AB9E69873ADB55CF2F4E38EE55E81DB1989C65557EBFE7A41753B5D7A13D21BB847F49BB723D4D15F6189778876158E7D055
                            Malicious:false
                            Preview:\2...2b.0b...1..j.d....I....G.....i...>.S...B.^.V..j..*....?.2K,.p{...Y...=......;.;N.ha..p.2............i.0w(....-v.'^..G.....} .,6q.#|.4.#.}i.l..&.:.0...&...M.a .q.8.1..U.9.s.#q..@~.H|..n...:@.b_u.+2.ca/......d.l7!....Vh..=...h.D.|1!.;#..5..r...Zz...C.]A....]@.`z7.....R./g.tl5d..b..]*.........+.9u.E..W..C0.._......[.5.X."Jh....1...J.q.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\31f9e8ec74b3086f_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):469
                            Entropy (8bit):7.512391343195819
                            Encrypted:false
                            SSDEEP:12:utRJFfckokczbN7OYcNwxrt3ZY00cuARHekPOD9GwFCRYTT/N3tJRg:AJaknADcNwxrdW00cPRrE9EYTT9TRg
                            MD5:500B19E80CDCEBA9F13D413567E27071
                            SHA1:15E85803F5B56AC04D07BA93D22DC8BFEA010D18
                            SHA-256:71C7FCAFD0EE2E986728400CA78B2E4BAC1396ACEE87DE488336A674C0AC4CB9
                            SHA-512:7F1AE54B0F39005C27895BE1495BFBF30B8C776D3656A061A2657C2DF8DCF2D4507D3B253D8537D598C41970E507CA7C2A09DE4CFE66403F9352B8B5887FFDB2
                            Malicious:false
                            Preview:..f........I......._..0\..2.t+..N9qsx..$3..C........-..H.j..A.....j.]@...&..f..~.....D[.........)m`.O......9P..0.....*B...U..0......U4n&....... ...h.^..|f.X..h...P.~...~....h..s;.w..P}..G6...........:.vH..9..D.}....q..g..`..THy....)v+{..B`.`(e.....R.,d.t.n..R...b...Kf:.sP......}D...K.e...uo.ne...?-.......w..p.&O.r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\431888171713135e_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):479
                            Entropy (8bit):7.560345840469294
                            Encrypted:false
                            SSDEEP:12:AjJcSuqjl3oa5xvh+Cb5EFPFjVXSP3ZcwFCRYTT/N3tJRg:AjJrl3oTCqPFeZmYTT9TRg
                            MD5:90CCED11154720993E79635EF4EE34C8
                            SHA1:B990256F6FEADB197E995B309C116414B8E69619
                            SHA-256:6DB77BA2BEF19964E70C914187BA59CE00C1C96CF19B33F94CA792FB0FF07ECE
                            SHA-512:427AC8420021D20F1AB31005640B4C82FEDB674DD021ABD971C1AE2D3E2562850CF0491D9DDA1E4B1876FF14DEB0E3F57E865732CE4F51BE902C98606A7C8192
                            Malicious:false
                            Preview:.A.h..m./..&Um.W..d...s..p.....^.{.....r.35(...5....J.....Rq.IkD..B.g...0l.x.A.h.+.k....!...x..?...6......,.......1......K2...J.oH...!^.ybY..R^|....S.4V..!. $...i.(._ .I...q)..pr.c..}...S...^.W8"Rh.....Tr.....O..=V..u#....D.}.....'..(]..n#....l.@.?y...@.`(7.....R.......g.{..>.....P..>m.3(N....?.P....x..../s%.h..Kl.n7.Y.N.B.dm.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):431
                            Entropy (8bit):7.470581372654425
                            Encrypted:false
                            SSDEEP:12:iXd4Qoi6sC72OunwwpIHLGwFCRYTT/N3tJRg:iXdMAFgwpIwYTT9TRg
                            MD5:35FC85DBB940390710C7973489B110CB
                            SHA1:15A8C87E35F82220BF25E87AFB7FAD830703A275
                            SHA-256:8FF42675317FF3E832745963E6042FE36A51249A556E5D45CCC20995E5300A82
                            SHA-512:8123CBEEB0D6D5F894120E21326EC393E59CBCDCDE0E633CF2975C811E297529A19BE4D1F778026D9E63D47953B8510328258210A39CE985ACBDF5AD4E66F99E
                            Malicious:false
                            Preview:..C".Yk.9B...i^qx.1....q%......y.1.....?. ..w.A..F..9Y.#.G...f...+....}Gk.b......I.4.3V,..C.LV.k.q.."...q...3M.R......._D.3...p.kJJ..'...,.....99.A....t...M...0.{.^.|%.^e3.d..D.}...-.X..Y2.{".B..xsnG...@..B(7......R.,g.w. ....n[?7.|Tu..rz.K...az9.A.G*......{'......~n. .......L]3.!...t.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):462
                            Entropy (8bit):7.53632123640721
                            Encrypted:false
                            SSDEEP:12:ZqFw708MQPEOjh3zwS4FsLs3JwqsRwu3JJOPwFCRYTT/N3tJRg:PdcOjhnjoGqsWu5qYTT9TRg
                            MD5:50643F8369239FEFD6B5C8A0BD9BD976
                            SHA1:D4313E1E960F6A7F9C105329F4AC87F777E03B23
                            SHA-256:0D6B16B17C3E05B69C58227481339433BD48948F9B18AEFD50F523198809996F
                            SHA-512:F44DBAA4EFAAFDDA9DEA9BBF88E759EEB9F6540A174C63011271F9C0272DFEFF75AE8320D9B6B652FCC028231CC9EE86771645DC8C94DC7DF042265C00E5D320
                            Malicious:false
                            Preview:..=.xM.<...C......;...O...[..w.fZ<..>...?..<../....l.U0/.V..r....B..c......k ......}....6.;...u.e...Y}...Q]e.-..f$js?F.....<........?q........5.mMQ.6.m.Q..+..C..g.......:...w....Yg....q.V..x*{.)...$..0.p.D.}.....l...{.im'.7..W...{L.]@.`z7.....R./g.tF&..jSq*.1F.#.v..Sw..........l.eZ....Y.4..w....."Twt..C......q.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):438
                            Entropy (8bit):7.462939322243907
                            Encrypted:false
                            SSDEEP:12:c6M6RzVK5J0ahdvnf+O4YCOlIbCaqwFCRYTT/N3tJRg:FV2hznf+O4YTlI2YTT9TRg
                            MD5:E7953440F2F6222C700444E5D0D6CDDA
                            SHA1:8D48223EEF359BAE9B21829EBD0D9B9DD65429AE
                            SHA-256:7E11E6B23C719F4826A661477C7E11A1C8ED492054045E54E8158D8FC71E8E32
                            SHA-512:7E04E8E081DF4565BFEA33D19867D2A730B37A11BF4394B80F5D614C93F95622C8D30D18C9703EAAC8787E8DE6FCD76B92DF0AD6B779D26DFB72B2D2F2B9BE32
                            Malicious:false
                            Preview:t>.6c.pD.......a.+...ED...NY...'..up.X...Wn......X......0H;N'.#=VD....].vP.v.H....xO..Vm...v]kz.TWC...h(s.B.(.......px..F..R9...~.ya.!.E...........c.......q@,U..'3..h..x)W....I.Ua...D.}...-.I.X...C3....lIA1...]@.`z7.....R./g.tF....<(U.......@7S...C...x.".'.b5$.Rp./...)1{....R.vd..nBwmEq.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):497
                            Entropy (8bit):7.542591260014563
                            Encrypted:false
                            SSDEEP:12:UtRtO5j3XOl0+n+4ziMrTHINparboTPL/gTwFCRYTT/N3tJRg:UtRtO5jnniHANQrbyEbYTT9TRg
                            MD5:EB2C7F1741FDB0DFF7ABF265F8C7884B
                            SHA1:B5AEF8FA9E60A620746372DF2E54D1B7DF3DD9D0
                            SHA-256:9D9082AB36A74D02E81BA7994F39A99D0600CC42E7BE0666F187F390A1AC6700
                            SHA-512:9FDB8B4D6712D6B673624E491B53D986A4AC488F07F3F4EA59978A17A0DD62E2DE893FF9004AA5120292F9C7BC572B3EF33FE28549FB66DB73F91D6FD0B2B222
                            Malicious:false
                            Preview:.0....}.(1.c.,.?lW).....)y(..?..|..'....1..Y.N.....(...1..P}_.M.S=.......R....._...5.<d.;...x.3..o.&....}!1"&.(RV.f........b.......bz....[V......'.....t.pb.4..h2Dy....j7iC.~.,...d.w"(..8..<.....gqC......w..;?...x.V....d..;?..<>.(`.(..L..D.}.....j...`..UD...Vj.A.IO.@@.`(7.....Q.,g.t. ...;..4B..S.Dm.....X.2...2..bG..........`]6>..}.=z./..$...s.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\627265196527eec1_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):465
                            Entropy (8bit):7.57529080510694
                            Encrypted:false
                            SSDEEP:12:lNy8uyQzASWUPfp04qbq6lb5EhXwFCRYTT/N3tJRg:lNy8uyNmfp0hnlb56YTT9TRg
                            MD5:74A6DF23A1AE6EB633744323D45764E2
                            SHA1:F9266B7FBD17DC791B62B8122E5C8DE36837E6EF
                            SHA-256:35C1205AAED265BA1955230E95355C18F4B7AA219095A884A4357C9EA5BA2D38
                            SHA-512:7C5458C15CE9B774D44E233758BB4E034A99AF71F2BE11D7B79F8D2C629D466D1A6B297FA168A042E573D4A8BB8CF909F3FAE0205FA74E12A7307E389802AD8B
                            Malicious:false
                            Preview:>.[......'..U0..2..MFTX.6...3..[.).....Ws.~q...k.td.......<T....x.!~Mf0.3....Y6/oT..+Z......W&...^.\..o....*.K..2.(.~.2g.odN.u.L9U....L$........z...d.$a..a......V..}.)..e.&".B...QdA..r.z. .r....>9.....p...5....D.}...2!..h.m<.SCx..VG.B.$e..B..`(7.....R.,..,_R.].9...o".L........9..FZ.2.{....S_.!....v.z..f.......hn.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\64766d63a539c3ca_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):462
                            Entropy (8bit):7.485324004071349
                            Encrypted:false
                            SSDEEP:12:tgpo5gJoFneruXynyg3TZsPx6QpwFCRYTT/N3tJRg:tsoAwnJXRg3TexvYTT9TRg
                            MD5:473DC528AB5E986049EB8EFB71D91FFE
                            SHA1:C668969E6E426AB00E331C6170D72F4BFC4A5392
                            SHA-256:01F99FFE29BA266140D0DAE41B744F42217D2F5F5A45F40CD2D5CCA997D4CC21
                            SHA-512:39E86F366F0DBBFFA9CC7140CB303448D34302CFDBC332E1DBE29911BA72B705685716A08FC2DCF5D05C650D0B7496538846046E72D622B1852A563B11C3C44C
                            Malicious:false
                            Preview:e..%.2.F.q....pE...:`.n$!.t....r.....?..H..JJ.g#.JP:9I............o............PW...h..j.....8..4<.zd...Z.8+..J..B..x.R....-]......Ob.~.^...U...5..G=..M.{.k..W.;.f.`.7...0J.7`.{fl.|..SAnL..'....1..r.$..x.|'a.].D.}.....j.q....m.9.5IjW\..{..B@.2(7.....R.,g.....1.2.,C}E..........O....N....Q...xK.:d.._......... 8?.M4.+p.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6580eb6b2e190c0b_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):477
                            Entropy (8bit):7.515344063364777
                            Encrypted:false
                            SSDEEP:12:4n/sPS3PJ8LIBJW0N4Blf2LNWZDbnVP3Xv0FTwFCRYTT/N3tJRg:ksq3PJtJW/DbnVff0FbYTT9TRg
                            MD5:EF8DB6E35A16E8F0161152CF27F2BF4B
                            SHA1:F32A0FFCF6489B9B64B4F9D6C662020E36F7F7EB
                            SHA-256:DEDA48E799EA20E939158A99FC2F91622B7890279B458A4BCFA6FC2CFDED9B95
                            SHA-512:4EF7F644927CC3DE8056B74526D89FBE19BA147BE0C3D22C1DF971863942B8BFBFB11CF7B9E98644B69A2AAA38782639BE3C3B009C1FEDE4A0356E263A369736
                            Malicious:false
                            Preview:..|4....I..E(....l X.L[.."..r2.oY.N....\.O.0I..*J.oO7i.[.zd..0.....z.$..U6(X.&.;..C.V.......t.y}...r...9.I^....&.!\63~oe . ...T..9.y..hI......Z.y.*..QK...K......>...i.?y..\.GdPE....y8QdH.....;....7H....n.3.'}m....c.{...D.}....q.H..g..Q."...~(-A){..]@.`z7.....R./g.t.\...5...(;[Q.....J%..H..eM..=X.K.O.z.X.-:.6.._N..%..d0y..eq.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6a34b53951ee8d83_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:OpenPGP Public Key
                            Category:dropped
                            Size (bytes):462
                            Entropy (8bit):7.484917327398872
                            Encrypted:false
                            SSDEEP:12:icwChHjBEPqtRruTX02iHAt9vkiTwFCRYTT/N3tJRg:i2hD6VjrMCYTT9TRg
                            MD5:C38BEE7ED56A7BFFAA2561D7227F5B20
                            SHA1:165BF382C7A92ACAE73A5A0B62757CA00A113636
                            SHA-256:1F1FB83A0F3373F1D67897AEB8F615CD0D177B8997DD206ED40AA566B5281F2B
                            SHA-512:437A963A60B85FA3DD005A7FEABBCBBE55082D78AAF74B823E61D5E03287928C44ECC45C8A9E74978DD7CC1066BDB8428DACEDCF5E31CFFF9B4B9C0C6EF104E8
                            Malicious:false
                            Preview:..|......k......Uf.....1.G....w.\.Q.Q..>..9.H........W..2.W...;8._x..B.^M.'.h....Y.r....D......qw.(..U...~.....3P..".Vv..6=.R..[O..j..ZC..z_.7.,.."5..E...J...h...aV#.zp.....(d...F.0..=.]..|w.VG..i..D.}....v..e.c.C.....~.dA8I..B`.`(e.....R.,d.t..D|8..3_F.Z..).q......k.#p2M.RQ..X.a.../.t.`..,..f.1.......r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6e8773c5f8211d0f_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:OpenPGP Secret Key
                            Category:dropped
                            Size (bytes):456
                            Entropy (8bit):7.496813940948178
                            Encrypted:false
                            SSDEEP:12:TAMSgzagox5u2YcsDZRSrSGAg0ow6wFCRYTT/N3tJRg:TA9Iag32YcDeXgeQYTT9TRg
                            MD5:84991B328DD61A600756E2F16712E045
                            SHA1:538401FA3A1A40FB34AEF1A94315D9B3FF553EFF
                            SHA-256:16E4C1E40B20A15D73A00F85FC9DD6A8ED50F6908F414CA626930672BADE6B65
                            SHA-512:93CE333751707583F86ADA389F91F0D531BCA6A81D3573BEF2D21EB1E6ED856606C6ECE6A814A0F812C5AB97F254F4F6F0EA11726A2DAF6E8272D61D996E90F4
                            Malicious:false
                            Preview:....@.....HN."<P.....P.S.E.......F..m.$a...g.a.p.(I!*%.O.o.s.C.......2...a.....n..$3......L...|.zI.{..%p....b..s..q...b.?.:......7.../;.|(..n.(9....Z.<{.z..,.......[.;...l.$.?.sV\.Q.f.0......O".D.}.....=....bH.R.*J.{8]A.t..B`.`(e.....R.,d.t......b.....[.r0 .:.t..O.........t...A....a.....7h......r)"r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):463
                            Entropy (8bit):7.600143060348617
                            Encrypted:false
                            SSDEEP:12:E1Yt12raBoL3d/2gkixu6pAoVmEHapwFCRYTT/N3tJRg:bt1AiTgkQooVmEHsYTT9TRg
                            MD5:A6BEE85518F4A35607F939E5311A3CF7
                            SHA1:C4BEAC8F72870D3B69F53D7C75BFE0F2553F38C3
                            SHA-256:699681740C82D0DC1B958E192E98C4DB6AFC2B45DF3BEDF520480C138048F5F5
                            SHA-512:4D77AA3FCE7E2527BB383B69A2520A1EF7F8114D1B715AAB5368457A179F40BFD7D9F40E58B3366B70642646BCE3B780A7652906734BEEA6911A0E1276258D60
                            Malicious:false
                            Preview:rf..e+.b......M...7...2.3..;g..;.|*......a.{J.I{@..Hm_.<..f._..6./....$\.0P|./.B...U...6M....!....'<..F.,[~.).O..D..o....E..&.6.|?...s[..X~<...$.......'...G3k...A.+..[..=....-..e.w......5eWP?].yA..?1V...D.}..Y.p.......#....E.q.{PT.B`.`(e.....R.,d.t....mzS....J..>;.]&?s....g.a.K.....N...>3G`.+Zh.D..e.1E.1...nt..r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):455
                            Entropy (8bit):7.51597279788671
                            Encrypted:false
                            SSDEEP:12:9rrk1/G4+oK8DjZUYtftXhwFCRYTT/N3tJRg:Br1de179YTT9TRg
                            MD5:39AB8EF13BC8DB8F699B176C57B3FA6A
                            SHA1:2F420D5B3CDF072938534B8C54E7E36BD02DA7A1
                            SHA-256:C1CB49A2643B7349BA45516BCAF4AF71ACC182EF74769F72F4E8353EDC06CFA4
                            SHA-512:10C13228CA58A41AEAC19E7B85CFB458270BC57CEDD9628DEAED3A082AAD101FD2F0D0C943A85C4730C35CFC1660152A8DA5CE11026144F9BC1FF7E02852A46F
                            Malicious:false
                            Preview:.....lo~l..._...p.6KO......w Dr...^....].....].o.f...($...B.....<.,..r..$D..4.O+.....T.&....g......F0.p.e.jP\.l....F7...bS....!+.=t...S|._8..-.y.;E.F....{_~.g....J.))r./T..}rw=M.L\td.C......&....D.}....w..I.X...x.....i.{.&..@@.`(7.....Q.,g.t. !r...v...e.Fw.:\......2D.\p.!.@r.T....`...^.;n..5H:.$M.2..l..-s.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):461
                            Entropy (8bit):7.518012701145885
                            Encrypted:false
                            SSDEEP:12:S8OhoRQ9lvZD/4jm4fQLc9Ah5I9QbHgSpwFCRYTT/N3tJRg:P4j7J/uP/9QbHgSVYTT9TRg
                            MD5:B9605D01F1278F0D02EB2C1C10A93BDC
                            SHA1:44656F2CB8212F91E958564B461E56F2A0EAFE93
                            SHA-256:F84C132FEAF7A6D64FD501ECC38C3D2548B0DCC34044E49652B8A74829FB6B63
                            SHA-512:864FB70EC85AA62D28D68BE13D1615A22B83BC0C06E62785EE11208DF3157C5BDB46A45AFCB2152FE60768C57D4FD8818003311F5557F3B9D1F48EC201AC574A
                            Malicious:false
                            Preview:(.....4..[0......+[..h...(....I....h...._....C...I....l*]..g...U.@..{.......E..\.....pu?..x......|....H..*'w.E..TN-.C.Q.uv..L......Z.5...P..h.*.fn..{..b.H..D....["7........o..I/-..5g..h.~...}...i@W.9...D.}...v.....kJziR,....W0..{..B@.2(7.....R.,g....b.....h!.}.o.x.l....Q.t..R......1.x.e$....<g.x.b.m..}....p.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\72d9f526d2e2e7c8_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):478
                            Entropy (8bit):7.498379650534771
                            Encrypted:false
                            SSDEEP:12:3jGaYbR0x9qiyUN1FGAih78AwFCRYTT/N3tJRg:TG8NyePXih7rYTT9TRg
                            MD5:53037DC9B5986DEAF70BF536622E5077
                            SHA1:F0A594991A4D0EC93DC0B8E1D8D27BF60C9A8CE9
                            SHA-256:DF877806B5F136FAA6FADCCA49913467DEF8B3F00AB64BA64B62DCCF77C21703
                            SHA-512:2BF0C5643E5E00C6AFDD017BFD51D1A2D7C8C37FDF07238511D7D072FD6BEBE84A0003483DF6F5DC86FE5CBEA4F739A215C1D6D3EB52B5CDEEC809CC0697CB6D
                            Malicious:false
                            Preview:.W.y..'/_.:..............5...S...a....A^.D...J...X......((R&...FP...t..|..V......w..xE..."..R...@2......-.p.L..c(oP....0,..e..q3.....Xa4..|.T.Y7..}hf.`.<+.$\..I.......Jy8..Jr..1..4...~..,...KP..F^..\F.F._."h;..H._P.v6.D.}....r..d.w...B|...O....t.~B`.`(e.....R.,d.t..}...H5.s...A.|......t5.9.Bcc......-j.(...N.H.....\.~.!loH...Zr.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\78bff3512887b83d_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:OpenPGP Public Key
                            Category:dropped
                            Size (bytes):465
                            Entropy (8bit):7.510830227792882
                            Encrypted:false
                            SSDEEP:12:gB5spZosl8ay8QY3ckmOpGAqmkQJwFCRYTT/N3tJRg:iypZoslszY3ckmO9qmkuYTT9TRg
                            MD5:65170CCC4F3BEBA71CF6E92F3C84DEC4
                            SHA1:3A319C8F0F52392278933EA6BBF8AFD4AC4BD950
                            SHA-256:0ADACD0C1BEB522BC9CC83B96C155C2199EA62CE11716189E00677911F51C679
                            SHA-512:B80D08553D590953F5E9B68F9D4B76957E0D1D82524509464255BF52C9B13E4F81D6C518548D9281DF090E529EB1924203419B185893C9295B3B91A7BDD39250
                            Malicious:false
                            Preview:.&`..]JU.e..i..G.K;..G......hyU.k..ihn...(.q....s.(..F......<l.r...9#.$..&,.'......&~........*g..(V....F...'.P.vF.~.R?Kd.;..6........].o..TX.|H{.w:.I.....6U...._U.g.....X.~.HB{UY.:.Ou.#.f.T'.w.Y|.p...xO.c.D.}....=...c...B,....l0ATIT.B`.`(e.....R.,d.t...5..`.)...0C.....)NlU..Z~.F,.}<i...Y.+U2P..$......e...)^.=.*r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7f540d5ac2d70ada_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):468
                            Entropy (8bit):7.48699243243426
                            Encrypted:false
                            SSDEEP:12:3dUZprBFUhA4Ru+a4BiDkY8wFCRYTT/N3tJRg:+prB2AUhiDkbYTT9TRg
                            MD5:F5C375BECDC7542A570BD5A5D819A312
                            SHA1:E98AF8E65362AFB7A871448F4BE25CBDEC4B6831
                            SHA-256:07F55EABEA19AA5A69CB20EA15DED5B38358DE1D8EE869D7AFA4AE48063A0E68
                            SHA-512:61AE4BADC34E670D292FBD2F90ADF478ADD9D39BDAA81E007C6BF6DB539C973E3B9F9B97E53FB5CB5F1A0D85BE45149B9C77F638B2B7FD5C79244E8F78C905E7
                            Malicious:false
                            Preview:...,1L..1Cl~.~.......>.u...q.+qq...a?R.....}G!)...$/V .R..`..*.X;...!.Q...q@.....#...:.u.P$.w..^...........fzD5.]...`........pGj.-..vK....Z..V...dd.)?..b..\.O.v.ZD{... }<.[.......6....s`<.*..=c..6r.y..u...:...D.}....$.g..`M.RS,_...-A1{..]@.`z7.....R./g.tn'.i.Gz..)..Ti.... ..d....{...Tn....<.?/5.........v..\.`..w.q.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):457
                            Entropy (8bit):7.522557853347026
                            Encrypted:false
                            SSDEEP:12:FOW3jnElYQiXwC/L9qxTeCxJawFCRYTT/N3tJRg:/3jEl9iXtLwpJwYTT9TRg
                            MD5:C8B5368ECEB61201464E2080C0C1E343
                            SHA1:35E86119A3216E6FFA3FDFCECC659F851FDE2909
                            SHA-256:39BD404A9568EDDA5C9FEEB43CAE22D4FEE36D3D1C99BFE560FB02E20226E94D
                            SHA-512:444C96C664249A6EC557264B56D4CF0C16184B9447F5FE799C7E5AF22E3697EF3AD89F2AB7160F3CAF196CE5C9E1095FDEA59ECB3852C23D19551AA6897A56FB
                            Malicious:false
                            Preview:...J.k.....9..f.d....y/..t.~../5.)0@..@7..V.6......v.aa...L.7.s..r....@=K..... ........C3oo .....:......E*9e.|...5..;&...S. ...a..h .8.pv.7.....;......).:.5.....Cf....B..h..9.E'.......Id..g).F....x.@....D.}..Y.$...Y..Xu9...V8..){..]@.`z7.....R./g.t..}.Y3.-.....`.,.....~.h...Q..._......+..D..9....z.%....|.q.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):466
                            Entropy (8bit):7.520910443213039
                            Encrypted:false
                            SSDEEP:12:+Qe7MCRAfljNztxCl0nwxIiQ1SpwFCRYTT/N3tJRg:+1MCmlhztxIzxR/VYTT9TRg
                            MD5:A3801F7EF56A8B3D2232906486B755E2
                            SHA1:7B7C19BDFA22287499CE52ADB46B7629DFC64E7C
                            SHA-256:6A0AEACE1F66418A08D5D140C84ABFBB83930CB8482F4ACBFFF032DD0825EDFD
                            SHA-512:88787BCD27CEEB93C8849CF977DACA49F2D00BB24640069BC5A11C458C8C6E440B25E24D88B9A3391F4239EFF56336344A5726573CC7BBF5F3917FC4B82077F2
                            Malicious:false
                            Preview:.GL.vWg........=....&S}/@V.+c|.b}|. .z.L..>...K..*G..&:rZ.2...;r..6.<...@.....-..@8I..=...J....`.ft...2.*.{.u...m.!.@.Ma.......H..].`......$.T.M.:^0KK.T.....h.}{V.B..>..5V.%1Z...!?..{..8..;m...W.QM..d..MJ..@..d.D.}....-.....k........(.B.$e..B..`(7.....R.,.....P.....r...._.E$<7c.&...l.8.H..(.=U....|D.2..[S.:^..r..-z.n.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):481
                            Entropy (8bit):7.556673282333923
                            Encrypted:false
                            SSDEEP:12:EN1p38lp2U0MopcUyxAQulisTwFCRYTT/N3tJRg:ExQeyUaAflPbYTT9TRg
                            MD5:77A7617D8A863A789AC6E91585DCEE6E
                            SHA1:4E1F5F04B2D3B410B221A866933317734FC070CF
                            SHA-256:9474D7D56DC0C8793A38DE0FCE323B09E81053D33F131A4DFC317CB37AE32AC9
                            SHA-512:9B37F1B2E5ED26B98A8EC4308124E24985D2A9426462346D9DE78CD26B999F8912F8D110C48B8E49FA9957067956FCB5A5C250CDBAC83BF43B8011AE747CD4ED
                            Malicious:false
                            Preview:.z.ZQK..<."b...$_..l&~j..../8...o.'..7....p..-v,QE...59..D8.}u...'.H.p.....k<...d2..(AS..6z0.s......||.D.YRb. 6...j.9..5I....U..fyw.y.L.HW.c....E.~..%..t.i........q...+..^y....`..@~.i+....zL./S.HN..r4............;.m[.O....v..D.|1!.>p......#.t$2._.O.p<{...]@.`z7.....R./g.t..?..MoY...d.<.4.n>....2.V.f..........)..{.........[...bU9.2~q.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):438
                            Entropy (8bit):7.536421001652246
                            Encrypted:false
                            SSDEEP:12:C5fVZRN/SQCNoYICP3Q1bGApFrtGwFCRYTT/N3tJRg:6fVNuNJICP3QNXpF2YTT9TRg
                            MD5:D03E0D381AC3EBDCCD4C2838BFE95B5C
                            SHA1:A8AE6A169FF7FF6C5EC1349BBDE0FF114DDA7E1B
                            SHA-256:267E333B0181F95887979F9177F42418FDB4A447A02D5365C39941EB4BB62D9A
                            SHA-512:B42C6CB420B9A04A4E57CD2E54AA384DDA24E6E1361C5DC523F40D8E44FF004C87F8CC7779A274246DCD45FC73F5C1C357D928042E3C837AFEE9363FC5EAFFFF
                            Malicious:false
                            Preview:m*...[...@...T.p....u....w.(.5..C1.L..P>."...n...|......c.n*C..h.|i..C'{...z[..s.@N(/.#..v.5...*......}....<E..........].8..T....,....{..y.A$.....P.{.0....A....9........R....d...D.}....#...y...u..G.G-v>{h.>B`.`(e.....R.,d.t..8..l...N...d.y....9..8t..*.nO..ApZb....>.x....g...?..p.R....l.r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):460
                            Entropy (8bit):7.505885983749258
                            Encrypted:false
                            SSDEEP:12:6tgaa2xQedsZzJyh8Q/M7Z94xbDATwFCRYTT/N3tJRg:sfQTM8KM7ZStkYTT9TRg
                            MD5:F2B6A26F691D5220FE540E182B557386
                            SHA1:D17AE80EC2DE71C513533A7691FEF62C33D496B9
                            SHA-256:B526C9EF52F08D2ED54669BEBB519ACE3C915B0720DA08EAF03F657B2E95EE35
                            SHA-512:D95AA5744EAE7B6733012BD2ABDE766575D64B3B69B0DACA7F7B9A837C0D4E3C09FC3FC9055C713408FF1966FDBB323561AFB01FB263E30773EA1C593FCC8941
                            Malicious:false
                            Preview:.|......4(5.........qY......z.......N4.K.c7A_M.WS.aIfs...M..Q9A..T..z?.p.{....v..GE9.)..3'.B..+...}.. TL]c..9...Fz.vGu...v\.G.........@.0.S.h.Hr..}.ribBo..D.....so.......g..h...<.\Y.N.?ot.....x..TA.n....\.D.}....>...k.CX.(J.yiN+)&.N@@.`(7.....Q.,g.t. &...2...7F..$...z..y./..b....-.....)L.wo.+..m...F.i..a...s..\B.s.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):463
                            Entropy (8bit):7.606749215912247
                            Encrypted:false
                            SSDEEP:12:Km1QHB5pYJwB3javVMkDi7QJRJwFCRYTT/N3tJRg:D+Hz2U3uvVXi7QJR1YTT9TRg
                            MD5:46D3B7D674F23D19551249F45E81B0CD
                            SHA1:0CD52E86A1368731865315B2609C3B867F85D57D
                            SHA-256:B125A77A5FF80FA9DE5D89FDE37118F8AF93FADB38B812363A970BFC2CE6267C
                            SHA-512:145F7707F3D0D8BA81BA97DD9DCF002E304BA0FE23EA81E1F8C1169324EAC695A67E13D217009CA0F49D8C31ED5B43540416796F55623B42872B2B09333F2343
                            Malicious:false
                            Preview:.i.6......r....K1.....L.t`...b5...I.h..O....h.#.....~......(6.+.k...,a.E.....M")..>._...$c..}.GA..3Mu..0 ...>.i....mT<....r..9..jp.....16..:".F..}c.)..e...te.A%YA...=.Jx.h....x....O.....>l.[h...x.x3.t2.D.}...%..Hn.X2.yu:.....u&{A..@@.`(7.....Q.,g.t. k.?.k..)..q(L..qX....|%...\6.{k..`..-/..[z.=.W.W..I..@..]5.a.s.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):475
                            Entropy (8bit):7.560031284510169
                            Encrypted:false
                            SSDEEP:12:gqqK1dK/gZaVMXrvXGAwQBVwFCRYTT/N3tJRg:gk1dK/gZPvBBJYTT9TRg
                            MD5:74DC782A8C82373AA1B36184B2C25F4A
                            SHA1:387E3151D3550AF628C6EEE32FE9DDA1CE78A56C
                            SHA-256:A7EB34A38F6B016D6A1CB8EB32DAF4BE08A6721C5259A552EFEDA199406F7B70
                            SHA-512:41FE306F84631BF17CD374948A23EC99AECABDE1FB71C424582E6ECD1FC202DEE75A282CFB741238329A350B820F672F5BD8AB75E9D46D74EA69C7DE446961B3
                            Malicious:false
                            Preview:B.._7q...O...H.$....7......|.@....j..zy2.....x...3Y.G.....o.9.'.8....<kJ..%..OxqTP\...fP...Z....b....p........*.g*..aF.<..2L.DC..R..#.T..z.|..D..W.H?a.e.BdY..>.....q.......E..U..lv...A.(.>....(..m./.6~0..ZoVPayM......Mr..D.}....".I.ew..@6/....0ATIT.B`.`(e.....R.,d.t..h.f..{J'z..2....G6s.!..:.q.$<(.7.:OKy..OD....lH.;...Yn.Z...r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):464
                            Entropy (8bit):7.518676788535689
                            Encrypted:false
                            SSDEEP:12:/Aaww6kwWZICsmO+eA2jqXXJYZIy+761lowwFCRYTT/N3tJRg:/AwrwWZIvEhXK6GbbYTT9TRg
                            MD5:2610E901446186380825F8EEBF28AB26
                            SHA1:B4697183D7928D69F1D21A7DC238EB303BE9E060
                            SHA-256:7A348E016D81B1BA4B299B4E213C91827C913A28E33C75A3786B94B15CCE4D31
                            SHA-512:EBF939D4FE77C8099958F05C0676EAC4F0868F58AC691466994C70DBED0561EE26565CD40FE20CF1D298E3AD641C7EDC47C546DAE1CE8C8224783D52F6A6171C
                            Malicious:false
                            Preview:..`k.....O.).]......E.i.*J.!.7..;..79.Daz...u..8.+..-.t.Vj....z....e.^..+.1..Q.uw...i.]..t~..u..Q5......Q.4.]...dJ...|c&....N..s.*&C...,a.<j...y$.X.*.LvI.4.%..I...I.,h.}..F._..-.e..^.....*.<V.L.G..O...K.....T.D.}.....=...... ..}........O..]@.`z7.....R./g.t..Dl..|q...[...(.x..9.."..=.m..D3.~.........x.DcI..r..X.%l..=..q.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):460
                            Entropy (8bit):7.5478493185057385
                            Encrypted:false
                            SSDEEP:12:II8tVpuXYQYhh0QiQSJFycPAG8VMholHSwFCRYTT/N3tJRg:B8tVpuXYQYhFU34G8VMholIYTT9TRg
                            MD5:53FEF7E7DCA95718E1736DF2B75B971B
                            SHA1:797582EE5883E918DED447BD6C122AEFCDF7C26A
                            SHA-256:889366FA610F5F4B8D6C6E1325D6F3A0BFA7FA0CEB88DA8A78077B248B82CA00
                            SHA-512:356A5271D15055159B2193AF7CE66E28C74F6EA26EECDDB2ED4D252DEBC5088970C7EACD7F3710AB6DF40CAFC3690E8EA1C01EEFBBEDFEEE0A15F9BC1AC4EC2D
                            Malicious:false
                            Preview:...;..+Z.....p...?...w..t...../...".....x.n.Xz+.........r..vsx..<.....H.|]..._.[..Q..M.M!*..A..oiN..e-!Q......{e.I....t..>....y..!..X.O...]f+.h.sj.9....k.m..Uq._Ro.!.i.o.?J..eI..`+&.(B&..i).n....&t|)....D.}...#.d..c...S"..VA......>B`.`(e.....R.,d.t.......\..W.).f.A.'........?...y.9t.;.w../i.,)[v.h...f......~I..r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):440
                            Entropy (8bit):7.467878934052452
                            Encrypted:false
                            SSDEEP:12:JJp8rUM9wMMViQjdRneVAyH0vwQPNUJRbwFCRYTT/N3tJRg:Peo898Rnb60vBPNUJNYTT9TRg
                            MD5:DA27C1DA430D2692224DA3F4AC450CC7
                            SHA1:8FE9ED41829BB67618F8573C6307E88A42A3C1DB
                            SHA-256:D53247B641F6C726A94F4E35C2F3B35A5B57EDE1416CC3A8268E75A94BBC36A5
                            SHA-512:29496AA72E760965E6D453168302D99F39D06B8E642B91CECC8F9E5F4E5DDE2EB15A43BB6E67195FB33076FF8EA03825EFD0D7C0CF21C1EB803FB1D23F08215F
                            Malicious:false
                            Preview:.3.....d4 <...o.]=.r.F].i"...m.^-..Y..*...X....(..H0..o.v.\4.e)......ww*-0M..Oa.$;.r...(......e%..4..o....H./+.f.....0nTSsa..\Lt..,4..)?..m.GB.fu:......F..d..mp.f....a.=....^...5...CD.|1!.>#.....2.y#..o._iv?{d.>B`.`(e.....R.,d.t.!.X...|n....3....^...%.y.......^...Cj..)w.|..>....,M...#..G.or.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b381493e8d0a8910_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):468
                            Entropy (8bit):7.551054566039312
                            Encrypted:false
                            SSDEEP:12:KT5Qp/0/ODOfudzKFeyjMdBEX0siPmAnwFCRYTT/N3tJRg:vUUdmFej4i+AHYTT9TRg
                            MD5:178DA7B6354F8F59F978F1067761050E
                            SHA1:1DAD03603F66E87EE278B88E9F5CD67348D1E691
                            SHA-256:CA837F0597D8FD07EF48B1256519F789C7704BCD8530FF4F1503CCC9BBBF53AE
                            SHA-512:CD2DEE83C9C500F21FE88628CC3562E5136A955CEBAA1EC8DF74BFA77A3A50213B642F7FC443DC34B9A6CC11F90473975E39A31C160E01642A92F87F7273C970
                            Malicious:false
                            Preview:j..c.O8.W...!wg...D.?...s.5..:.V-..;.3....7....~~.e|.......%i..w.Wrj...".&_Os...:..S..C.h...._.."t.....R>O.aB....O...jw..@.oz7p.s......;.$....g..;......X...u.......<$......w`y...K.....7...&Y..)............%9@D.}.... ..e..wJCP.zI..Z.TA-...]@.`z7.....R./g.t.....q.er..............-."K..l.|V..*...$...=,7AzZ7zU..z...E.q.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):469
                            Entropy (8bit):7.543445200161326
                            Encrypted:false
                            SSDEEP:12:r2p2dv/Xcm6AEXkjyIuI1couNyenTcQ0wFCRYTT/N3tJRg:r2p2ttjy7IQBTclYTT9TRg
                            MD5:C8EA158A2714508F1FA6AF4FFD93D852
                            SHA1:78616F936951AEE5AB090017CE43A89382E09A79
                            SHA-256:3142FA0D847636E578462997A444DEE86674D8E402F6A6470E22D75D4E1F3543
                            SHA-512:E9EDB21575ADFBEFA3F7CE06D9872C14254A1F49B340DB9860B6CFEA68A48BA453CEEAF40A3F763C0BAE725D15A4639DE3CACFE2E2D00B3BB9B6C3F54864989C
                            Malicious:false
                            Preview:+.a..X/.SL@").T..^....%C.@....|_.?<.jj.JW=.-....S.........p.....`..i..~89..vc.....%#UK."LO...4...:]...[e.G|EEc.q.....\...8...[0-..................+.U.V.|sF..y...w..'J.......P..d.....S[3..|Z........H..!.6F.@0@D.}.....k..yV.t.....9d'.&...B]`.7......R./g.t. ....]1L..z.@.?......+.3Vk.......l...]..t...`O].a.e2....V{.7.v.fu.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):464
                            Entropy (8bit):7.514712631041967
                            Encrypted:false
                            SSDEEP:12:eZJgvSisETEoSynaVW94Zn2vafN7P9fiXqtNLcjwFCRYTT/N3tJRg:eZZzQCVW9qn2vaf3iXqtNQLYTT9TRg
                            MD5:2E0C155185F47C0F70D4933229E73723
                            SHA1:A3CF683AA3BBAAD8DEFC4350F113E5010316EDF7
                            SHA-256:6E5D6A07298297EFFB1DCAC5CE31A6A6B1D8B507AA97F26844B54DDC95A5017A
                            SHA-512:C6BEFD6DCF95B5D312ADD32128A99B288E67A940B2FB2D16DC86159A0B8E1F34C0EC689FF29983CE4998E0034F2714C38EFF8B3F6AFCD839620E1EE554CC5257
                            Malicious:false
                            Preview:......U....*....'.A.......p...h...^.K.+..S........9..v.&\.Ze....o<..L..i.B.>0..E.....2.z..+$...q..'.Z...B.z2..%.:.H........i#.....2....f7u.....v.6..H..Q."....bke...:....9...[...".It..E1.$Z.*.[.sX9..E.o&.n..@E,..5.>-....yX.._,....0t&{A..@@.`(7.....Q.,g.t. -.R4...!....X...G..*<.......3P~gp....y.q...?;./g..U. Z..s.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf8eae3dcaf681ca_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):460
                            Entropy (8bit):7.431034925613503
                            Encrypted:false
                            SSDEEP:12:o5DuGIDCN3YgS84Tb8pg26TwFCRYTT/N3tJRg:iD0DCN3YgS8gZ2EYTT9TRg
                            MD5:C12A2F4027350FB8EF98D4712E5E9561
                            SHA1:5877A64EFFBA6A55BA7C781CEC9469B3A35A7C0E
                            SHA-256:943CE16A2B16721E938006A52CA11EB68AA971344E5EED33078E21D79BBEF7F7
                            SHA-512:8DC0C002410A9CAED15F621C03C275A5AA4735D14E53ACBDA8ED24E654663AB4710CF7D229D4D95290AEDFE577A526511FF151BD9CEBB32E14ACFC4715802B79
                            Malicious:false
                            Preview:...)9.&y....,...D....+.l.i...T.@.k';.U....u...E....d.<...a.Q.s.".....?.....v3....]..:.n.s.Qu....I..,R.....G....#..Xu#...=............q.yw..:.K..z9.L...J..U...o...b.T..\.$.5....@../.Q*..........K<..i.F@D.}...u....cM..b-..{W...{L.]@.`z7.....R./g.t.2..F|.i..I0.i.......o+..#(|.K.n....f}n$...%:yA..5a....].m.KsI.q.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\c03c0918f3ea6b81_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):439
                            Entropy (8bit):7.497853576073969
                            Encrypted:false
                            SSDEEP:12:cIyl2sk7otwV0UvESUdvMi9JByZiTwFCRYTT/N3tJRg:NyYtMIESuT9JE4YTT9TRg
                            MD5:1D86E421F929BF19746105D1C534C96F
                            SHA1:5C905AE016F00D335DE40AF5CE9AA2E891AE2384
                            SHA-256:5F05C193D7649FA618C837E4FD30780063CC87C30D0796FE4AEB7526D137B269
                            SHA-512:E2A26D3623FDF63A69516536FD910F9FAA836F85B3086A1D8BC799A0B83A3E18A9DF0F80D0720A1AFD4B659E0FF3658140B9746A6EAD922497CED83AA2114607
                            Malicious:false
                            Preview:.......-@...#.FU..F..\m3._....,.....4QH..0.......@..l...+.....]..M&T..L#9.8.>X.V..;.M:.[....q...@..X"~.I"+.l.?.cb...H.z..........b5.z......*...|.0..."f..-.._.:.A4nH..Kn.....&.p.N.hAD.}..$-..*.;....~z.....dA...]@.`z7.....R./g.t.._,}....cI:.<....og....*.]{......]r.....!.......=.A.....1..q.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):457
                            Entropy (8bit):7.496376089460464
                            Encrypted:false
                            SSDEEP:12:fmqYXzjm+J3FiKRj4OTwLWcwFCRYTT/N3tJRg:czjZJ3FzRj4KwYTT9TRg
                            MD5:B913AFADB3038570303C9339CB2EE7C9
                            SHA1:74A38E0BA9CFADE0AB37BD2690271F2262474C73
                            SHA-256:99C8DF4A5491629B0C4B16395A78C0EDAE29951886866EC81A61E1FB7B5A96C0
                            SHA-512:154276EA2F3C93E6497A0122AABAC0ED9D3CF58EC52B33B11607FCAB25E455DCB64DA9E815C89595B52E645F484C185E89D291D04986E64868FEB3AFB174E302
                            Malicious:false
                            Preview:$+..j..[.!....tJ6........+.^?nd@bbJ^....|=..+...4FS..D.bG...M5.^.Q{Y.>I.'....R....u$......U0M.Z).i\T..v."_...:U+q.<./.U..sD......BN....3..yg.j.U.x..&.....y,K.Jb...;..........N^..<...25.T8..oM.KwE...GAD.}....:.......g,...nW.7&y..B@.`(7.....Q.,gg....c.D.-c.ZZ.lE...".9..........)...vc/....<...U.....Vr.U.o.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d5dedf551f4d1592_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):460
                            Entropy (8bit):7.525974997628317
                            Encrypted:false
                            SSDEEP:12:wP8I+khDl+TNqyANMlnmi426wocwFCRYTT/N3tJRg:wP8xQDl+TNqzylmixzYTT9TRg
                            MD5:647EE0CF6174A7B2D463AD9934576DAF
                            SHA1:A188BC7C7307A0FFEF4550D16C6E0AC6E24AA211
                            SHA-256:C83154BA8EC15C8B8870AB8E96EC252E7C2EC4EE48A6C2345D6D157CFC64D35A
                            SHA-512:1EA6A1713CCA8B9202FF713DFD677CF3EF93E9EC84BFCB34C6ECEF9BD57BA0D98A15B615501BFC854D48083341A99C308F2E41196AFE6B57F91F683AA2DC3D5C
                            Malicious:false
                            Preview:*bP~K.}.Xq>.Xg[i....~...Ub.4..<.....hS......JrG|H.6.,.........+......AQ....g&.h".H.I..e.@.....a......fX6.j;!%.k....) B....-..........H|l.......I...L.Zv..q.k....k^Hs.(G.iW.;g....T.7..m..&t........}6.h\#...XFD.|<!..r....Z3Rs..._..8...y..B@.`(7.....Q.,g.g.tpy.RD[.N#'....}..9]ySj.l...c.f{..U2..{.].....q....O..M...ro.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\da25e12456b6429b_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):469
                            Entropy (8bit):7.545301842812235
                            Encrypted:false
                            SSDEEP:12:NJCaNMJHyRGwRVjb/ZVOdRAqbQ5slwFCRYTT/N3tJRg:NtsSgkFRkE78YTT9TRg
                            MD5:118C0BEE197CF8EE38E5FCCBC6995E23
                            SHA1:5A896FADD0833B19FB9C19BBB75681D4C5631C53
                            SHA-256:8DE08479EFB622DE586B8179D3C62D4BD8E20DFD02AB236BAC44E9860AC42431
                            SHA-512:1E3B1557EE7E470D7F2D6953E0A6C6F08B4AE42FDB3D81379C767874D74F017C3170F3D154610AE1CA6BBF62E845AA9B3BB4ADA79ECD0676AB684F341059DAA3
                            Malicious:false
                            Preview:...........'d..G...5=1..t#..tC.j..^....1.^o.z...M*.D...%e:&....{.@w...|"..-W.i.#...W4T^.....+...7..uX_.....lg...@...%) Ay........X.........9..1}..........^.(c...n[.,..h^...[..._\.#...*.+..5.K........?i/..9C..FD.}....q..e.{.C.........b..B`.`(e.....R.,d.t. .\.*...'...wM@.s...._cL...1.&.(...nSJ5.r.....*..w52.B..cw..r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\e0924daf8f4398dc_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):463
                            Entropy (8bit):7.572157396406838
                            Encrypted:false
                            SSDEEP:12:9xulRl8B72h70JBUAwHlIaVYVwFCRYTT/N3tJRg:9xuln8B7yywHGaVAYTT9TRg
                            MD5:F94FAF3B74FFD13F3537640A93564AD7
                            SHA1:48C997532D25BE9AC92E80DD05C832B9E6B8A1B1
                            SHA-256:DB2786EDE3ECAFAA2ED1AF4F2AFAA58DBF64A0862A2B1045C4F84A09A524CFDB
                            SHA-512:334E0943A809F27A9C513A67FC4D4481C23D6D3B97CC38EF30C6832799936DC782209D584188962D2315D310BA56687AD45D71DB3ADC2C9208D733E153FF2B47
                            Malicious:false
                            Preview:.D.a%><.-.o.A.b..C.....:s]:xf.b...-|......".$.y..JB.14..N..*...#.m.f..;.l......(3{T+...g.v..z.y..... .jf.M...8B....&B....P.%._pZ..../.v]......../...,..w.c.^...n..Xq.$67.[...noN.'Ap...v....l.(YS..2...kGD.}.... .I.X...O..a..-#.{8T.B`.`(e.....R.,d.t.}.._...r.....sz...hv1.HX.g"I..jR0.e.9c.t.Wq..Y...Xw.2.........r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\e4666359b4558d3e_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):468
                            Entropy (8bit):7.4379783170253315
                            Encrypted:false
                            SSDEEP:12:bazvTiS3qFL9G1z1lSNruCYclvaDWHgTwFCRYTT/N3tJRg:+zTaFJGtSNKCYcNaDWkYTT9TRg
                            MD5:119CD55A6EAEBF6B6744DB8D1D223BB3
                            SHA1:E40A7471694649B52EC246320D09225A079E9597
                            SHA-256:2D5B29A0D77A421D4A4F9CB114390567CEDA38178777CE1E9EACA58D2F99B2FD
                            SHA-512:3B7A18C858A8682D62605212232E50E0CCCB036503A4EDBAC8C464957CBE94FE63912EF6FDFF4C1E9FAC99123C0D4A94052EB810D0FCB7EF9D097C2CD8B549FA
                            Malicious:false
                            Preview:...23-|$s>.....OV..v.ud.......`..~N.PoS...|d...?.Q...G>.g:x?.]_...S..X.8`e.:.j.D..)..........ip5...qZ.j.^..|.cJ..#....` .......;f..X_QQ..5.-=.....Z}v.z>`.D.]....G...F`.......~>71.s....:..X. ...;.q.:..V.y{G..A..GD.}.....;..3....e~....KWN.?{..]@.`z7.....R./g.t[H.....V.M...o.ZQ......%d.S%.K..@"....%.#.."&o;(d...g3hZ[.....q.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\e58e492b0f04240a_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):462
                            Entropy (8bit):7.512463457248525
                            Encrypted:false
                            SSDEEP:12:jBzbLr6v2lJdzfJJQbsAWyE7cwFCRYTT/N3tJRg:Vz2v8dzXQbhmmYTT9TRg
                            MD5:B56833581EBAF1B698E30C8528ABB43B
                            SHA1:5D0BB9E9940A84CD2417A69B98906B793FCED5FF
                            SHA-256:6B4CD222718C59389857C9C7C2CDC5D9CFCA1FE33F7CE2C8F956A53D5CB21FBD
                            SHA-512:E52EBD2B0B84B642C6485BDA958DE41D20D58F2A0806CB986B43B8A117C6E4CA5761E5B262043E04BD5BD31BDEABA868158D66AA37DD7F2E0552BFD704DE73E3
                            Malicious:false
                            Preview:_..0s.n].@.9$....q.^.[C....f..zw.ZE'c.?.fn7U./5..Dz...=....._...RF&.y.d....~L....P[.F.2.+.<....4.x}x...U.px".S..T... .....3..^..?..e%...N.e......{o./w..KP.........9.[.........EX.K[..j.l....5..]e...GD.}..Y. ......2.{ ....~.!.{..B`.`(e.....R.,d.t.*...._.....wN.}.._...9.&.^"$. .JSFfl%.F"..W._{.).=.......|.B.\r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):455
                            Entropy (8bit):7.501777763947764
                            Encrypted:false
                            SSDEEP:12:VdD6c0U2F2pjhzwgoyyvf+qrjEcwFCRYTT/N3tJRg:P5jbCP8mYTT9TRg
                            MD5:2AC070165DA30FC6873332DCFA50364F
                            SHA1:C5A856D22F20AF541856F67CBF58A3A9BD996C84
                            SHA-256:BF93A147D8CEB2D7311032C46A8DF68993BAF4080974B1CE8E2827B4D2171035
                            SHA-512:135312126937FEE30BC3C9F2FA4D11FADDA9083C9DA5CEABCCA59E3877EB0414F181D7A57456F7E4B85D5EC30EA4C11B9BDDCE794F3ED4DF82AD68E6AB4710D1
                            Malicious:false
                            Preview:..........x..5....4.{.;..q..............=.)...~.&l.......B.H....]....Q?!..U.T$..c..\..6...`.....+Z..P.....h,V.#}..........pUnTOi. .I:..+...G...6k....|F...VU... ().E........*.....x....|.*E.F.....X...DD.}..Y.".....V'.O.(....IB.?y...@.`(7.....R.....x.YA...J;...)t[....;...zlFmY.H|..(...Se....M....Kr...`4..zm.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f1811476c6b2cc5c_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:OpenPGP Public Key
                            Category:dropped
                            Size (bytes):469
                            Entropy (8bit):7.55861163318168
                            Encrypted:false
                            SSDEEP:12:KZWKJtLIaUuBh1itqjSAA26a/NVwFCRYTT/N3tJRg:CWSRXpzz6aVJYTT9TRg
                            MD5:F3CFBE2CB1CD12FE4C218F6F0DB8A460
                            SHA1:80EEC008067F331D8AAA707BAA8A3A7436B35313
                            SHA-256:30CE10604C6232254DAFC85D64C45EFF3FD6A8358FBC6A279B3D975276727B6A
                            SHA-512:DF18758A24A4FBFA6A86CEBE483E9CAA184EADB77C015823A9FB113523D56D33394E1A249B130DA46AAD1EDE1B3A15E17A28BA93C0DFFCDDF194CFA66F855EC0
                            Malicious:false
                            Preview:.Cu%...R....B.A.. fl4..t.e..Dp."}'rn..?.....dA.o....(*..!........EZ9.Y.aA..g......a..cP..).....?k........i...Ip+.p....^x}Y9....N7.n@.k.&.\A..D....).g._..N...-.<..2..@.?^.....t..H.@8..Q.../...C%$..&.M`.......v&DD.}...& ..h.y....])...B......>B`.`(e.....R.,d.t.....[_.......t........0...Xz.....Zl.p]...#.........>...[..ur.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f29d20371983e164_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):468
                            Entropy (8bit):7.575991330841103
                            Encrypted:false
                            SSDEEP:12:87z4kEnflygSyZGkS0dB8uAHz8bxKWbwFCRYTT/N3tJRg:87S9S8LAwbgeYTT9TRg
                            MD5:063A8DCD954A71592F661CB726BF5F79
                            SHA1:7384A46EC7DE27C3365E54D5AD8194DA4959B66C
                            SHA-256:C44E4E49F2E2248BDFEB756CC9B26084993FD2F5822F6A172544699FCD5E1C66
                            SHA-512:67DFFDA9C2A6B12710E5B522167199EBC46523FD9E43101C4A098A0EB6027B43E8DF4C462C34DD5E63F5F4BDDBCC482B59DAAF75DE59C8F90AC8677F3B92A002
                            Malicious:false
                            Preview:.,.~n.KV....-...z..t6/*.^...U...$.....LF..*....AQKMh..)#.&?<.,.@..v4..2]'....tb.!.<..&x{.l...L.U..=../.....\1.:88B*..h.u..'c....)..W.l........d.?3Uh...;C1..._.d5j...C.i....UY...WU..._.J.....;g...._..$Y.y.6. ..DD.}....>...b..X...@.k<[A....]@.`z7.....R./g.t...@..ZjY.=.f...............E.....;r.3...F...+..8+...:o3}.,uq.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):476
                            Entropy (8bit):7.540306847503898
                            Encrypted:false
                            SSDEEP:12:TUzl+SbLbFPESd2F9j2dJm44Y1JwwFCRYTT/N3tJRg:TUQSD1d27jgzeYTT9TRg
                            MD5:AA2659722AB8112E48EB1C6283ED605B
                            SHA1:2AABC3A891F23E78535E957A4C5C9E695F51B63E
                            SHA-256:EC80AF467111DC74B3965589F03D464B1C29E1E975EE5A582FD7B1A4F5059234
                            SHA-512:C4C00139B73EA2D097AA6AAF19B84671680CAE706A3DDED8222D8A7678714BDA5DFDF9771D8CBAEC5D510B94A82FF2A5B0727F391BD6FBCC892B87734204A09F
                            Malicious:false
                            Preview:..|.x.8.AngSk9.?.. .v...O;..h...xM..8....,oQx..$.....P...+........................%.U.....Is.....O.9...^q.1p .Sj_...x.."......'...L..pn.-u.^..+c...,...&.....Q.!..C..^.I.P}.rKY..{...7..A4...:&..) !.F$b... }..)R..%hQ.DD.}....'..I.X...#....r.U.,&..YB.`.7......R./g.t. ...T+]..tJ4..D3...)...Q...].S.4.....7!.oE. .....:A..TY...@....B.u.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):463
                            Entropy (8bit):7.552516826364072
                            Encrypted:false
                            SSDEEP:12:tjkARl9sEJ4LAEbD/dfnWTwFCRYTT/N3tJRg:tgfEJ4Ldn1fWbYTT9TRg
                            MD5:66CAA5988B74E4704B45F8086F7BBA5C
                            SHA1:BDE18FC83E157BB4AA91801F9BFB6552210A257B
                            SHA-256:18018B39EE2B84BD53FDEE1798F05EA0481A231F98BB72758A82F5E2B2D613CC
                            SHA-512:64A46394AD13B57FB2BF800952097D822DCDD924A03CC68ACBC94B1FEB88131DAC39526FDE24C72B9967C59E877549EE0D96005B1273A49373E0B13ABD987C1E
                            Malicious:false
                            Preview:...hw.."...\-...T...LOQ`.Q..c*..Z.<.8.>.4.\l'R.aL.4..ut.A..z......M%x.W....|...ve.[.&.e"..5.u......Q..UpQw7..........lo.~D....<+8..]...k...........MWp..5...D.......M..........e....[..*_.F...|D0c.U's=v?.;DD.}....v.....bO.......ykN-)&.N@@.`(7.....Q.,g.t. .....k..Q......5M...qc.!.....e.XN.FY.0US..ZS.2....u.)..=.....ms.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):456
                            Entropy (8bit):7.460772389482855
                            Encrypted:false
                            SSDEEP:12:8m7u+VyY1LUuDxNMHA8ovw7UwFCRYTT/N3tJRg:37N4MLUuAg8ovtYTT9TRg
                            MD5:0F9B32352972B1CE4504619170F50A7E
                            SHA1:5E152510DF3029A17E35B9CE356B621B1325D163
                            SHA-256:BC9DFC218CB43991EA1D2C34C644998D59F73F296619BC9E8CC99D16E49657F4
                            SHA-512:F20B67A6AACB6D131D14C740E5236C074D00BB2B092216D71DB210AF83CE5F822F38B1BB54C9191B6DB0799596E95327522510263654768BBAAB69E92EA39B30
                            Malicious:false
                            Preview:...7p..U...5...2.../>....b...'..}.....G.e#..R.`..L...t@.......S.g.#.5.g>.H.WJ.i.N....+.cF_..U....d.$.......t6.......9.#....v9......JwQ7M`..h...jw.$ri.....d*(.V....9u4\.!...P..:>.lR..uT..<J.T........v.DD.}....v..g.c...fx.....aA8I..B`.`(e.....R.,d.t..+....6.~l.N......8.*?..5(...aQT.......Z.>.....(CI6..q.Ojw^vr.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):480
                            Entropy (8bit):7.515568884232868
                            Encrypted:false
                            SSDEEP:12:mWieToZREycZneitScsfse0+SitKiGA12QWmZs/wFCRYTT/N3tJRg:m8EzcVqfs5+zK88CZsfYTT9TRg
                            MD5:B6413DDD8B593DCE4ABBC0155E92CDD5
                            SHA1:0FDB6E1381159397F23201D738101C316D4B4B3B
                            SHA-256:B9FDE0A7B3930818C4531025E2D40F96304ED1F663BA0B996F6B89A7D0E6C743
                            SHA-512:946520ECD5B32A2BB2748B5F1B74757B7EF00C9EFC0B1938956DDFA8CA2B1CA7BFF0DB9C74F16438086DD44750FBB153C7A27E6BC8BD33C570B68CF8F2804491
                            Malicious:false
                            Preview:...1.C....xp.?m..T.+..}..cm......::{h...?"....vPb0..S.p=..5A7..WEa....z.....+IH(.9.....i..@p...+...*.&..w9...d.O)NE...@.n.j.rJ!.l.iy..d.}.2n.....Ev.."~..l..p>...0..%..g.S.ZI..f.`..Z5:H.9V.C.[.xF.w.Z.....n..y....H......y.vDD.}.....?........!)...D.0ATIT.B`.`(e.....R.,d.t.k.N.)Bc........Y......d..&......J(...$kT..H.J....V......aW2r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1683
                            Entropy (8bit):7.879789964678856
                            Encrypted:false
                            SSDEEP:24:blUoeZNt/NiU/giUQLnKSpwShGRHQBaRH7IZCo2Xz3MLNVB4Qo8nMn9b0Ikj3JM9:aoeLGi3LohHQBaRbS43c4fnrRFeXzTTk
                            MD5:ADB822FA260CE83146556F4053214E28
                            SHA1:2291331B37A486A6B789D4A16003DA9126F6D4AE
                            SHA-256:D7E9B0273B238657B197857713037AF9DF7408E6ADC6F59F862FCA2E1C58747D
                            SHA-512:DB9E364E3DF67BA2831B018C3BF71429CA3C3058C61116052AD1167FCE48118BB0E9111B12EC864857D119A763923783A745AA55C7731B49C40415B1F111CE46
                            Malicious:false
                            Preview:..uQ.... .g..A..vN.\....|/.i.............8.....m..j$...0Z......e4.)^..Q..1I..l.!.....H..@`..Ab.3..LN0p[...n....?.#72...A...|....A.t.....R'-.n,A_g<7.m..>.Ko4an.._EM.Qz..J.9.....=.pGJ.4t..U.%?J..CL.&.V..u..#.?f$..r^.q..S..%..+.g./...<..!...t..J..J....k.s..,.A.....O.YyCC...?..06.%0}.8q..co..uX..$.vh$..M$.0.A..O..(...0..z..I....@<...F.l.6k.N..c.jd..{i5t...G\.......S>.8P.|..X._L....?)e+..F.G.zu<b..q...".....o....%m.c.u..;.........{.............K.eP...3.bWu.;y.us...{au.LX..m..u...F.......r$(.......`.(.=eKa...pUV.g .....A#..6k.c.p.z.k.=~6..X.>?........].>.]......n[.m]H,AfN:.b...@)m......-.Rs........R.Wy...k......l"....=..-.".W...e.....4...8E...L....lK.F.......(q..6..*H. .~......b.s.......3S3...j.c.....M+...&........>...L.b.z.....\...j>.._T.6.0..t.L.T..Gm..G.E....L....p..}..@.c%A,.....s....S...V..m.:+......&....k.....j.....WY7-Y...2.:.Ds...G".L....A+.$2...p.....n.G.].G 1.av..Q....q8.b....YZ&.(.Q=.'.y=2..(....m.v..N..=>A.....~.::3.C.<DS..1~.+...

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):253
                            Entropy (8bit):7.1338509362090035
                            Encrypted:false
                            SSDEEP:6:QD7o8f9QS2aMvRE11QMncM+nPo8aC6ztDsY80T/f/9FZtOoRg:QJ21aMvi1CMnjqwFCRYTT/N3tJRg
                            MD5:826D6A4AA539F6302340BFE116590D9D
                            SHA1:11C45A011EB91D56AFDE8E0221966AE8000ABB93
                            SHA-256:13FF52D14F7D6FEA0836E4F3653D6B3FB8951901F576D0BC782C493411869E35
                            SHA-512:B2D4B77BAFF60D11E5CE8CDD20420F31236EB0F1AD4C386A678979ED74BE2F499717811ABC9E7592389B73AEE14ADFAE815F3E0C0486C17252ED13A862ECDEE8
                            Malicious:false
                            Preview:>4?.h.C.Yb.&.|....y.".cKD.}...l.t..n..2F....t.@.'y....j..)e@5..MA.......~W20.(.v.w.w..8G"....P...F..e.~.w9..I.tm._.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\the-real-index.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):291
                            Entropy (8bit):7.19521347681602
                            Encrypted:false
                            SSDEEP:6:AiLpaqeLAe4bz1bk03yGY068wGlZcPo8aC6ztDsY80T/f/9FZtOoRg:TLyL4zRFPH6tGlZcwFCRYTT/N3tJRg
                            MD5:4C082314CE10835CCBC4234CAEA36052
                            SHA1:9BBC922714C46A161215745349201FFBEFCC6D8D
                            SHA-256:4757793A44ABBA64B604D54904CAC0BC8C7A307ECBD9677B6CEE036712A6FF53
                            SHA-512:4F6BC2F3CE1F4559B83BED2462606CA31287C575EF5EB7F9F033AAC41196343EAD47E760E77128935BADD3B61AF3B09212D8A25A4B899D31CB3839E6E55ECE8A
                            Malicious:false
                            Preview:./e.....h;.L.n..8.M.I?.....{.8..L.g......0..XVD.}....f.....{GC...J..l.@.?y...@.`(7.....R.2..........3.C...#.........o...>........!.)...z.-.4.1//....m.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):253
                            Entropy (8bit):7.1654714895686835
                            Encrypted:false
                            SSDEEP:6:cPo8aS2zvplLiAa9aY7Ql8nPo8aC6ztDsY80T/f/9FZtOoRg:cQ8a1riDa8bwFCRYTT/N3tJRg
                            MD5:D280F5009F3648E6B85FE4E08AF4CFCC
                            SHA1:F87D35F1CAA5EA5143E251B1A5CDD166A31E1EEA
                            SHA-256:F02FD68C6E706AC35D69AF80110CC61E6E0D62DC279CE21FA4238FED30317C2C
                            SHA-512:A477CF55410F1B9E1DBECD1750073AE0C2C19336EB594D06BE154D00DDC2FCDB8CA82AB84E94E31F8885679A4B15E5B25A20F64AD2830458201BDA2C9FD297FF
                            Malicious:false
                            Preview:j>/.=.0.F"..:....O.0..KD.}...l.t..n..2F....t.@.'y....}......~.U+.$R....L..\|q.#..M^.5.....T..Q..A.u...Q'..hY..a_.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):519
                            Entropy (8bit):7.634024611098702
                            Encrypted:false
                            SSDEEP:12:zX4THEUZpG/4bnVKfXAaB05bpjjzPTwFCRYTT/N3tJRg:rUZpG/KnVKo/NrbYTT9TRg
                            MD5:BAA53D478CBE509A40B3243D19749624
                            SHA1:27CC3C4E98A2972199CB4ACD0EE25119E20545CA
                            SHA-256:281063DCEE5BF81573A9693D07C4275E72C2D5ED29E844D3E7164A81DAC8E9F3
                            SHA-512:9A4366ABE13F61E789D44F1F67F7A0593B81152704690573C0A63A0A36E2E4FAAECDD92CD387A43B6E65347645626E477F8BA9D8CA4B4A0F6C19095126CBC2EB
                            Malicious:false
                            Preview:..3 T.O.Ni.kS....S].\.A9....cn...5,.H...ae..o.U.....w....?p.L....W..e..m..8.....D.....OJ....i..8..].*...tE.V...m.....z.....i...T."..v&...Y.n.W.Q<....8.......T~..#.Q....x3.i..`....Kr........aJ'.@...=.vE|..=g..V.:.%..>s...C>...i.\c.f....y...7.f..5..e.2..i....K<...w.Fl..\....2Jo...nD.}..u .....n..`F....t.@.?.._...#2......g...j.q...f.I&.'.....$..K.?..GR'.</.x*.[..=G[.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):527
                            Entropy (8bit):7.560598953550473
                            Encrypted:false
                            SSDEEP:12:G+HRCpIMLBAH4RjRkzcA9MTLB2yx5L+qJpV/imWWIuPMcwFCRYTT/N3tJRg:p1MLCHa6D9SBNb4mtjYTT9TRg
                            MD5:46038506C4B408E249361F9C89BCB57B
                            SHA1:11C4BC65E4505BD6F48444A8031D5BE0CFD9ECF1
                            SHA-256:3C9DAB2C58CC6941785B9876EB75EA5EE38DCFC5DA6676833BFCBC74C71C3ADB
                            SHA-512:4E3E282827C0349E3E79B6334B3C9227F970983C1DFD7BE7384EF612A2C1A18B06E207BD23B5AF8E5DA884D75F49CC9470D5FF685D0135DAD6792370627BC3BA
                            Malicious:false
                            Preview:..{..CD`..D.....b....L.1_X...........$G.I\+.../W..~....g..r<...}..p./K.7"...x`:.jQo`....H.Zg.......[....*..}v.H...n....i.(A&4....a#)....v...9.PZ...B=5.Q.....45.^..g....ky.X...6..B..1|......q."..$....)v.3..T"<=.t...;.b=...U.an./h\$?.I.F....a5...I9 I..(`"..b.a....d.c.p\....x.Z.78H..*nD.}....{.I.Y.,.qF....w.@.'y..A@.`S8'>..B.b...U7.../.bF./..z.Wix.m3,`......n.7...h...D.%VZ`.t.-...c.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\CURRENT.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):248
                            Entropy (8bit):7.177308042240113
                            Encrypted:false
                            SSDEEP:6:3PQULmWfCM5iVDknYaMrlh8KQKBZcPo8aC6ztDsY80T/f/9FZtOoRg:oULmW7YDkntMr0KQ8GwFCRYTT/N3tJRg
                            MD5:6D3BA170D27A90BC29224BEA345AC8E3
                            SHA1:EFCC9B523420CA6D2A756F59B31F3D843529ACB5
                            SHA-256:987210A89B75A99E3B1256C9167B6F3FDAD27F6B04D00C3AE13160F442BE3CF3
                            SHA-512:E146E37839B9E9716604BC5AC26BDE493B001A5F0B5603662172E7D063F4DFBBE2829779F38F48E62231AFEC01E7D5D779C24AD41453F288265A7B19907DDA1D
                            Malicious:false
                            Preview:'H...kj......aD.}...g.@...n..`F....w.@.$y..B@..V..-...~trm...xL....m..]...=.%....!g.@.'].G.9^.<.....z..v0TTb.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):560
                            Entropy (8bit):7.6436337886774846
                            Encrypted:false
                            SSDEEP:12:Ampclx9tCy9GfAe5soYKvkbgHzCPjp/ZLdtoZCPwFCRYTT/N3tJRg:7p09abqghHoNZpVPYTT9TRg
                            MD5:93523943D347EB3E93D9F20308BA535F
                            SHA1:61503C420B568B34B60AB94C4D1618269F82A19D
                            SHA-256:9066E177D1CAA2555DA65A41481514BA7E782440022532A3AE9881062D0F67BA
                            SHA-512:BE4FF42DD90EEA5A28D538A3D934B5D64AE937CD80E2D479BD2D5381F1E777707D487FCFEC5A60D0B0DB33DE7D689704F39E08D7FE592490B1845277114F2FD5
                            Malicious:false
                            Preview:A.[.=B..u.e.....Q....5.L(\..R.[m....K n..`..4L....*r.%rBx..I6...Ft...%.GGI.....W.k?..A..7.......I....E......[...).5b[..8._.....w.."....#--8..'.{..uP.QZr.vb....v......V.6..n.d{X...O..y.a..~.".P#p..$........W...l.+u.(...R..D:}.l.J.-6...6...5.../t.....v...-..g.k.>.)....w........4........(.....i...Z.2.j.*I&.N...B...lD....onD.}..u .....n..`F....t.@..NPpY.^d...,,?....X..@..7.........e.......>w.k.."..I1.'V..[.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):568
                            Entropy (8bit):7.6115902994794595
                            Encrypted:false
                            SSDEEP:12:zInfwNVFMBIZFXxdCc1H/V90tVcwFCRYTT/N3tJRg:C4nvZFbCXwYTT9TRg
                            MD5:6255FAF75EC816E47B6C2B9648383B87
                            SHA1:99FECA1AF2A1E4FD4B723E904505130DD40C02C1
                            SHA-256:E8398A4C613E3EF468D6FE21BDA0FCCDC7CA67AF28D309455749749170B14F8C
                            SHA-512:E30B25841900C3F5F6F032407CDDDE19D8F2A297E3F44874F02A7E89E1DE7638BBD6B3AD6D61491F8029AA16B317805FEF4485D2CBBDE18BA98A153A277C86FD
                            Malicious:false
                            Preview:.g...c.....v6.R....&.uG..f.5....u...W..s..f+.....7|a&..%..P...Q.y^1.s...=}.z...=wF..p.=>:.8...n..........o=.9BM...8]..n.m`.yi|..f.m.9y.. V....w6..4g.V.......:y..Fm.{.....:.O...?x8......Bv.~...a.?...._.8.tr.....O_..Z.....l......'45.%..v?D.?.jfX..T.;.D...0......n.*.9P...|.%.)..*...H..gF7q....Y..../...'...a#..~.....s.N..{.nD.}....{.I.Y.,.qF....w.@.'y..A@.`..-r.K...aa_..N.$.yU....%Ianq..O....K...H../$m.....nN..%.A..c.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\MANIFEST-000001.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):283
                            Entropy (8bit):7.226098161504864
                            Encrypted:false
                            SSDEEP:6:2KpGPEK2kULGjYSpmD5E4LVhprXJywVIcPo8aC6ztDsY80T/f/9FZtOoRg:tpGnsGjYSpmD5Euhp1y8wFCRYTT/N3t0
                            MD5:5432BBA04B9D5CAEF5A8AA5F638F78D8
                            SHA1:4BA24244D85D852A7F0ED0D356FAD421A84F88A5
                            SHA-256:08CBEBCD292F42EA38E879B328E4E9E202F70F9AEB1EACE80D4C34938E976489
                            SHA-512:991B1CF12D1BC4A748296D4583243A7B32B8F90A25781021A8A85890609E65FE332F3FD9B415F76288C876DE3161398F37F151B3135C52886FFEE83A24AE8BFB
                            Malicious:false
                            Preview:?Fqm+>.k...r.%.P.j.T).F.c2...0.~...1.I.oD.}...R.I.X:..v.....@.$y..B@.`(4.....R.%...t.<.&..(............c;.9.....M.p.r...EH^..Y.%..r.<.H...l.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):731
                            Entropy (8bit):7.668554338489483
                            Encrypted:false
                            SSDEEP:12:X2lNq7pRpJIhjoQ3VOjD+pN+DyIiDsLceE+o0HyTLSJZF6kf4BS75MhVGKAYL7sl:YQBWhjlwjD+pN+/Dno+yHWZF6kgBy1tb
                            MD5:EECEF313DEFF73C8D58C42B74680A304
                            SHA1:1452C9761C9A0A8B821526E2E25806A8D2A9EBA0
                            SHA-256:4EC6BD892E30FC2ED4024AFC393CBEAB7A8E7FE6DB52C0F3C9DA77A9F7D11D94
                            SHA-512:1F3129C83E6A8C07F3863D13D29614A6467FF3BF255C3B1FED209BF55D52C0210B1BE7338C0B5B74466481EE1A650589B862089AB072A69A38FF5D83531BC208
                            Malicious:false
                            Preview:..sJE.5. v.&..#..5P.[.....J`..._?..Lx..M.%.......r....2.T.R..A.23}m.7....0.O..L.w..s.N.B....l..n.{.TvuZ.....:.1.@...[.s.t!.n&.nTj=h...Zt..0.0..O.....n.*.......Va..[..m...;..g...~.....wDw.,[......${)P...hC....u....y....Z.........*6.#/[..~..p>v....Y..v[..!:@.3&...S..G.y...3.....$. $`...I.6.|.g...O.vU*.8....x..e..s.\<....b.3#k......+..._v...bD.Cs.Wr......X+r..j0E.7.[.......j..YW......IT.p.J.."e0I..J.>...3.g..j.\...9....I|I.[.Rs....b..Da..zn>t....I...:b.....E..~...f.nD.}...x.I.X...5..<...pp....]@.`z7.....R./g.tH.....{n.v.3....O.;|...-.....Q.z...[W.uv...B.0..<.....o.."q.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\MANIFEST-000001.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):283
                            Entropy (8bit):7.190271428333776
                            Encrypted:false
                            SSDEEP:6:ExBcCylCyGjYSpmDAtbnA3AoXcPo8aC6ztDsY80T/f/9FZtOoRg:UJyGjYSpmDAtbdwFCRYTT/N3tJRg
                            MD5:4B9A9B957F6BBA5390FCF8FF3C843B43
                            SHA1:91634CA78A4CEACED25664BB2A726ECDA36E784A
                            SHA-256:26D3C326F3C487EC1D89260729FA0946A1E7527CD370C937CFEDAFDB0A13A5CA
                            SHA-512:4F172E86AD0DA27879BCFB3A6188E55A2A473E9846EF51EC9CE0523DFF09BE5EC025B68269A84C3D58952BE34494CC6240EC33897F78B540B7A778EC85EE041A
                            Malicious:false
                            Preview:...:L.-N.|!].o._..D....97.....gz.6..K..oD.}...R.I.X:..v.....@.$y..B@.`(4.....R.1^.-..G...cM.I6.GB!V.............+.!......w.s.#.F.v..`h..H...l.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):20712
                            Entropy (8bit):7.991416961880369
                            Encrypted:true
                            SSDEEP:384:EBl/Wfvs2FbjJZ9FktYj9l8VBy2PeBPGWoPEJYhVRtQ7NGCznsO/FRfjl:EnUsOjJFXcRPKXbJYk7k+F/FRfB
                            MD5:9AB9DADA4843E61B0E6B2B3A86C9638A
                            SHA1:CF81EEAF1B3A54576BCD8DA4422683917F35356E
                            SHA-256:E73FB306603038A2B7803F0E5A95EBE6E6AFF6B006CA1E2846757F8D571A4B17
                            SHA-512:4A2AECC1B146032658B6DDBAED9B6878615A24DC1F785037FDAC3FD202A9D3D4FE8901B7A9454B4F22498C6052BA2CDEE950C2CB38B3C3FF3D1DF2D099D0924D
                            Malicious:false
                            Preview:fV|mO..N;..u...B.|.b...#.<.d%...AF.A-t..uN..X..9ew...."b.l..[...\.|..}..|./l...`]p..>.....&.......2y.[..#.R.e.oT.....i.'..wO..D.bM.%S..h......rn=.o.<...2...a..?....;a..=.7...a......K.*U.I...~....O...u<..T..yc...:a..g.....'.B....h...n8.....]....O......j...;2Z.?.1...d.d>...T.............m.&...2..... ...j..`Q..?...^i]...>P.Z'.M.C.7_..Jf`..G..B~..G.D%...h.5...#9...v..u.L..-oW6..se8k..F...Z......|%..I.?...m..ci6...&..F~.......b..........$.e.......c(.*>.u3jR....^......]X..C.?g-...............N+|.>...~8..9i..<V.l>.C.-....l.'........}.Q.F}.r.E.k*....F....7..E.F.....j~.!Px.j..;....+?Ij...\.$..7t..o..4<.Lh\N..Z.i.u8...v,.j8;.3..c....P...WSx..........xq......./..>...P.i....q,.....g.......Z.3...(.....2...i.%b.XX..P.F..o.....>...[P..S,.-...=fv.c.......wm.......#_..a.@..~.A#.oZ.t..........o.....O.&._..L>.3.O....e..i....A..A1........z.S%B..@. Q.wWB......0..aSG....'.FD...t..L.(.}.o.0J.m0D........Pl.[.......;..\.R....E?...(.5.=.s.]2....._.j.i.:..];T.II$pzAI.Y7U

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):763
                            Entropy (8bit):7.751843716230405
                            Encrypted:false
                            SSDEEP:12:jxF1zj7DohLVekkkoGhwECPIsX39GP0NENbjJ9FeeW1CdtyF9AMRlQAUcwFCRYTk:jFD8hLTZwECFH9GP0NENf7FPWQdt8AMX
                            MD5:D597FB773F159F64C86BC76BC756ACA7
                            SHA1:21882E33FBEAAE78E8645ACCBEB16E53C2A10270
                            SHA-256:66DFC96AB7941071DB9D9C94A395457E3BABE1A5C96C61640D5CE2ABCAA5F4FC
                            SHA-512:1BD6C3B76AE714B423125A403C58B51576E080BFC226377BB15276E8A87B22D9A3242ACFBC43FE3E0F79EA3BCAA66FFA1C288A5B250A3FB4E6B92E5C69387F4F
                            Malicious:false
                            Preview:.Z...w.]..A..`...U/.Z...N..x.JVQ...z.rzE?y?...]....LzH.v|$....r._[&....".3.>.l.7..P...'MaQs.........Z...3..../cd...@.gO..Q.XFv:........~..iU..#.....`...w!.&....eU.....I...d..`W........E.....=..u...'..P........7~^......u.....o.T.E..NN....h....NA...=.D2..B0..M...H..5.BI.....,KF:G9'..5..d]...`........(.I=.t.=.b.....>...z.........t....u.!>..r.y{....0.O.......<|n|..).o4..}.......j.. ...,........X..s.;i..]..D\v./a....^.....{>....y...kb+...".... .Ns.....kG.HNG.."...................3.'.lD.}...{.I.XN..g......4.J...j..8.......,g.t. ....&.O.pe.oNu..`...<.......bT.P..3...=z....RY...&=T......v..L........y.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Reporting and NEL.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37113
                            Entropy (8bit):7.995296049727479
                            Encrypted:true
                            SSDEEP:768:SYijXYwX4MUrEHx96z3qLL/B6BtJXtSpga2Ra972eskfvvQCSfF:SYiRo7rEHa3gcTJXtM7lskHvQC4F
                            MD5:748E02BF2E0F7B7FD46C2D61D3C827EB
                            SHA1:95656A021D963353EC8030C1155CFF71AF1D59EE
                            SHA-256:BAD50D372BC75B0FB562B2D4A2E8B3B7BE4EEF9A2081F3F5E21866087AB016BD
                            SHA-512:AEB4D12B5B4F38CBA40BF5D58AC11D246229BEF3D5B28CDFB41B6A2C28E2F051701B7FDB3CD8658DA4D3AF2B3A681E3321E9ABB60D1969DB1C38529D63E22181
                            Malicious:false
                            Preview:wD>?.5........b..n.....1=.;.Cm.=...8...t.....~.....@.pL...|...~.P.f....8.KL....i...+....`].o.q5.Q..7...".....^..yRHba."s[..lR.........Z...wA. ...w....?...AY.9;..L........c.6.......D...D92.+.......bq.m...T.n....F}....^t.B_^wL....IO.5_`.. .!q+p.~...R.....T...C.....;...>`..EOU#..}B!...:....Ly..'......_V =....!..u)...".X.U~We.4....A..6..M8..`.......aO8.Q..V+...=..k(......k...xC.i.^7......a.B....h..w._..W..6o.R.-........%.."...x6c...T..A..V.qV....e'.t?6/F..._.T!B....C.I?.@.....-..bn....V..'o.X{.Oi..n.T!b*8.).t7.../...N.!v...}9..2].......w.Z,....\Il..p..Up...R....L....IX..5....U.;.%........7j...f.5...4...........<P....@...#Ah.R..e.(h....L..QV.~ef.M..&Z.sA...oI.{...tv#Y1..W,..2?8C_-}........k..3......)........!i.y..... ......yT.......+....gh.I.\.....8..g... .Z.od..,.k.....(..o$d$....W..cm.s........G..?z.H,......ut.S.....N..Y....".<.C...)*^.{._F..|>...,z..'?A..A......eu..i.......Vu5.@..S..Bx.O....q....&.........r.8...-..\Y..&?F..S.}..go1..ys

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):3846
                            Entropy (8bit):7.960074601449906
                            Encrypted:false
                            SSDEEP:96:CU6tagFZlwq+PWqthWRK4uwgMxNfkwn+wKxY6uYzJCri0jVBA:Kw3PWkhJwgMx1MXutu0o
                            MD5:FE56CC497BA22237C97CE808E8FC6BA8
                            SHA1:1EB9D3E02562C1939A00911A1039AFE80B61BF9B
                            SHA-256:81F5B161788C3D1D97C528DE9F8455E1159195FF31C7ABC60AA622A17074F725
                            SHA-512:828AEFC7085D248DD15B1B90375F9219ED7163B84FC69C39E9CAD33B10186FF2CD001F20559D83070905FCE244F1AEA9621D4B216B2E5F15DE773C49E3958CCD
                            Malicious:false
                            Preview:Bn....o....._5.l.r..7...L0......$..oiws....i...^y..-<...<r..g.....H.....?*....k0.-.s.qly#c2....A.PxY.b.!.f3.O.z'E....,.-R...i.O=.;...|E......5...n..,.0....z.<.*b.Mhx2.RWT90s...=P..M....i..W..|.x??lt.L&........(.}.D...~..>.|.......j.v..o..k..Y...#.~.c.v..<.L..9+.I.Z<.v4..=..$).z.Fe..`t.....3.Q....Y`......60....=...=...>.d0...4..h.9%.U.ks.Q.V.h.'..L...^.W}..hGr....5....-e-<`......:8...!z..W.\.....".j1.....g..o...).n......s...pe..x\...C.D<ng.....,Pf%..@...G!.....q]..y...gc..%.%O...'..km..-5......[t .T3...c.....Hs.8#.[qc..!.fwy.P..0.B...[....I..f..7:.A...l4 ...1...x.D...O..[u0..[\W?R......m.^.....F.k.PV....L....+....x.. .8...gfa9.....).X..4...bm.dJH.]..l...u..+....v^......84.AC ...n.e..p.C?..0.$q...9.9.dl....H....>._.e....ko......dO..'...<Tl_)c,u..q.d.'>.{LD8...._>;m.....YO..e...........\i3.....s...x.t.........w.).P..-o..-.^.@&i .-...cyC7..w1"?%...............Eg.._q.4B......%.P....q..Y.G}.....B.Hw6..n....V..1et..}...N....J./5...?...A.a.R..

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\CURRENT.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):248
                            Entropy (8bit):7.166602308239894
                            Encrypted:false
                            SSDEEP:6:RtULmuSnVJPCVV6SicPo8aC6ztDsY80T/f/9FZtOoRg:jULmuSXaVFwFCRYTT/N3tJRg
                            MD5:3E313F51E7B432B2A96790720A4A833D
                            SHA1:329BF457F03EBD3BC7ECCC1EECA0D1C5DF5630FC
                            SHA-256:F2A22DDA7BDED58E1FD8DD58AA2ACCE33942909478D88A470AC2526F2D665828
                            SHA-512:440ECDB3D775D93F5DF5F347F00D644CA332AEB24D8EDEFF40CCD8EBEF702EA3892E144439CF6EF185AED9732767BC688A67DE01776E7B6FC8768AF62AE1A0CF
                            Malicious:false
                            Preview:.a.@...(..r.@..aD.}...g.@...n..`F....w.@.$y..B@......9K..AM...`h....n..b0...*...\Q.'.?oj...E8/..i...+.....b.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):548
                            Entropy (8bit):7.633942327978306
                            Encrypted:false
                            SSDEEP:12:nv8PKI2PvxhD2KP3qVZI6M2fc59sku+QpTzmckZwgcUwFCRYTT/N3tJRg:82PvxAJVZI6DfYsku+QxQieYTT9TRg
                            MD5:70486CC3E2D5E20B2922E01FDCB46672
                            SHA1:EDEDA9F8511963EF3E4CB0DA64F8FDD45C673840
                            SHA-256:93CAA1AD3F786E7761891D5E876E275E134D777DDC31AD68572847196AB5C3B3
                            SHA-512:DBB8AD8CBC13DB28DF10B4662D1A51E284B5B692EEB467F0689F53AE837638B6503629BDEF1643DDA835DB959CE7AF694F2F7824ED4B123A2BB8FABBEDA4FCE7
                            Malicious:false
                            Preview:j.9U[KCO....'..W[;...0......r....Q.G:.,..}.."B?d..7C...p.3........>4.1.4.:j...=.X.L..*..rn......uWm0.L...!...q.;....m7.RYW..fR.\e.......!.J8......^..<...x.......p4.....U...u.A..p....<.wE+.B><..X.8MH0...hN..I_.2.3..J...{&.TDdc.si"7?A{...^@..E....F.c.+.OS...@2e....|......e.9..j`...B...0...~..u.>.......dnD.}..u .....n..`F....t.@..7.ye.V../.....}e..C.X.\.}....=...t..1..Q.I..!+?6.7......!...+[.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):556
                            Entropy (8bit):7.611181881041911
                            Encrypted:false
                            SSDEEP:12:Dh1TY/f0v9IrRgt/q15b3hJ5GV81Wwc+CgiBVP6xAcwFCRYTT/N3tJRg:tZHIruUfbx3GV8gwHuCBYTT9TRg
                            MD5:C923A95815ED14AB9BCB8449F6C50BDD
                            SHA1:F5D9160F07A7E5DE8FCB2045CB4EC460E2500CFF
                            SHA-256:65F7DA8723C0DA6CDAD617FDBB9F6C5C391BBCA3BBFF2915E80350B28BEF8CC5
                            SHA-512:23F390268579969BEBD470627C066F5AFFD5A3713F1578FB0909723A451F0EB4E71A89E6379D69B3C85D28D26F03B52A760D008686B2E5866C17A02C5F5CBF56
                            Malicious:false
                            Preview:..7........r.......4.G..W..ko6...>(.....v&....iN.F...9.x._%......q..grs<.%..,........VR.\`b.....~A..o.bs...5..@..b..fa.....p.0B.)/.X...o.1.../..-........K^NH._.{..Y....M....5..$.1j.b?n.o%..w........i.....<]XO..2'^@..\2.%....h.....Ig..8..H......OjG.e..C.bx.....t$~..-)...8.\*..x.l.h..H. .....l..nD.}....{.I.Y.,.qF....w.@.'y..A@.`.p..b.._.A."....fV.|...R.2.z+....+.uK9]..TE.X[...>..Y.0....c.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\MANIFEST-000001.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):283
                            Entropy (8bit):7.233165299314051
                            Encrypted:false
                            SSDEEP:6:TvbrJcGjYSpmDsoAVToi4VIcPo8aC6ztDsY80T/f/9FZtOoRg:LbrJcGjYSpmDsoAVTx4VVwFCRYTT/N36
                            MD5:B0D99F9F3EBBA9F476A845E232F52114
                            SHA1:C2A19EBCB19DDEF0D6C543FDE319749FD64038F6
                            SHA-256:F0BE4F3DEEC0BA40C788EFD99B0D3C138F3A13EB7CADD0D4B2CCF82CA1974A9D
                            SHA-512:28F77BFC652EDD7F7CDAD828C33F66B6F8E819D9A830AE8BF8F432D16B317D28170E7EF8DF47981C7001C719CFE773E574972B6A1A4CAA57E8AC140D18A5D678
                            Malicious:false
                            Preview:8b....(fc,.............tK.u.....>>.C.UF.oD.}...R.I.X:..v.....@.$y..B@.`(4.....R .q|.u.v.,....EX<4.A.....B...".n*!........t.u..c...F..S.\..:.l.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\VideoDecodeStats\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):131313
                            Entropy (8bit):7.9985286321643505
                            Encrypted:true
                            SSDEEP:3072:daQ9x54JClwCfKys7Do7DVZSwZKrmUcbMQI6tVeu5L:dfqJk5f9KDaxJZKLkt6+
                            MD5:D057FFE139FA3787480309D08DD76137
                            SHA1:B9A643EB399D2FB9645E9AAC50E919AFF0963644
                            SHA-256:88D5AEAFF2FC6887589C26AEFBF27CFE4686A891C97A9DC35B67E5371D8B3564
                            SHA-512:8D1F2B078E08D30B4DDE1ADACE8C78310C5ACC8E4A815535999642FA86E26F4A71DF1581730FD65C0170B8BF2E1AA997E9A753FB7220C6537E9A66AD5EA28454
                            Malicious:false
                            Preview:..-...hoo.\.e...`..j......#...R..z...BRKH.z&.,..=A./..R-l...B.w_.X7...n6.hzl}>V.:.. .........:gs..".(.k7..r.W.d.KJ.....1.z...j...p./t....H.X...~..[<t.q.B..(.cE..z$p.......<I.|.G..?y..G...K..au..J...e.Xm.9p.v.<....Eog.R..m!;.-\|./....AG...e..`@k..!..%...aO....VD.%.....P..H.A..OIz......|L..;N..............~.1..-c.G..F...x..X.T.F.N.3....[..V..,.A....f.......x..I\.p...j ..v...L.n.2.;.. .....$n...+..g...t.{.._..;.K.@.{.Z...+N.n.b...?u.G.V.X`k..3.G..........-.T.LI..n........Z..-...(..t.Z.cA.G..s./.0.P......-..*@k#J.Z&3.*}.A..us.....F...J=...Y..V.xx.f....,R.eUX....+..c....@..O<.E........0B....CK .).k.S4A.....o.v...W(X^...'@"$o.k....U........H.Mh;]....^...v....DP...n....z..@....!...Z[...G3.t....0.&h.;z..p.O..$....<.WD.....=......<h.Z....i>....{.I.a.KL..s....A.......(..f.b.|Y.@_a.x.#E.O.},!Y..Zr..).~8.,Y|.n..b......*.......=d..J4.{......;.u.\..B8....nh..Y....;g..PsK..0+..x...9Iv.rV..cP...g.j....7.rY...........>.~F...,*.'.=y..Qd.'.4t.]8..SI...

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):287
                            Entropy (8bit):7.304513362191746
                            Encrypted:false
                            SSDEEP:6:UMyI4wMc0BHC6o3LQrVZljiWcPo8aC6ztDsY80T/f/9FZtOoRg:UMyI4ThsejiWcwFCRYTT/N3tJRg
                            MD5:E14F4EBCC0E69B0BD3097167F74F0166
                            SHA1:0B5874793D9DFDF1E47DE6E7BB85FD710C437E2E
                            SHA-256:F8FAC57B2A48827B850E381DDB23572512109F6C34A7039EA4DD83F18C7E883E
                            SHA-512:9A0DED3A91D48C71B2E2798F57E1FE38EC30151F6C61C1E04E63E9E41A86F44E5D7259A934912C929009405F8770F40C84A66EF0B5C5009B86EB6C30FD837DA0
                            Malicious:false
                            Preview:N...W...x...}....~.F.]......D..A.1.:..fR....99W..Jx..E....x.I.Y.,.qF....w.@.'y..A@.`.T]......b......M..6.k.),.|..I.\b.$.3w........W...5Bt....0=.Yc.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\CURRENT.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):248
                            Entropy (8bit):7.184708054190189
                            Encrypted:false
                            SSDEEP:6:OY0qULmaJXDFE9z5lmpcPo8aC6ztDsY80T/f/9FZtOoRg:OY0qULmaJRE9zy2wFCRYTT/N3tJRg
                            MD5:E22FFB954E2C31A53FD4EDA16173E663
                            SHA1:7E549C1D980005E2E15D2AB4B2230BD38D550D21
                            SHA-256:59683A5BC886CEB0EDC5EA2DE2A4753A7B9126D7589D9F8593850B4921427747
                            SHA-512:B50562B92B9DE56DEDF6E5CF087A451FA0A89F40DF790760B8A22646B737077681315663E4D539009C11F8117EE52D0A2F460BE2AF3F1FD94CDF65A0B6337907
                            Malicious:false
                            Preview:..[..<....m..{..aD.}...g.@...n..`F....w.@.$y..B@....R.q..Y.X$.)...Q%.,ui..e.....x.T./d_.K....xl.S).?(..<5..Ceb.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):510
                            Entropy (8bit):7.5768789408605635
                            Encrypted:false
                            SSDEEP:12:7/Q3uOiQHfdl6Hww0QeH6xvfp9WOxJwFCRYTT/N3tJRg:rJQHfSHww0x6xvfDbYTT9TRg
                            MD5:5B9E510F24EE0D2493331F1A61D76DC4
                            SHA1:75B521B9789C944A4F9F5F298F596077428A30D2
                            SHA-256:97BADBC1BF23437F650682B039D2623739EBFB0FA3308E1C433ED8B043562F55
                            SHA-512:F533C89E6A4C7E4FBBB21DD5A7D0BF2F71F2461768EE0ADCF18957C1A30B1DE9A6F23937A4B18ACF650A6B65E8553C646614C0D8DB73E01F5A08F79498362F06
                            Malicious:false
                            Preview:.C.Fe......!.u"zi>.....X.....k.:..wc ....i......eSkp9.x.#u.O........y....B.a..U..kX.<."....:./....e.cS...\..ith...0._o.3uw}E..6I.Q..ZQ#..z.....B....v...O..+y.(.0.5L.R..kq...(.~...%7..T...M3....0........=.W...U..4...G....^.]k.|g..N.....!.U.v.I..5..e.vb\k.!.o...t.6c..S....$.nD.}..u .....n..`F....t.@.../..N..o3O>.?...,....w/..."q..d....t..m1t<....O..C.p.R.B..z...[.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\MANIFEST-000001.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:OpenPGP Public Key
                            Category:dropped
                            Size (bytes):283
                            Entropy (8bit):7.232230096110902
                            Encrypted:false
                            SSDEEP:6:pM319W9svyGjYSpmDjBb050Y4Ux29WcPo8aC6ztDsY80T/f/9FZtOoRg:pM3nvyGjYSpmDW1awFCRYTT/N3tJRg
                            MD5:17DCFC5D0768F8969C73F463A1E24CD4
                            SHA1:B5C14891B43F98D722DB058BBED946944AED8517
                            SHA-256:CAA4633DC53C6E0D985FA535C34B918CDB8AB0BA9910AF1F26F5278FD3157586
                            SHA-512:661762D116194E7886CAE3CCF71181F4CD143E07B99042E114B405D1E229EA7A109CB955EA23E6E048EAA7E4F06117CEE578B6C82CAB053B2621FB65637D1DF0
                            Malicious:false
                            Preview:......{cRS~..EX..1WD.. .......qza..C..%oD.}...R.I.X:..v.....@.$y..B@.`(4.....Rf..C;-..yqw..j6f.....oW..............De[....,%.A..\..8..U.c..l.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):359
                            Entropy (8bit):7.4641593150565475
                            Encrypted:false
                            SSDEEP:6:XEBehZHTddD4MRnwgS9c0CEmOkPgkAhDj1pYcPo8aC6ztDsY80T/f/9FZtOoRg:BVwgSyokG7YcwFCRYTT/N3tJRg
                            MD5:BBBEBFCE3BC39F241F5C14DEDA1A766F
                            SHA1:5AD41430481340A4EF506BCA0E89F71CE77EA843
                            SHA-256:0747A3736D40E8868435B5C42A1FB8F2DC86BC9FEFDB39E82518175A367DC843
                            SHA-512:BC68B32B783B3D098A89DAA023326D07E250D006E64EF3C2D61B9F4DB9252E6DC97280D95449FFE2AF69B537022A347547119A5427B41FABA70A558BC74DD6CA
                            Malicious:false
                            Preview:>..K......,..E.$...k.M.{D.S......b../{..%..\}....N......O.x.2i*..3..s.....r.C.N...e..?>k..a...?...../U..%..i.Y.......\.E....x.I.Y.,.qF....w.@.'y..A@.`..o..z\.k.......0.`....U..L-{.^...#./xf.G..T1.JA.0.Q..d..9c.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\CURRENT.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):248
                            Entropy (8bit):7.161179009982048
                            Encrypted:false
                            SSDEEP:6:NxAgdULmXSrDlYvn6y8IcPo8aC6ztDsY80T/f/9FZtOoRg:NxLULmCly2wFCRYTT/N3tJRg
                            MD5:0A081AEBD9B85D46BF65BDA730171B82
                            SHA1:E945F65884C403F7B46AAF71B8638D6596C2408B
                            SHA-256:34F77F05D903B59CC1A08194207C6E52452D987A7724D4680CA740C877F1B3B1
                            SHA-512:AEF34F365EE1C74A2D62EE89B14282730317880B55B08CBB7320A82FE25278220D0ED1951742B38617D8C0313428E30E5D97C4E406EDAC84D68AF5DFF19B0878
                            Malicious:false
                            Preview:.A.........u.#..aD.}...g.@...n..`F....w.@.$y..B@..z....j.Z...Qi..7.....1\..7....9..".w..mVR.K@].F.I..]?.sj.....b.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):528
                            Entropy (8bit):7.595623109933386
                            Encrypted:false
                            SSDEEP:12:8van/Svq/jVYia5e01W/5p0ehqOEg+GwFCRYTT/N3tJRg:8yiU5Yi2a63EYTT9TRg
                            MD5:33E3F5B3E37DC27BF10C964BD41DF932
                            SHA1:8EDA7C1DBFBE9CE478AF84CB1202D43F106E8D28
                            SHA-256:D605463339BF70084DA1E9BDEA5F2FAF631AC335EDDCD98FDD2A018FD712AA3C
                            SHA-512:EAB0F59B308EFBE102133AEE02743E008837E567F3E3802714D1C60D31C746F790034DBC441B46A6F8F4B8C19EEF16ECCB3392F6523E25E9D39874851D53C1E0
                            Malicious:false
                            Preview:+..D.Et.....<... #A>LG-D...~...$..qc....E......p.....2c.F\W1..C.1.WB....E.=..bxF..:n*.*.+.`....P...].J...4S.6...+. ..u...{#.....P.w...=..!..L.i..G..b..br.../.....W..Dvr....*..?.x...G.oh.Y.TD?h......*R..Fn.W..sSq...#3V....:#.m..)ro..rs....T....)..~.`!.d.?.1.$=<.y.hhu.]l.H....}z.D.n.8nD.}..u .....n..`F....t.@.Z.D'_.#n..b.b...6....;..d.V....{6.0).c...4...]x..TA.1.8.[.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\MANIFEST-000001.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):283
                            Entropy (8bit):7.16387328350332
                            Encrypted:false
                            SSDEEP:6:iXUonP5QLGjYSpmD6J6reqXOjWcPo8aC6ztDsY80T/f/9FZtOoRg:0ZaLGjYSpmD46hXOXwFCRYTT/N3tJRg
                            MD5:1A45B3CE062898BD71A8D371607C1470
                            SHA1:83425A33B71E5F898DE8E8E2EBF9BA8DFA87D447
                            SHA-256:3B263DF0CB9CC942A614E943AF7D1D4579743EAB83372C0DB1CF1113B1506DFD
                            SHA-512:0201B2A23C482CA48A62FDB0F81D6D847074CF6784D8A27C585D508BB82581F6DF05B980CB545B0106B68763C2F20809F9CF88D41201D92CAD115E7D7995623B
                            Malicious:false
                            Preview:.P..r.....|.Ni......!x}{x....o..b.=.....oD.}...R.I.X:..v.....@.$y..B@.`(4.....R......IU.`r...K.kf.[]..j..@...B`...3..m...|.?..d7{}.N."...?.}l.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cookie\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\AcroCef\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\Linguistics\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\Adobe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\LocalLow\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\ARM\Acrobat_23.006.20320\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\ARM\S\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\ARM\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\ARM\{291AA914-A987-4CE9-BD63-0C0A92D435E5}\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\CURRENT.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):248
                            Entropy (8bit):7.163558407021494
                            Encrypted:false
                            SSDEEP:6:fHX3/oULmWT0DMyZSidLZ838g5IcPo8aC6ztDsY80T/f/9FZtOoRg:fnAULmU0DPZHdt8j5VwFCRYTT/N3tJRg
                            MD5:A60E7321AE12CA044CB3ABA142DAE8EB
                            SHA1:47FAD6FD6655035FA98C2DDF8DD5E836A7BE1AB8
                            SHA-256:B927D5B415E2E96232F2F96E07BEDB3A0F9E831DF1B3ED28CFE8328F6F6EBCFA
                            SHA-512:A6FD6283188E74075771ACB474777E9F534FD675025227B933BFC50DA7CCBE841A26411B078FDC72A462D6EF87294D9694979A2F20B7C62759EE04E84326037E
                            Malicious:false
                            Preview:..Z....3j2.kst.aD.}...g.@...n..`F....w.@.$y..B@..X6......A9F........Ez.?x....Yy.+..<..9.lt...r....p.a8p&..K.b.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8422
                            Entropy (8bit):7.9791970607264995
                            Encrypted:false
                            SSDEEP:192:4u2Oe149KeamAXZGOxnRJ0rO+XMcCEv4l:4Me1tYAnx03nv4l
                            MD5:ACC57F910A4CB5802188B9D12ED341BC
                            SHA1:2500DF784491F133A65CDE029C55283DAACEF613
                            SHA-256:75DF57C7F5E91AA176220D5DD1DC7C18A03DB166D8E7B5AD8A2C86AAFDEA77B5
                            SHA-512:EE35362BB14781D485E6368812135D27C834C28F533EBF70F312ED711ECDA29893249550DB8A8A371ED78F4D21A622403D3C3EEDC25BC953F385D21BA1E5081B
                            Malicious:false
                            Preview:....5-.......;...1...O..`..n.s...<.....Ha.j.8..?.8...I.x.3x.=.`..|m..-.D..^..K.....9.&%:..) ....&*.+aP.._Oe.+...D}.~."...e.,R.:..,.E......P..@(D.=z.9..z......Ht....&01......A.....H...J......3.k..^..4J...]w. jV.}~....]cwLO.../.C.AU#G..:....?.....wM,*.......y..p.....L...b,...$.5.LxP].CQP.,l......|C.....z...@;n.l]!".:.%o.0.2.....:m...YAp9].Mzz&R*CdV.....K2/f.@..q.....3Go.3....2<..d........<.>..t..h<."....c;...t ..M _~.<jA...T..#...N..'.."d.O.u....n....*0.m..P....L...=;..7..P...s.pC.w.....o.x....#....<(...j..D.+.....F........m7.b.....^..>.U..w.....&..!..A.Z.....~2..$....s...d.n..]jN... ..q..G}lD...u..j...&$...W?......g'....i5'.@.....N0>.P..m....8...C......M."....4."s."..G..C@.R.l@-).BKz.#...9....3c.....q...c.BB.b@..{Of.R.n7.b.I.(....c...V.E%,....!j9.94.....Q.. '2&.....!.q...L.C5..H..@.a.j.....x^.x. ^...a%...{.w<.#..L..R.4.............Uki.........g.SL.Udk.q..,.\.'..b.DP.;.}t.M,...r..3.K.....4Sr.f....q..2^..m;.ph......J...2..m.. ..{o~...__ q.

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_2.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8422
                            Entropy (8bit):7.977938795485572
                            Encrypted:false
                            SSDEEP:192:AtQAo4OEpEoBlcqKMnOn/put7LPerFMzk:Ao4uulc5kOq7rerF8k
                            MD5:BDC200A03E963AD5C68F73EFE9131C68
                            SHA1:16F8B36899DD9AD9122E92DE56C573E5BECC77AD
                            SHA-256:328EBA8702B75FA3918AC6248C4C911D2F3B0599E584D6D220698F3E6338B328
                            SHA-512:BABE16E75700D957D9272C1C1B4A64CA7A8BC0A33BD6FD3888B884CD8B30EC8AD8592764A8409D7E2CE4FD72B7CBB8AF7489274B4F69D1B57D983B0F71BEA232
                            Malicious:false
                            Preview:..qR..R...7.s.M..\.?...&.`.yZ.p..i.9..>.N.0b..3lDm.!q......}...J+I!........7..A..v..../..^...@$A.u`.W!...$....*'k+Z...............O.."x*%..&....l.vD...<.%...........;!.w....9.y~T.#H...k.R.^[.o.p.)6..WGO.....X.:........i...dw.II.,t8..2N.b.w....T..T.16J...;......{.a....5.E.g.......qLH./....$.u._..?.r....ke..`/%...Xl.2.z6W5.P...o..e.....x.b.G.."b.x.._Z.....1wf...jt..rh..`..=....._.<.{s..Nu.....H2D\.....G+~p..D...,.[....{.F9..NSG0F.Y.*.@'.'.....R.R.E.Ag...c..C.....q.z..B.[.....*...a4.....0wSwRV.}9..t..%.*As..b.w.~.|...J&&..G.X...f..n7.a.D(..G.+Fs.t!.+...B..`^....#.S<..........DZ.p...Y$.......6)=..z.@.N[3...*t.>*..c..!F.b\k.V..S;..V.Q.O.,X.. ~K~s.....5O@%:.@.2...g...D#.>B.?K".Ken:.&..k.....u8F..3$6*(5.m..T...PH:N&...U.X....tmE.7p..z...G.g ...yzh.m.H/...e..PJ...oT.S.d&.H...M'^.c.8&f.7.....:...R..h...d...v....&N.....?.b.V.....S..yA...~W.r.."..:...j.QP........>4..1..;....b......9.....w.F7...N.jsd.z.3,.....2..)......6]A\<X...Yk...~"...

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\data_3.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8422
                            Entropy (8bit):7.979411878338441
                            Encrypted:false
                            SSDEEP:192:oRGRSjJLsXH6K0UHihS6e9pKb7wod99EJ7uVrql/RBvaJE:0GRoRsXHDHmCfWo7+qLBvai
                            MD5:FFE5BC8E64E4C3A1102AD7736CC63D89
                            SHA1:6C308BFB31028899F51A37CE35492C8F2D53B541
                            SHA-256:6C83F565138F2D3ED6307E8DB05E577F5296C79EAB92BB15C15C7D37658EFCC4
                            SHA-512:7FE7A61AD39A3576135D22D1D69D1E4EB1AA9E298ECFA4785DE852CD11EB6F7FEAB8CBD3530F2A87CB55AA903327A8323EBC20254D58420F4C5316888B851156
                            Malicious:false
                            Preview:....W...oFl..TBZN.;....t.. ^..X..}.4h*{57l2..B.^....Q..R.....4 .].u..v....P;Z.5.=@I......*....z~...(..8......L#p....N....k.-C...`...f.....zZ..d.>.S..>wc..>).......r.w2.`..;.......L.z...x..gJ2....*...J<6.a........W..U4...?G36.I-...Qg........LU.....-..|dw..b..b."......}`...)..&Bn..............4..w......... .!J.zv...vV.l..(...y..5.u.....)..{H..#.?_.BE.....z.......VS.u.ym...+J..l...oF.F..r..)J....DI.Ha.9.v.y.B<qpa.74..yUr.|F.k[.{%.~.B0.~n>...LI...*y{.c.....o3.s.!.#.%n.B......eN..H...........[....x..43..w*.B.L...)Y.r6.y..2.._+..?.c.......$.YSF.;.y.A.-.]....>....K"T=xb.aZ.....f.....l"4X.)..... .1.o.....^..Xl.A.CK.X.a.".V-E.q..N.'.#....&.H...MgbX.o.*..=....+.R...)}.5....E....'6ecd>..(..$A.z#i.BP...23..x;;.U.-..Q...57.y.............[.z......=.al.i=....d..j...y"k.....Y.ue...K.]....>/.3.@g.....4..D..rVL2.....+L.~.pfV....t.O%.I.K..c.9|...........l..Q..<...x...W..eYi:JK..gF.(J.a.&eTX..Q..........jhE..Gc....4Vk..a.l..h...."^'.=.$.....Z.G.e.

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\Cache_Data\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Cache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):458
                            Entropy (8bit):7.573006682202986
                            Encrypted:false
                            SSDEEP:12:LB8rlUbyP0uksAnL75fPAvdwFCRYTT/N3tJRg:LBGeh75fYvRYTT9TRg
                            MD5:F41A8951147DEF1E7333E88EA617B97F
                            SHA1:A38073F944D7F325254FE3732FA5C0384EC520A5
                            SHA-256:8BD309EC237600AF023077ADE7BDB387E9156BBE83F42C5B641C1F82260103EE
                            SHA-512:929D6E58190162D949E599FF56956042BE07B9144A596787CFC98A0EFF511D26098941FCEE9A316C11ACBC4F53C9637AD68155D2961972D9D65F2070F7221B7D
                            Malicious:false
                            Preview:..6.w1..#....^........]L2.nM-.i..................%..qu1.KhM.%...?.2...'...|Z.Q.d.kb..?Q...U.~o.y......y.!.r...&..f.7+K$.:J\..t..q&.\...#Uy...Tgm......_!.r...sl.r".=%.l.......C.0.,*..1.3...fu.Wx..i..].,..D.}....-..p.....w......Fn{...B@.`(7.....Q.,g.t. ...Y2%..+.$....G..e/....o.c..S..sD..P....../fPe..=R[.u....s.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:DOS executable (COM, 0x8C-variant)
                            Category:dropped
                            Size (bytes):420
                            Entropy (8bit):7.555592989132104
                            Encrypted:false
                            SSDEEP:12:xpRjfnZHmRbE22Udtg/DQmDM5G8VwFCRYTT/N3tJRg:xpRjZMD2E2Qh5G8JYTT9TRg
                            MD5:CD91B2F59369FF0B6627792964C2CA2E
                            SHA1:09707BFCE0F26C544A6D59E7070E90D453FFA98A
                            SHA-256:26CBF6D2FE89B35C19D8775DF6D4AE9F6FA749124778CE8E57AAA6DBD8D0A6B3
                            SHA-512:58C0AFE56B69D809D2B5483EAFF83B09ED767EDAD9AD9B5DA6A735D0859F148B76FD42AB828533DC1E24D68BB7F88919CCB531A12ADA95C0C82F00C7C759441A
                            Malicious:false
                            Preview:.c....+...*...1.>.R. ..........H..1l....NX@.....i.Bo8B...H..:..W......9...!pk.D..M..q..7.W.Y.....^....9.B3..b..0d..#...7K.,.Q..IGx.....?._......#H....?a..t.e.A.@'.......D.}.....i...]~.p.)...u.@.$y..B@.`(4.....R..Tu...n..&4.2..R....F/%.y....w..X..%..]..{3.9Q\....kF.cP.l.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):498
                            Entropy (8bit):7.591375190409324
                            Encrypted:false
                            SSDEEP:12:meGHNty85E3F+EUean3jRYJoVw8cAuE0QC3m4xHjHwFCRYTT/N3tJRg:8Ty8IMZ3GsZxCQexzYTT9TRg
                            MD5:A728C6BA0D97E8DAB742356F861A1211
                            SHA1:8F6898BB4B561F5D7710E17FAA55EA89BF0A015F
                            SHA-256:0E04B74461580B69AD8D7F0924AD7932A109C76AF8284636E9B1D4405883D34A
                            SHA-512:4FFF359615A92A67C937378FC145E2182FAD27BB7F870BB93A5710E0AA549D0304DE5B8E26DF57480AFA7F035BB864E80213DF152565D99C66F74D443224876F
                            Malicious:false
                            Preview:.#9........3...7.?...]Q.A2....3...S.,#.M..0t.k.2t(>.L4...T..CV.z.@b...._.$.&.'.....-m....-......l.A..h.39f9.l?.......5fLT...P' JPQ....d\....g1a.mFA.P.Qz&...5... ..Y...N[.Z.u>....a..r}...jS..(7..dSPQ.ro...l.X...I.i......@..B.....*.....&.....o*.D.S...F.l...g.rlJ#...O9xAI=.~B`.`(e.....R.,d.t.K|...Q.N.z.....+?=... ...RE...{...I.R..wh...d...6.B*3....=..:.r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):461
                            Entropy (8bit):7.559421416582611
                            Encrypted:false
                            SSDEEP:12:qDaoKC6zx5dDnu73ml6R6AUvYeF8twFCRYTT/N3tJRg:qUI7WhtvYyCYTT9TRg
                            MD5:5FE4B79FC7EB381E88894F20E02E9026
                            SHA1:4F3B8AFB825282D086745EF2906C25F8240984A7
                            SHA-256:D1A9FE06FFB3F01F05A8D02D3E76955441A8CEC11AA6F2844ACAA179B083BF49
                            SHA-512:03D63E9CF7230176349088DE8503B09FF6711D17E2B2A1FBB7450C126277C5651E4EC24EA41897CD12602B425D2890716ECC7050DA7DA0413F0E4FCE65B05A8F
                            Malicious:false
                            Preview:b....C.."9.?.-g.>..h....xF.I....d[..S.....C...=.x.:.3.K...lS.'....&S.....Y.v..8Oz....:..r-0Jr.f...@.r.).H..L.#.y.).E.Il_*...o.J.V.i9..D}v0m*%.Tc.n......m...b......yn5^..ay~.. lo...Q...<nu.5..U}.y.L.*.R.._H.D.}........7.mwH...fmvA.{L.]@.`z7.....R./g.t7.[./p.19.w..3K./p.X"YX......?.......z....f|.W8..p....+H...u.).q.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):467
                            Entropy (8bit):7.561354518293168
                            Encrypted:false
                            SSDEEP:12:Vl8whjs/dAVL7NAGAi9puEhVwFCRYTT/N3tJRg:V3s/KJ7VAibuEhJYTT9TRg
                            MD5:F2B15EE9140815D662883E90846766B0
                            SHA1:CF762023303AB75192E1B5DBFC20634202AD32DC
                            SHA-256:8D392C39031619415A74F2C9CCBEECB094C8FD3CD8E8670A38623FC2209A64C8
                            SHA-512:60BB59064B1F5270D8DF2199E515C994626592BA73EB502F14520B6CFACC48A8F8F466B4EB8BE2BEC2E391DE184754CD345B2B0781A4DD38ADC57C03185DB055
                            Malicious:false
                            Preview:....9..#i(.l;-..[...y..`/q..r..!.\2J....oKuf_....sPE..=.~.Q...~"[_.>..M.\...Yb."^. 5k.\...0...X.e....Bf.f-LP......w.h..j.Z.KP9..../=..+.x.}(V6R|...Q.!..?yJ..6./&M..ZE7.M*.....'...f4....c._...]..R.....e..D.}...!.v..g..u~}....k-A.{..]@.`z7.....R./g.t..../.}..7YE..4u..V..&..).....u.....Y..H;...Fol..7X.=..)..Oyq.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):461
                            Entropy (8bit):7.592766821501747
                            Encrypted:false
                            SSDEEP:12:ALzlI7cIpMLOp6YLc/oLwUoABKS1AHn33JMfeMVwFCRYTT/N3tJRg:ALzlLIKSpLLc/lUoABKBX3m20YTT9TRg
                            MD5:2DE6F54CE9B879445A8DDC1EAA28288C
                            SHA1:5FA5E2250E23E435327B8B449DC1AACEC4EFC435
                            SHA-256:05BCFAAEFE0BB95EEC540C7EE23E59EEEB9DBFDDB63FBAAB198FD4D55A9D993C
                            SHA-512:EC14E0F0FE643953C2E8E213598792FB8E64F449CF1E5805DBBDB564A98CE70C7C694A192EC800A9296E2141C82BD585BFF344271B9352BB8631ED0A6922C77A
                            Malicious:false
                            Preview:..<.2...qZF........D.....?..\......R...h"Tcz.f..TX.p*5G.l.|.B;..YH.6..=`..A...G..H*2..o...?..!'.{......m.A..c.f.Y.C(X..........9u.....nQ...N.....Na.:6.;)@!...:.[a.......~..g.T..k`N.>..{n.v..|...I"..D.}....$..g..`..UK).@.D.#({L.>B`.`(e.....R.,d.t.dy..H..X..f..|.X...w..,|...U..,.FZ....GYr......y...S.p...r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):432
                            Entropy (8bit):7.559959797175299
                            Encrypted:false
                            SSDEEP:12:e5aNHAnLfgMX78R0jUNUN9OQnOVwFCRYTT/N3tJRg:e5IWogKCKy9OQOJYTT9TRg
                            MD5:2A97501F794E17BC30F533DFF7E5A6C6
                            SHA1:72BC2131C74AE6E04F9C02ED241809B309B8C7AA
                            SHA-256:A66B0986B3A10B9858B5FEC6618A64E7E88724088F5A64F855D2E1039877EC68
                            SHA-512:A9C1F64AD1A193AE64F4EDDC788C50746A339A84BD14735408A6DB8F60848A33D3ABC4DCF2F65087434C681DD91FFD89C5A2A675D71D9719DD557006C7508311
                            Malicious:false
                            Preview:....A....X.....I.5...U.q.'.<7G7...#H ....x._j.=..../.......c..+l.J.N......m.2....1..c..4%.<............K.-.b!........P.JD.o.Q.-.4...S...*...w.@W2......_..b*z....)+~......D.}..Y."....*JCX.~d..~.UA.I...@.`(7.....Q.,g.t. ...E...Mu.n.[`..]e.V.S..E-.Dx*L)[..F.w]1....;u.//..+..o{^...s.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):431
                            Entropy (8bit):7.508436613585593
                            Encrypted:false
                            SSDEEP:12:hgWGd/lcKo9Lulj8NHxWguwMeTrwgbjhwFCRYTT/N3tJRg:hLGFXkLuGx5/MYrwgNYTT9TRg
                            MD5:F835873F603F864250B13D12AF949701
                            SHA1:80E5BE4993B3C8A6C885233A7CD29246A73DCD72
                            SHA-256:778A8682AD726F453704AE62572CAECA1C19DF179EF6A598CD42132545583A9A
                            SHA-512:F5B9563C1CEC0D878CB950693D4BAAB587BFCE407AF90A0AE50B995913B876D4AD6B4AE23A676236B48BB48A4318103FECF451B13842BEDBE2A00ABD14FA7CF2
                            Malicious:false
                            Preview:E..."0.F\yW.....%..W...3.8..&"g#.;..yj...|..q./M..L...<.........h5...np.(.......C.......^..U.!.U..]P../4.....e.T...D.......IzN.*...;.2.W....Kb..<...?..Dw.7...."..}..P..D.}...-.X..Y2.{".B..xsnG...@..B(7......R.,g.w. .=7....R.V.~..P.Ge....m...!.Z...V.ve.5....J..!m!-...W.!.=....)t.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4ca3cb58378aaa3f_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):462
                            Entropy (8bit):7.561345994204299
                            Encrypted:false
                            SSDEEP:12:D7eLkpCHdQfIjdNJwqKi6pFwFCRYTT/N3tJRg:fR8U/qK33YTT9TRg
                            MD5:61B045AFE653B4AB2E91C05EFFCEA354
                            SHA1:3168BAA13EC1D3D2A11A00F0C5D112B995C5ADD6
                            SHA-256:4CEA767F465BEDC3E3FB9154D1850EC484B5FA8D052E5DDA07B14F4558FFAF97
                            SHA-512:C2CFD2B4EF0FC87F605BD63A48D042F34FF70E3BB99C510CB844F5D010E7442C3BCB306C86A22C1E7D594970C8804BADA839A25C9F7C2761C84ABA3D5574BCF9
                            Malicious:false
                            Preview:.w...U4...._....t....}....x.,Inm.1N......B.gN;.......?..I.j...I5.".. Vr.......i.J...KU.......lC...*c~..c.M........._....~....+..p....-..6.>E......9]..R.g..Y5.(].mb.....b...{g....-......M...-I..x.....t...D.}.....l...{.im'.7..W...{L.]@.`z7.....R./g.t/..P......B....5..},...j......U.Z3...]C..CD.}..2i..w..3......q.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):438
                            Entropy (8bit):7.406724070173213
                            Encrypted:false
                            SSDEEP:12:YRYjWYeS7IbhHuXwgAGQwFCRYTT/N3tJRg:YujIwggAGiYTT9TRg
                            MD5:5434337221745BDAFD049BF2AC4E7989
                            SHA1:9ACDAE32DFD5868A6BB4ADB744FD0C7A6191FDF2
                            SHA-256:4B27EC814D1ED608B57BBC1D85EBB52A7BCF1253A21B887824A92B5D00135859
                            SHA-512:7B5B30CB6199AF7C6D8C69BE12EFEF5334E413C83A1F25013714F2DF4D7C3DC6A310DD47CC82C9662207673DAE3EE0628F536F1D9A85043A31F4FD69E58C7ACD
                            Malicious:false
                            Preview:....n..i'o....`.=Z...=y..@..N..1Wl......}......=........3......_...2#C-....o.....p...g..Ml.M.P..zWa....3..].,..C.%..j....0....K.D..P.1.2.`sHQ..g...)..7P$.........\.tR...2..%. 7{...:.D.}...-.I.X...C3....lIA1...]@.`z7.....R./g.tE..S:....Q.F....b..g.dd.......E..H ...H,.poez.y...P....q{.n..q.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):497
                            Entropy (8bit):7.610847240127632
                            Encrypted:false
                            SSDEEP:12:9ms5x8akBXHxG5rQrbREWvDwGwFCRYTT/N3tJRg:9mszNkBBGmrb2WnYTT9TRg
                            MD5:9DEE9B8A94BA04AAA17B01BA69C4967F
                            SHA1:41816A4C7B5A4AAF3D9B1A336B30BC5E15DE2789
                            SHA-256:20B8858FA6E21A791DA2BC271F4A3AF59F53ADC24ECD73358E5ED783B98014FE
                            SHA-512:7EAD6D014C0CCD20AE41CD9F406315DC0DE4AD0E4BDC50E7A898D86DED6973525C76764B5225618ECFE892F4BEDAE0864AE512E38EB9A4D16B548EEB0CE3883B
                            Malicious:false
                            Preview:.R.n......f...Ct...t<.;.%.~."!c........N.E.....\......K>_.7c.}......Y !.;.~..u..Dr...#.....iS.v..a;..x..`/.P....../..: K.wmS.>.qA\p.\.......o....1.m...z.....maaw.3......?8w...Y..x..=..,....1.g:..n.@E O....."...D..@.v....5..~$-..*l.D.}.....j...`..UD...Vj.A.IO.@@.`(7.....Q.,g.t. .A.(....i.........i.c.g.j..^R..|.r......L.......".h.B.-S.s.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):463
                            Entropy (8bit):7.542331540219678
                            Encrypted:false
                            SSDEEP:12:pIhVtcOtPn7pruZOUmTnu6pAA1WFVDwFCRYTT/N3tJRg:OVtcOtPUZOUmTnoAILYTT9TRg
                            MD5:AF5EAF7E5AB43ACEF21FF99BCCD63EB8
                            SHA1:6D5F9A724D26037C1095C7FC40947AA12F022C48
                            SHA-256:9058ADD73FB21FC8FE45EA062014C05608CE811D5EDB467FCC471AB73C68BC15
                            SHA-512:985340C5E41F919A26DD30C14BE96B44F9176C6BA11E2CC0DB82FAF8C72253D0B9AEB37485A5DE32F0F5299F0B607CF6330B6E4CE5EEFAF7AC517E66318DD0C8
                            Malicious:false
                            Preview:..DL..l.*.R...V...RU.Q.........0`....z.B.4.y.;......e.&..y.n.. ...9...eg.d.....~~..4..=...Y...h..a9.M?..._C...G.....ynP$5...w(..'.,......Va...QP...c.... .Ml..i...>s.Y.;...l...Kg..a^..yG..?j:l..j.{.}.SK.G.D.}..Y.p.......#....E.q.{PT.B`.`(e.....R.,d.t..].4"oC.._[+.O>?.B.R.|...$Ee.....'a......Nq^..{R.B...P."Pir.{...r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):455
                            Entropy (8bit):7.5364313075862635
                            Encrypted:false
                            SSDEEP:12:OINgysuNAl4HbZ9ZfWynwFCRYTT/N3tJRg:OIpO4HlfeyHYTT9TRg
                            MD5:987006A42104FE9C086D869E9347C9E6
                            SHA1:1BBEE4176FB523F7EA5101EA3C8042E860AAFDD1
                            SHA-256:CF4EB390CCCC70106A64AD250E508987318F611BD442FE5CE342086200ADEECD
                            SHA-512:CF6FE915522B9C495C7AEFA3A3BE24BC466968BE48D8D3A54438DE654C3DD581B344265C7BA29B446CFE19228960DFB78A110F07DD7E59BCB146776470AD11B4
                            Malicious:false
                            Preview:.u...b..y.+}..N.a..i....8}28.C............i.....2.x....[C@..._...&..Q'...z..\.......'.~..(cp.V..p-.{L..z...w.....5...p.&..$Z.;......8.n....9.'..0./r.~....c.YS.d..=.....2.4O<..Y.y..=c...j..9.H..k...D.}....w..I.X...x.....i.{.&..@@.`(7.....Q.,g.t. s<..l.P6....f.....A.n....F..=g_......R...C..b.U..U..2..'A.s.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):461
                            Entropy (8bit):7.570037149748732
                            Encrypted:false
                            SSDEEP:12:T7X1LMkIvX0TEsJ4fXT/VkknwFCRYTT/N3tJRg:3FwPsRU/VrHYTT9TRg
                            MD5:44BE3B48B7499B8A267F39B688A32AE4
                            SHA1:03F61A5A17BB5B0ACE673C8A4D459D2B533608C6
                            SHA-256:285D0CCA705CCC8507409BBB07CAD29F2C16E3F9C14DF34BC39082D0E44B6246
                            SHA-512:3A6F7708AB5145E08221640B191A274D2F1AF75BE1BE6186D07D67E80B9446732F689E9D533AF6225454E224C19988552E55D938CA43AE7223B00E448F48A17A
                            Malicious:false
                            Preview:........U...,..b..9..F.H...JS.>...C..=...f.R+z.c ....PZ..-..sW.y..6/..l.Y..s_..*Z....l..Z.....1..P@.&.)9&.jx.x....%".Cm....ZA.X.y.E...];.hZU.{.7..........!..@.)...m.a-.z...p.....a.. r<..d....t......%.mW...D.}...v.....kJziR,....W0..{..B@.2(7.....R.,g.....XDz...2.....U......t>.W.....2.;.L...5.{......eg.=.Q.V...$.p.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\72d9f526d2e2e7c8_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):478
                            Entropy (8bit):7.534666215321269
                            Encrypted:false
                            SSDEEP:12:ijpxCauxzKoG/WgQMNN1FGAiUqJhwFCRYTT/N3tJRg:ij7CaozKfWgQ+PXiU2tYTT9TRg
                            MD5:20FA5B623F11D15F6436646513B80922
                            SHA1:45C26490B81C5C32B42AC11AE51E6CF83E299778
                            SHA-256:8A5B05A333A6DA469E09213A751DB7CB58A62BAE597032749A6BB9A8378DA9F0
                            SHA-512:08C84F6527F53C89E0877C4A3CAC9F7DFFEC53A82E3B5FDB18DC71870CCF5C56AAF3C890497807C7F47933D4F174C5E7F0EAA85560E99D0982F725200D2F7E78
                            Malicious:false
                            Preview:..B..j.%.u..{^........3.q^...3...b....u.VtN.I...Td...10_..U.......#E6.%....Zo...V...~...Y....q6.`b*..&.sC|..j.Dl{.Y..V ...W..j..6...K.0...[...*...Uri.'.J.........CF.....n...I.Z... .#".....K....$X7$.x_.Hm..u:.,...r.I....Gez.=..m.D.}....r..d.w...B|...O....t.~B`.`(e.....R.,d.t..t...z.2._n}.....Y.o..{...4.n."N..X7.Q1.W.DG..,.K....f..[|.g.r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\78bff3512887b83d_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):465
                            Entropy (8bit):7.542691847050873
                            Encrypted:false
                            SSDEEP:12:2wXGO1nfIF9JbqihnPrqOpGA6Ch24UGcTpwFCRYTT/N3tJRg:2wXGORItxVWO96MhUGcRYTT9TRg
                            MD5:E317C0B75E84B06B4966B5C03F9D71E3
                            SHA1:38215EF8DB2B0369FE3522E6468E5932D252A41D
                            SHA-256:94EDED7DDE8E0120A9903FFBA32B6553DA65A541B2B8283788C9C608D67D3262
                            SHA-512:6636203CE868E9F94535192FCAB38180F78A847EF3C246FADF743983C15BF273A1DC105802019094B8F0D5861E17294C8DEC55C7375E30A5128C039E16101A99
                            Malicious:false
                            Preview:.....L.&.y.rW.....Cr..'.u..W....W.........y3...M.--...t.0h.P..71..............L?..U4..>.'....y.tM.d.:.8y.......2.#..Fn*. ..q....n."0w-#E..@kS!..}$r..O.....!.g$.....m....A...U....D.O.8.;.qB.P#p.'.t;[.....).D.}....=...c...B,....l0ATIT.B`.`(e.....R.,d.t..G..Q.#N..0.....;=...$x^:.V.].y..DB.Q.0eo.z...h)(B0~...V..Nr.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):457
                            Entropy (8bit):7.525387864003532
                            Encrypted:false
                            SSDEEP:12:3NBuwv6YjIbPWwemvJwwFCRYTT/N3tJRg:3zvqWwjCYTT9TRg
                            MD5:5CC808E010D74828D2B1940ECF252D0D
                            SHA1:91CFD62D21A133D8F577F4B0C0C52D01FCAF0CAA
                            SHA-256:8718495F8681523ECC2E955DB6D892FAC03BB3AE9E850445390509988E8D0EFF
                            SHA-512:5BA22185988313E6EA708A928AD146C2C51F4BB306A12BE2AB8FDC85B73C90775B86C6B1191A02D49547CDB3FE8D0563C497B5B6036232FD490D1D18813A03ED
                            Malicious:false
                            Preview:. ..gDs.;$Ml.>..4g..H...i.L...._.......0.I.d.qM.._AL.t.9/;^6......grL...uX.zC.i..?...%....0....i-.a.u.v......./...m`.....9./bu..GN.4....|.e.(.h..-X.K...nzy.O...3............D...4.....6T.q.J@.*.K.U....D.}..Y.$...Y..Xu9...V8..){..]@.`z7.....R./g.t..+b..'.2(L.u..1...RpxM..?.._..\i|.yMwC..7d...]..Il 84=.q.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):466
                            Entropy (8bit):7.563205520347255
                            Encrypted:false
                            SSDEEP:12:otIcXIR7SJ6HYtFVd0nkbaeB93GwFCRYTT/N3tJRg:yXIR7HYJdJbaeBiYTT9TRg
                            MD5:E2690B0ADBDA384C8C8716601ADD1D04
                            SHA1:DC773F7B4088838018A860BD66D9CBAB2BC543A5
                            SHA-256:92D0BC803BF81534071361821097A6A8A05CE5FAF7C4406ACF6F73D356AD2671
                            SHA-512:7E9CDC1AD262B601AEE68B4B45DBF01602D290E4D1A3793746603B76808646386B687980730065DB3B828C31269E1C2BAF0BF881D4DE40F3218E10577ED26B10
                            Malicious:false
                            Preview:s._./..K.G......A6.2w.B_..x...9.....n.s.Q.m...g.b.kW.|.L..;m].!xT.VS.7S..G..x3..W.G.5........Cw.....t8I<o^.[......a*..L.4.T.h.;.+"...06...!@z..@..P',c ..Mh.....|...N.D./E....'.B...W._n..p...8.?.^...h....h\..-..D.}....-.....k........(.B.$e..B..`(7.....R.,..`........B...5..m.m.^.GB."w,.+.3..L..43^....Sz....M..j~C. Fn.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):481
                            Entropy (8bit):7.562480521693062
                            Encrypted:false
                            SSDEEP:12:raUBLp6JNUCpVv3Fyq7AC14/0ChwFCRYTT/N3tJRg:eVVt7AC14/ZYTT9TRg
                            MD5:7D4ED5F303ECC748633129538924729E
                            SHA1:2C9CE113E54835174986617F8308716F60297406
                            SHA-256:3452F9469268D7E6EB85E4C7E17F74B9895AC904A8ED0859BB051FAC4CF90500
                            SHA-512:FC38BD4A5185D8E9C66B50972CCA4BD73B4C08E317AA4BDDBF95A9C6EC78EC3896C174CD21596859095F4B52791FAC6B2B527D95D29405D58166B18E85A60527
                            Malicious:false
                            Preview:.....*5.~t.R4......-.<.k.}...yH..[..?K..w..m{<..Pt~.{..L...N.z..2x....RT.4......Nk.z'.v.....\...n..=%..."..H.u.cZ.g../....9...QF...W.V...d|......s..`f..#...8%/<.@....?P..L.7.......J.Y...ieeB..%...l....X^.....H....g..Z+hc.#j.D.|1!.>p......#.t$2._.O.p<{...]@.`z7.....R./g.tx...}......i..&.C....B..R..e..*(...?G...57..+.e..{<.....s.ZhDq.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):438
                            Entropy (8bit):7.493592489011929
                            Encrypted:false
                            SSDEEP:12:G9YlaAD74zwUM5bp45ngP91bGAGkYbFXtNqvcVwFCRYTT/N3tJRg:2zwn5buy9NXGDhnqvkYTT9TRg
                            MD5:28844AE0B3F3CE3872001DDE6B5BEEB2
                            SHA1:5FAF9AC3B1ED07F13E41019DF8D9A36E3DDCE53C
                            SHA-256:BDAB2E6B8906A39D51B338681291B865A3CCC619A1973578AA4C8500E39EA4CA
                            SHA-512:5CAA112A77AED3763E0983935E24186FA906132BFC84B3EDBA7A0042DD9051F1BD4323934A3B77920089C77B4332D12BF64623AAB0D5BFA0B6BFE2E7F3644F18
                            Malicious:false
                            Preview:G....{&...wI5../F..I'. ....r ..3..Q-.P=-..+..........$...|H.Rtj...Z`l7.,..W...{...u...VG,,...H..L}.......H[...V.........p.t........(.....0..sjl.G...+....!1<....VV..!..5.BT...v$....I.D.}....#...y...u..G.G-v>{h.>B`.`(e.....R.,d.t....fv....kG......V.._Y/`....)......v6..u...{. x5).._.[q.4&3..r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):460
                            Entropy (8bit):7.572791533613735
                            Encrypted:false
                            SSDEEP:12:dG1EgaI78RgH4bMf2NfICQcJrXo0J9rqZwiTwFCRYTT/N3tJRg:dGOqARHDHsAESibYTT9TRg
                            MD5:B006B4FD8F9DEE7CA08E170B9BF98510
                            SHA1:B2E7D1288493764D8CE1929991BA31C958EF650F
                            SHA-256:99B9B3DFE78533999DF4C830ABB6661D3F7868A0A89A95CAA2E383CA58722922
                            SHA-512:34DF762254DDED985CD8C840ED18DB47802ABFC90A0A3C6C1005CBA92F5E3020E7438FB27907C04E20620823952D6F2936F6F743C0994BF091A98CF2F4367965
                            Malicious:false
                            Preview:,...o....5G{ar...l..+..j...a?.,...;.&....PQg.X...<u...M..34...+|..mm-.BCZ..ZS=..$..#..v.+.....)..1.x&..:.....Vb.U.d'.._.du(.[J.i.ew.....0|...1......`i...43.4......B..^.?)0_...u..e...........q..b...`,..D.}....>...k.CX.(J.yiN+)&.N@@.`(7.....Q.,g.t. ..A>..&...=....&.8.<.$L..#...,7B..x.N.uW.n[.,{J.....=..2=ss.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):463
                            Entropy (8bit):7.5700457203189595
                            Encrypted:false
                            SSDEEP:12:2u3oNRyLzIB+ZaBVPbBkDiALAQnwFCRYTT/N3tJRg:j3KSk1DKiOAmYTT9TRg
                            MD5:E63F75562D4517E6062D796E739F26F0
                            SHA1:04F14DFD08AB7D46B1BC9832CFB1015102234C52
                            SHA-256:6442A6F3A29B3495EED9915C841E7F428BC3B11A676C1A61B399BA7C0B10789F
                            SHA-512:2E8469AA3A7C83D13515ED7787CDE04602C4EB5DC96D26E48943EDD878667DD07E262FB1E6034F8F9344116744896CCAAE6962A3E150E435622CF19046C10712
                            Malicious:false
                            Preview:.8 ...O.m}......(%R.........!}H....(.V.^...k7.j.u........i..L.O.. ...8<....._.5|.zX...ZP.%... ....A`a'S....Z.,....>(.q+..}.."...A..9...-.L...U......0.S).....?y...94,c...l...h..".5..n.K.....>.e<!eu.*.D.}...%..Hn.X2.yu:.....u&{A..@@.`(7.....Q.,g.t. .n..T...n.Uz..:...Y.$.S\\.$"G........S6i..+.\.&.&....J.^s.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):475
                            Entropy (8bit):7.530332809675974
                            Encrypted:false
                            SSDEEP:12:89t0AchiQFO+GLOs3sLHZdVvXGAyTdy6ywFCRYTT/N3tJRg:c09kWGULbVvyTdIYTT9TRg
                            MD5:632338755B642BD1E81652F99EBD83F3
                            SHA1:7885EF5E7DCADFA261551B2A82FAB9C761EDA355
                            SHA-256:3CB3A4099C35BE9EAB660CDDEBC1C524D8CD7E0DE6FA495832F48B32538F50D1
                            SHA-512:46FF78AFA7FFFFA1A71B4DD9BF7469E5643D6F1F0CA809443E08E192A949DDDE22CC6FDD13638B9AFABBD23A325F56262DA7BDE353A4301300188A4A806A56B7
                            Malicious:false
                            Preview:H......=...Mm.~......R.#q..h...~.r0...~..p......@.<..a.....L.M......m*..UYM.7 .EH<4..2... .%c..B[..lm^B.....T...b!/V.q.......h...Lw.C3.j.Z..o...V.f.:r....7\.../ !....|7..X./.... !.K.-....b.uX..e6p.Y.....c..ig_.,Q..~)...D.}....".I.ew..@6/....0ATIT.B`.`(e.....R.,d.t..T.OB.fH...J....4...Z.....OD.B.8K..m..........ET5....'...Ii.K.r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):464
                            Entropy (8bit):7.572563722970288
                            Encrypted:false
                            SSDEEP:12:XaKN8haot1j5CcN4r0Y2YYZpcf0BcATTwFCRYTT/N3tJRg:XBNwaRrudiJAnYTT9TRg
                            MD5:F64503BEC0C5B4F2FD0F226BA934F1D1
                            SHA1:07A060C64B3942DCC3DB749DD5EA01EAA17B62E9
                            SHA-256:78237533F6386300DEDD472F8EC5B91D7445A17B6C2348BE8BF1DC95954DB539
                            SHA-512:6B758B3A313B250213AA053AF400A01136A83344CD376C99EDA6086DFCE3F9F28B577DCC990A8F8325440CF76856F6980700C8FDB015E9A134924C8681B2F690
                            Malicious:false
                            Preview:....."....;.u.......\....S.H.%..iz.l.F.J^.i<.U...X....h...i.xMN...g....'y4c).9.Oc...;..............R...Q..f..?]v..E....7.l.....'Y].Sb2...6.P...!/.f.~.q.$B.E...>_6......x....s=......-&qH..../....xbE..?.....D.}.....=...... ..}........O..]@.`z7.....R./g.t....o...-:{D.!M....g...*.VU1..%.. ..afr.c..5..?.h.o3.x.mr?...q.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):460
                            Entropy (8bit):7.54942040016005
                            Encrypted:false
                            SSDEEP:12:kntjFzWQ6I06yYjFycPAVyiXDVwFCRYTT/N3tJRg:4B56F/234AQVYTT9TRg
                            MD5:24C4A9BC8073C1DCC5822D473286F102
                            SHA1:32AC078EBAB395D0033536648CC21B4A039BDE43
                            SHA-256:8D395E6107AB0CA70F70257CF271BACCC3CEBE4FE700F458D8E8B2B6A784B0CE
                            SHA-512:DF8BBA4DF932573795BDCD0686C05A2824AC9EB9B5AC8C844578084AF44B5E5A944A4FD26CFFB099E715B5F7BDAF691A8CC866BE1BFBBC8BD05DA1AA15D91BF6
                            Malicious:false
                            Preview:.o.....(..UPZ.&.c.]Y6.e..j.{@2`A......,....5.*=x..]'..j.m..9+...Y..[.M.W#.o.....~..j.X.i.....g!...K.S.p.+o8-\.5..Q.$..%....Q........K.uG..+S...+=.$A..i\1l."..2K7.aF..n....P...........#3.z.?......\.X2...D.}...#.d..c...S"..VA......>B`.`(e.....R.,d.t.V...1!?`....@..r.}`&.1z=..;.... !.4.~.+.?g.d.<|#fU....G....gr.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):440
                            Entropy (8bit):7.451047699005296
                            Encrypted:false
                            SSDEEP:12:/ZgW/PBhIxjeK2LlXS3+upeVASqz5VwFCRYTT/N3tJRg:qFeK2LBuFbSA5JYTT9TRg
                            MD5:24B80009AED2120E956C4A64F5683E95
                            SHA1:8D41BD0379DF5E6D1347B493F3BAC946B4433A26
                            SHA-256:6208AD53162C9110380108841C5D1361987E227CEF5E6EC2629BD1DB2F94BA50
                            SHA-512:EF104EA2E22ED6441A9C2BAA0B6658FA2225F9688D6BD612A01DB6A9324F6C64C1A35DF918BA1002A013BC1D4287055F4C44A2D52D59276D4AC3D34B94380A4E
                            Malicious:false
                            Preview:|...w.g.0..od./S)..ZJ...4.#+.....,6:-..'.A(.v...S.Z= =.\8Q,....X ..Q..$.:..(r....m...E5.3..x1.`.02.}=...vR. w%n...R.4..x...vv...=5_u.Y*.%.w..S[...6....n_.h 3.6EC:......U.1W.4..U,...CD.|1!.>#.....2.y#..o._iv?{d.>B`.`(e.....R.,d.t....F..\H...e...H.|&(w...\.....K.....?..We3V.t........c...r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:OpenPGP Secret Key
                            Category:dropped
                            Size (bytes):469
                            Entropy (8bit):7.562201557266078
                            Encrypted:false
                            SSDEEP:12:g6dmEoX7xM6aa/YFns7aNyeTPTP7QmwFCRYTT/N3tJRg:nmZXLrIs7axTP0kYTT9TRg
                            MD5:4C1A168EAEBDA414E5EE3200311E99E0
                            SHA1:4956F5A422918A6FE07CB015244F7EEDA8F902C7
                            SHA-256:BB10A271F87C57E68AEA7DFF880388C573EF2D3EBDF45F37151C3107C31E9FE0
                            SHA-512:5F4C60F7797BFC510E02BB4999A1B68DB652820A9672CAF7B7F0A6C5C3BA9D7ABBFFFFB198D0CA154F8610EE04D60CAB7B3E6B15110D406F4A1271E0E640CC15
                            Malicious:false
                            Preview:...n.A2.4.m.+j2n7)......p......6.../].....1.......w.......1UC*........L..$W\.T.L&..]..~4)..*.J..$).. \..5b.MY..........y.6..Z.`.....}.4..t...Sy=....Yj3.O.....wZi.....u..,,...T.H..zX.4..tuk*.`...k[.Xz:..(..[N.T.@D.}.....k..yV.t.....9d'.&...B]`.7......R./g.t. ..P..QZ.I8...G..|.^f...w.....B..Z.L.......K.[..r.....D..?i1..u.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):464
                            Entropy (8bit):7.462093074336273
                            Encrypted:false
                            SSDEEP:12:Q3Iy+kku3I2JS4RHxRkoP9fikTewFCRYTT/N3tJRg:iIy+kku3ng4hbk+ifYTT9TRg
                            MD5:AA8823461716BDFE53A3D49DABB2C1DC
                            SHA1:A180A9E8CB01B147091BDC00C326AA00AED9D738
                            SHA-256:B8CBF476CB262CCB1FC8100F919EE8FBE9B7D727AD2D6BD1B61FB9E56BB8B06B
                            SHA-512:A0393F2B4F24B9A089CF6BCD640E70A7BAF351263EAE01FC4FD8629078905027DD6D5B8925A891D8251C5BD1EED1E2FD7C70575E64C4C02E9E3AE40C4D1B58D2
                            Malicious:false
                            Preview:`?..-..g]Q......jq(.b.W.Nx.b..0...Q2...o.5`.v..!.N..0Nz.M...W...=..u>?..7.R..Q8=.....^..<.V_.q....|.A0.$gr"x..0..x......]'{......'`..H.......0.@*...N/.........5I....CQ...<.".m._....HI.M..Z;.<<..?W..}yK2.,@E,..5.>-....yX.._,....0t&{A..@@.`(7.....Q.,g.t. .<.q.I.K;).Ng...\q........;v..I..........u.Y..T._o.}.M.+.{/..Es.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf8eae3dcaf681ca_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):460
                            Entropy (8bit):7.486137110760294
                            Encrypted:false
                            SSDEEP:12:YkYo/+LnKj8DN6/NFoKJqQXaKAX6iPwFCRYTT/N3tJRg:JYFLnKjSN6voK1qrX6iPYTT9TRg
                            MD5:754AEFC2B7862EBFCB9D8F2587942DEE
                            SHA1:FF23B878D00DDF68EF84A4756C6155C469E9C2E9
                            SHA-256:32C00432380ECD0FA9D3C8613207246B45C647F48F4F312C2E9951168CE67E75
                            SHA-512:5D662DB1276170DA3AFEF9DFF439256F5B6EC0F53A7D7813611859CC8EBC4A320A4EB2A1C9AFC45AF472A7ED96D91FA7581B6DFFA2F1FE19430C9345E5DD31D8
                            Malicious:false
                            Preview:..j..uQ@...P...5.H^..g}O.X.Q..X.5...+..;O..z7.u.~.W.7,...v..n....%...^.&...L...^\........-o..)C.*.A..<.E0.tG,j...XQ81..T...xf&._K.%-...>...-3.....]Z..^.r..}3/.]}x...#....\WZW............r.c..F..c.l....~.`.@D.}...u....cM..b-..{W...{L.]@.`z7.....R./g.t......l.".C......7S...'.,3+T...QV..B.z8C..........J8c.gc.q.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):457
                            Entropy (8bit):7.573075739241283
                            Encrypted:false
                            SSDEEP:12:VkNuZgEz7Gl0qCUfjlHFiKRImMUucwFCRYTT/N3tJRg:quG0K7lHFzRI4YTT9TRg
                            MD5:34A46454CE0C15CB44FDD3FE45F3123A
                            SHA1:D0789E6AB18C8052D9CDA06726FFA1ECD979DE0A
                            SHA-256:BAE41E71A1D3AA5123747FD084DB64CEE39B05B80F1A44954A51E94D9AEFF9A5
                            SHA-512:F480527CF12AEB92BD2E407284BD5FA4240E1E8602A3AEC0D0F2AF12C15F04C0284FAAEE6B5DA909D82BBC38DE90E2F1AC804B173FD85960BB17089CCE4DFF76
                            Malicious:false
                            Preview:.&..inLW.J..2<...X^.nZ..2o.1g<Q:...l..._....wD...(_.......`&.c..6cq._..{>S....j!.N....sr>....W..p.].&s).....Z.....t..i`!g...$.Ie.=.*.;.....0-.3...&.P../.....$....q.... .F.,(w.P.6)I..}..?t...r.]`<R...4..AD.}....:.......g,...nW.7&y..B@.`(7.....Q.,go..K.(.....t.........}8.$.".M.........ih.Z^T..X...2U.&....B,Bo.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d5dedf551f4d1592_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):460
                            Entropy (8bit):7.56718974666278
                            Encrypted:false
                            SSDEEP:12:Gp7B5I9OPzz6QkIiGYoMlcRDQOXYePYLZcwFCRYTT/N3tJRg:m7U6SQBiGYXlcRDQGPUEYTT9TRg
                            MD5:15CBC76B0C3E547C359AE76E356B56FE
                            SHA1:D7D1B6D95948BC6CCCA3400CA4691CA3DA69907D
                            SHA-256:8F2DF86EAA89455C4C34D8C3139509D56F04FC2E68803F01BE692F682B8FFC87
                            SHA-512:6D2A96140F53C3F8E9B4E7A563A19B522EDCC5492954C6D34A067D068B13E1319BE79343E02CE6767AA194681B120B33EFEDC797A6083CAC6AD44574D11FE2F1
                            Malicious:false
                            Preview:.A...U.o.P.......".RC_..|-...-Rf/`.M.9..+...........Zl......u..x.C.()t.^VO..eyDk...m.Q..R6...%....N..s3t^CR..&.4...Z...&Q.G.t.u.0...w...m......S.....%./...p..{....y...O...2_q.p[z.GKZ...E.G.>+..Lb....U%.FD.|<!..r....Z3Rs..._..8...y..B@.`(7.....Q.,gF..Z<.R...nX....".h....#.Y...J.4.n..1.O.j=...}.'..y..k~.@>o.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):455
                            Entropy (8bit):7.486124303462938
                            Encrypted:false
                            SSDEEP:12:pNLLNc6IVHiA4IelzOBntUG26aOSMcwFCRYTT/N3tJRg:TLe6IVCATWzunt0Y7mYTT9TRg
                            MD5:5A1B226961282B5908330347C9649FC7
                            SHA1:375A6E997EE21AEED63FB240ECA10A9D52CBD8AE
                            SHA-256:807C35663CCE5B5CE2179CA76B5BEFC061179B607CFF31343E565EC481431F30
                            SHA-512:437ABDA037A077F6ABAB03048DB107CCB6A02A45DEAF2335DCFB72CBB47934CB66CAA9676ED126D7E65B8065459EF1D145FEEB6A2E0B5C64DD67A52EF0390434
                            Malicious:false
                            Preview:..ub....J.).\V.A..Ys.'.I..jc..A.3.O.*';..:.z.l../......F...6..l..... }.V..j...a.|'J..yr.3M....r-.......:.].;B.5....3.....,..!..V..`X...j.d...hb...F.....}u.$@......l9...W...>..i.:.....j.^.;...U...5.e.?..3.DD.}..Y.".....V'.O.(....IB.?y...@.`(7.....R.......i.=.\1..^aG.e...... n....*.4..b..@.y....._.`?.{......fm.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:OpenPGP Secret Key
                            Category:dropped
                            Size (bytes):476
                            Entropy (8bit):7.5497943612531335
                            Encrypted:false
                            SSDEEP:12:h6zsKloeJWVjqm/i7Ks2A72dEsGwv7NAvKowFCRYTT/N3tJRg:MzsKeWNm/i7KM71K7A1YTT9TRg
                            MD5:A565315C0A1F25C65F6FBC3682AF7543
                            SHA1:AA6F0F560735865E445714602AC158CADDD051DF
                            SHA-256:6DA8E0B8591B8A6A93C09BB78A57856556C00AA84FE4081A383F2A6E5B041CDB
                            SHA-512:7AF88C15B4B124667DA4AAB65D7E59EF9525D80E7C90575F7574C5D07647E3552A0D242ED01877EF5A877373796B28B4E253B688A0162E0D63874A19C18DC675
                            Malicious:false
                            Preview:.~..u.2..m$=C..L.1agu....._..3.7/.......{.i...v.)..D-.'`.t.W.g.u~...J......".'.|Hz....N..H.y..hP(..q..h.......06.J...a..........r../..h...Zj..i..........!1.[|5...W....X..R.....)...B...:..9....<@..6.;..9.<.......QGxDD.}....'..I.X...#....r.U.,&..YB.`.7......R./g.t. ..Q.. )....(z~p.b/...>}.`...)t".g....6L..}w..7A[....c.....u..._..u.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):463
                            Entropy (8bit):7.509863249772594
                            Encrypted:false
                            SSDEEP:12:rzWyI4G2QfBvVJFMCD1WVnwFCRYTT/N3tJRg:vxrGAWWVHYTT9TRg
                            MD5:713F02585B7A2DCB3FE125D56B58C377
                            SHA1:67FA356FED7282062CEDDA32F62F31B16F485B56
                            SHA-256:14358CA3920892273E60FA3856EA38A2BEB5419B03D33FB45EA3BEEFC0D4595A
                            SHA-512:BFDBA1447A01E037245465FB72C517FF3322FE657BB2E50117019C7E911B68E217AF4118AAD3722428E313CE39FC7A0E1A20DE4B8629947716E44C6BF8397C49
                            Malicious:false
                            Preview:8.....<O...Z...d......f......,."+7G.......{Ut]..pr.F..kkO...sp...Qc.[x.3.,..m.5..R.0..M.N...[..Z...E%.X........#;......~..!:...-.(.x.D......7..z......y...f.m.m6..+ZM.2.=G~h..O..l....kB@.."s.`........O..{.DD.}....v.....bO.......ykN-)&.N@@.`(7.....Q.,g.t. K.....&...m6%<WcP.cB...4.({*..;...2.Q..O .Hg.UI..x(a.-......Ds.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):456
                            Entropy (8bit):7.467853387262809
                            Encrypted:false
                            SSDEEP:12:BEOovvXJ1cnD+8lsDxNMHAYWGwFCRYTT/N3tJRg:B2XHcnD+8uAgYWEYTT9TRg
                            MD5:442425D56FEBBD86BE6610FDC65AEA39
                            SHA1:1DE61F0BDDB5157A6BADBDE99D9BF85153609824
                            SHA-256:56FB3CE0D17C3DB1D3BC37E3FD43AF96B98A1D817D7E7B2DA2C0FC7308411723
                            SHA-512:7F92032774C0054F7A296790F8691536AEA5F76BC45150622BF10BFCBA8218EB03F42A38504A295E03D088A4B4E0D82CEC5007C5FA16923BD69CEDADFA3C3F0F
                            Malicious:false
                            Preview:Q...ja[..9...$w?.U..8..kY.T.@y.../0.h..U.I.. ..+!...8E<..q(Q.P...|!^.9Z.J0.<.Q.r.)...k..r...9...Gvm..A/. A......i.I.<....L_...*g.:.X......Y8Ex....J...+/...d.,..xA$.1.j.dK.H......F....{H0......&..DD.}....v..g.c...fx.....aA8I..B`.`(e.....R.,d.t...+F.8.`D06.P.C.......;U.Z8..98w....M9...n[...S..g.q..+"}.xgh.r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):480
                            Entropy (8bit):7.484104954473119
                            Encrypted:false
                            SSDEEP:12:dKnV8wOUbco/F4wW3KiGAsD/SnFWwFCRYTT/N3tJRg:WV85eiv3K8mSSYTT9TRg
                            MD5:E9EFC31112042A88B63383438AA88CE3
                            SHA1:C5A5083DCBA2650BE86DE64726C228BD4D11F654
                            SHA-256:2DEFC4D896650E9D001E6D7C839A8C113909A563F847F2D2B51E9D4EF9B7092E
                            SHA-512:B2536E69E72ED7E8FEF6403B77F2814D15E1C3DE6A630F78A90DBF2D98195132B24A09EA0FEEE08C56B8A969403DD03E29CD5F32059B466F89569FE802CD1056
                            Malicious:false
                            Preview:F..r?S"A.OAs|-...u..|d.O.^..Xn.^-8V.Q.\."u5@.......V..[.`.Ab..;!l.......&...].g..D....Si...W......Zf.#..../.)%O.....6.....q&.U.4.#5.@f..:U.._s...\...eU...-.W..}.Nq...j.v....S/.....@.....g5..j.z..#.MU..r..v<..i.f....`..ec.DD.}.....?........!)...D.0ATIT.B`.`(e.....R.,d.t..?`.`).M........s..!..{/..+..|.....o.`90.T..[...A........tQ..r.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\the-real-index.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1155
                            Entropy (8bit):7.836314652260082
                            Encrypted:false
                            SSDEEP:24:8uG4wGYmfLcdRURpKmmj14639C+fciSLwsAgcmbRF2tRmYTT9TRg:W43LcRURpKW639C+f7qXbRF2PTTk
                            MD5:F0B75F222D99284D7F2F91B5EB18ADF5
                            SHA1:0594F3918C2D12A816AF7AC8FC00FCBA7599A0D1
                            SHA-256:E6F74E03837098C2B1B0E4912223EAE543B1214B27FC31F531B05D422E907E05
                            SHA-512:2AD63624F54AE0CE335DB19369B9CD2391289650DA03616C7E80098CA27343859166DB2523B3A974864A424C69101FE2BC02D3472700FE9BB0899094CC2FA4B2
                            Malicious:false
                            Preview:.....k....J.F4..yYkV.....v..@.=..:...E...{.....J/...Z...mI.....P.....X...q^.,....\..X.N3Id.\...+.......t.......R..bH...f&8_intcgTAM.B...<V....5.R2./#..>.E.. .....xy.h7T..,e.ux.s..(#.@..~r%N;../....|.b<..[_..b..|...:....K[.-..q.p....q.vC.o.z-.....1.l..))h.BO..S....a.ml3.].wu.]....w.sE,....8....).Q...d....D.m..b.../.>Co...gp.g..B...~\ma........P.{A.\mK3.. F).."..}.X....fZ.......2....j.....f.>.ulAW=..9i.<.P....R..Y@.%|!B.z...`.....Vd.gL~.xz..p>q.b3+w..b..,s._....d....o....Q.L<.....ZC]^.....~'.vt.j...ukT..`'.Y.I.....Y.Br6.\....a...0P......C...Ym..KE....G..`...^.3..O.....K...7.~.!.Q#c.|Q..b.}Q.....wu.%......%.....]k.v.aP..[...3(.B.....]<..'.t...!l.C....c.){...R(..tl@...(<..H(fL... U...-.......K@].,..@...?8..Q....=....b.&.LDk........g0T.W.9...}..q.nx.ePt........|.....6j.v..R..=:..K..gU..).o1.t.....;6f.A.8t`...QnB._E..i..\4...DjI.}].z<.....9C[k.U.^.<..(*VD.}....f.....{GC...J..l.@.?y...@.`(7.....R..x....6.$....b..a....8...aNz6K.K...9qy..

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):253
                            Entropy (8bit):7.130867191141162
                            Encrypted:false
                            SSDEEP:6:Y/nZPLS29FTMUP7HcPo8aC6ztDsY80T/f/9FZtOoRg:YvZz197cwFCRYTT/N3tJRg
                            MD5:83816458B7D7C5E31CDC70890EA39369
                            SHA1:3B3597EA8EB40E5001F50E1BDFFA9D3184C77CD8
                            SHA-256:99E98C271FA84C95169703E635C1D009E4F91546406822E51B9C4D9C5E1EA59B
                            SHA-512:E888D5175D9D59458ABD3F4F82CCB8269A4FAC6F893C45BD99C49A7344033A94349D56C41C4529DEEA354D4570095FD38AF7756D406D36D1F74D699DCCC02922
                            Malicious:false
                            Preview:..\...OG....%C.C....xx..KD.}...l.t..n..2F....t.@.'y.."=.W.9..[.,n.......7HA...)....Hcl...o.L.B......(..".U..A..(Y._.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index-dir\the-real-index.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):291
                            Entropy (8bit):7.232171853112114
                            Encrypted:false
                            SSDEEP:6:eBVuq0Rbz1bk03i7clyBuWxcPo8aC6ztDsY80T/f/9FZtOoRg:eBVuqEzRFi7clyBu2cwFCRYTT/N3tJRg
                            MD5:4C1F359E320D60C202C71BFE97F1097A
                            SHA1:7E84AB4D9353C91ABEB57C30AF7A22E8CDD7B049
                            SHA-256:D0DFF61E199017EE2F201AA8C941C7B87F0A90429870097C909CCD5EB5D91AC7
                            SHA-512:AC2D365773E79DDAA3388C4889900FCD22FE946358ED26FF844FAE9F5F1086EBC90E4F0EE2F0C852669FB7B9F7ABAC5D657592C5F307B229B2F18C91ED057D93
                            Malicious:false
                            Preview:.Vax.`x.E.he..?WwE`R,...........X%R.0I,..N.k.OpYVD.}....f.....{GC...J..l.@.?y...@.`(7.....R.t...J...........U{).].~....s.. .x...xt3y0...d.u~....K....m.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\index.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):253
                            Entropy (8bit):7.183219414452769
                            Encrypted:false
                            SSDEEP:6:Eu26uS2RF4hJs2OwPo8aC6ztDsY80T/f/9FZtOoRg:Eu2R1as2OwwFCRYTT/N3tJRg
                            MD5:12753640CD044D0D01945587F3166D0E
                            SHA1:9931BBEA0C420D06E603471EEDBCD3810F0185B9
                            SHA-256:D72FB1DE37F472A35882F76143A3B8C5CE2B32D4EA8BFE18AA37086E9B999352
                            SHA-512:60A886C540CBDB3B6BA1469815282A23B36C980C5CEE20F5E7EB01CA3C3F221A5E122B3D9C19A88BB8E4557FE74302D4A533497A18594F4915C2007D065C32BA
                            Malicious:false
                            Preview:...^..-K....1_..m.h..9..KD.}...l.t..n..2F....t.@.'y....I...N.2.8..pe.d)..-.z.)..~.....}-..[..QKF.f...1...-.....#_.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\wasm\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):510
                            Entropy (8bit):7.582705112696777
                            Encrypted:false
                            SSDEEP:12:6cia/H6PA9ZENZg0TWzenDrbpHPKnuAsgXwFCRYTT/N3tJRg:gayo96zfWzenbxPeXYTT9TRg
                            MD5:C7CF8AD657D1DAEB4812BED38C1C7A01
                            SHA1:67C2435D20B40AD28579D7486478943A00FE0C88
                            SHA-256:A4F7F6D486F7133B2DD8BDE7E30C7EC6F0635A9DA94E3D32ADC4DC5304029D8E
                            SHA-512:3A1963AD1055D4C5C0DCF870C341F645127B236DEE864C7CE5DB96065B7656A3DBE3DEEA0E947287F282A5C822B96D8899426161B051758D022959E378CD0270
                            Malicious:false
                            Preview:..M/...(.2&.(Q.....1G.>=Q....L)...i..".3...N.w...0,...%s!...&.}........V.p..n.[....Q.....7z& ..|......yLa...}|.h.....i...0...a..1p.N.H.E.L..$...V!5..|q3}e<..b..:....P.)....{.....g...h07......U.AE.cq.qD..s<...o..d,uU..R#(...,....6.%..F...1.?Q}R..d.z#..\.5.......nD.}..u .....n..`F....t.@.....U.v.........M..|.S%...p.D.".....$.."E|..G..%.._F#"...F...[.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):480
                            Entropy (8bit):7.490225557073738
                            Encrypted:false
                            SSDEEP:12:3tG6tgs4Sp3dDikPCpVrdlL5G8DcwFCRYTT/N3tJRg:dvg8tnPb8CYTT9TRg
                            MD5:0C63BD7D6D22509562565D1CDDD083DE
                            SHA1:06B81DE065C1FD283B0A8FB43ED1EA53D7650F03
                            SHA-256:E03035AC108DCF49D72CB8A9B3BB44CB119C5659ED9A064CC34F78E76E6BED2F
                            SHA-512:A0CA4D29D4ACBC92FB7E738D1C8833F08E8FD4D69FBAAE59CE59BCF56B8A9AE9699BD33FCBC9F7864777D5DD597F237E2FB2F2DC3146C8C530EDEAA73946FEE5
                            Malicious:false
                            Preview:.e...zHm..x...=..k.Hl..O'..{.}.........g.{.....e..[@.E......N_"..(.A...LR....LJ.....eA.a.B.F:.8..Yx..*..ow*..k.R...4.e1..p.......c...7@...5..2.{.E..-..N........_.D..J\........\ ...P.\E.+.s..0.S5]..Jl.v.z..4.2D.;.....s......{...nD.}....{.I.Y.,.qF....w.@.'y..A@.`1.....S..A.yZ$.OR"b.$.......;.#.@..PM..~A...7}...+.......?.c.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\CURRENT.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):248
                            Entropy (8bit):7.17730804224011
                            Encrypted:false
                            SSDEEP:6:UQ4oULmu5yOTi/c4FWcPo8aC6ztDsY80T/f/9FZtOoRg:UNoULmoTEZpwFCRYTT/N3tJRg
                            MD5:16D6A509816699E3011DE06DFFDB6BDE
                            SHA1:7304442230CA7A14F9A36E285DE98B1A3B560FC0
                            SHA-256:D090872D2980512DF13727C8F1DFCA812A3184EE9CA094CE68D218C27EB6DF42
                            SHA-512:1BDD39153755EE280665F412D6F16CE3526E9D486E3B1430F340E09A9B1165383704FD86BF26F3410F0C4105084DFBCA19F62259CC815558549C980B3AD565B0
                            Malicious:false
                            Preview:..N...)...yU..YaD.}...g.@...n..`F....w.@.$y..B@..l....\1.&.F....6.'...H.:qr .7B.oSr.".C.....Y.C.....j......b.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):557
                            Entropy (8bit):7.622357621021516
                            Encrypted:false
                            SSDEEP:12:T0X78GQjhXliN+e5L48vz+vEqvl472Lpl2Iu0twFCRYTT/N3tJRg:AYqNf5L4GzgfaQv21kYTT9TRg
                            MD5:0DA1BD286AF76804B689A026920CBB48
                            SHA1:8D5EB6BE6E8A4D6787E54BDE2AD04E2A90292C55
                            SHA-256:4751EDC0D98AE37BA76C4759C6974F3CC22C702DE6B8ABE734D5F26F32F55D32
                            SHA-512:86DE238CC51DC97F079B7FE8F678758866416F234C308F5F4EDA824EE06189FB0A5F9242A9B5E2EB94CF7E12868BD77BCE18E1E863FD7F964DD9C123FFDDADAA
                            Malicious:false
                            Preview:....D)..eQ.Q!#..n.l.*....aX..cN....g9b.5..g.1.....%3.{.c>f.yn_S..Q.k.Va-.\.....+.3.Cm..7.....)...8t...f..*0;.e.e-F.1..c)...i.zR...Vb...dB....=...-.&t>`4m.8..:.K......*.K....`.$Z...]...{.3V....E..<.t.-B....fF..%.k.......8.1.:{.}....96~z.vQ.`..v....?.....L.S.}._y.jjn.{.'.lc..4..z.#..>.;...W......Q5Z..=..{]J'^VBpd.nD.}..u .....n..`F....t.@..}.sT|.....r.(...Sc.....Te...)...x.z\....V...`.e.`...."."..h...[.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):524
                            Entropy (8bit):7.598059342863965
                            Encrypted:false
                            SSDEEP:12:86eS/yNWGNuyja1sPcxZsPBVyWphNzcwFCRYTT/N3tJRg:HeS6XPmZMhAYTT9TRg
                            MD5:84DD6153CABDD66F9EB2EC519B46B901
                            SHA1:6339D226F7286540A0E544062FE6ECA36A31AB61
                            SHA-256:8F88E7D456466FDC14C3517D02B7F16CB691BECDD2B0EC12C6375F1E7C7186FD
                            SHA-512:820E86D44C88BF5C068676B5A68F59881AF516AE13510C0586046E8E4EAC4C1C82D8217A327C850FCF9BDF201B7998857BFBB83DAFACA5161364ABC115D7FC12
                            Malicious:false
                            Preview:k..}..Nj...g..BX.XTv<..[\e8m<...)W4=...IY.H..".....L.oP..............x.L.U...b......dn....X.....j.v.........'.*.i.`.k..'.^....U.9G..y.y-..47CUr...?k:..9.i.....#!. |.n.L.6P..............'.....uI...`...??7...y.B."......6..|;f...x.U..\&V..9Q(.H............Y^.....:...9.3_)..z...nD.}....{.I.Y.,.qF....w.@.'y..A@.`:*n.D...yS9..[.j.L.O?`.....;.>U..."...fU1....4<..IF....,$+.?c.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\MANIFEST-000001.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):283
                            Entropy (8bit):7.159473592698244
                            Encrypted:false
                            SSDEEP:6:YoLNYfFwLGjYSpmDa0fA9R1dDOcfmcPo8aC6ztDsY80T/f/9FZtOoRg:YoLNYaLGjYSpmD/fA9X0cfDwFCRYTT/g
                            MD5:78265210047BE6FF2A776451298A1578
                            SHA1:ABA2C053DB14BEAC36593F0A0E6E044342EA3019
                            SHA-256:A41FBF361DB175A2816A343484542D84FD559A1E795A05560754206CB1841B59
                            SHA-512:17253E32C62F705A33AC4A3EE821892987A95FEE7FC3BFBD1D1A78497BFBD3656B74B8975A1BBBD67B842AAA195B57E9B3ED75193BB83A0015500C87042B82AA
                            Malicious:false
                            Preview:...`.r..c~ps.s$@W..(.*'0..%.a....Q.4F.oD.}...R.I.X:..v.....@.$y..B@.`(4.....RD.Q...Z:M.l.......?,y.~b@e...A......D..N.B....,+,q..n..s....H...l.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):731
                            Entropy (8bit):7.749034285207979
                            Encrypted:false
                            SSDEEP:12:S0XgVvI9B/GQrKwWqtitbG1HJyIXQu6gndlf16NEFM7KUWvr/jwFCRYTT/N3tJRg:LXVB/IWKbG1pdQQoNE27ozYTT9TRg
                            MD5:35A3C81AD1EAF72F89EE7D388021A3F0
                            SHA1:02315CF2CF7198895BC03504A182A85C41595B2D
                            SHA-256:AE7CFCBE34600B61F0B7B807F850BCDAFD0B6BFDFEDD80107B6D9FA7FE6BA39F
                            SHA-512:9E4CBC30AB4106FDF9C1E703BC85C41F2230CFE064C2AFF62A8192B4A6FD4DDADE4F1C23927AB6C13ADED2E9F9E30027FBED01AC94FAAD5D9EC45FF089E15F7C
                            Malicious:false
                            Preview:....|.R-lx......6......}.l..qo..P.<k....p.O........._.mK....R.......!.#.s{..EP..........0i....;....sK$....(.3.5.>.../.>r..7V).jr....{W...... ..V~.8=...........wv!fd...I-g.k|./C..v.r.L.................GoA.>..!^.i.S..>.g.x.!.6V@..Uj...W....nPX.{.|....<.k..w..J.<2;v..7s..R.\.Qh...... D.8f.B.1..(P.pA.3..7.H...#...._.s...Z f.+.../.S...<...I]-.j[..c...{.V.).$..m..v..6,....0..p...._.a....zLo........q.U..i.....;....1Z..U.L..U.`....%.#n?....x.A.*.....gj.C......4.+..)..nD.}...x.I.X...5..<...pp....]@.`z7.....R./g.t.Y~.1..\.O.a}.Y..a.b...G....3o.'.J.P....o.S[.*...i.?&.C.}Xtq.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\MANIFEST-000001.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):283
                            Entropy (8bit):7.1544915802098465
                            Encrypted:false
                            SSDEEP:6:JSDmnDXi3GjYSpmDuJRQwRebtbw9f8IcPo8aC6ztDsY80T/f/9FZtOoRg:ZnLi3GjYSpmDuJTRSc8VwFCRYTT/N3t0
                            MD5:782BD79FE6702FE112C9D0C04606780F
                            SHA1:9F84734D8F509E9F3A721B673A223D348C6928C1
                            SHA-256:43ACAD8028DB305D8F4E9CEEC122E4BD6BEF8B2AFE76F87E7C6D8FE085A04413
                            SHA-512:63355B38F0D7CBF54C97F91BC0F486B9B2F86E1BCAEC946EB23700A3F9B77EFD9542D178FB9249C817566BAD812D0CE3235745894937970D9DE8E2E67F6715C1
                            Malicious:false
                            Preview:s..r%.V.*.z\._...5..EP]{s.....3W..u.d.&.oD.}...R.I.X:..v.....@.$y..B@.`(4.....Rb?..o....g..%...d.....t..M....]..3e....!..G#..tLF6...........l.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):20712
                            Entropy (8bit):7.992982755120598
                            Encrypted:true
                            SSDEEP:384:C2bWWAIX9aS6CF5WCTjoWsCTX3abYFmkwvyrjVLhntZk6lq0habBzLhpt:C8WWBX9sOWCnxrT7Fmkwv4VtntlA+ezv
                            MD5:2982B3C2B5A7F037A1E10A1B8A6A7C26
                            SHA1:DBDFF5C260896BEC30CB0B1E181ED3D4677B12E6
                            SHA-256:95368F36272823A48EA6F4A209786DBC90329B2C1310FF377C92CE31040E4C67
                            SHA-512:E68E341444DB78E7534DCCE39CFBD7D353362E32AF533EF8F437AD14C732348468EDA29B393AA1DBFBBA515E6C8321C22504AF0D7BC65733E2C63505AB4BB189
                            Malicious:false
                            Preview:D.|..aq..h.n..q.eC0[2f.(....L.X....-.......:.&6..Jy..[k.3.i....d9Z.w.....H..%.....y...#.kd....H|.#....>.....X..5.r..IP.<...2.Q.......#.n_.O...]..."!.....)......h6p..n............*..J.\.......C!...Ixl.a!;*....d..W.....Z&.Q..U......G]2..%.....*.(.-;B.9Ez..g.l(.p...g.'eT...T.7...Y..........p&...........:93...-.#.7....'.."V.s..d-.u.s"...7q&....5Z.r[..{*..cc.@....].....3i[.D.....s....]`..../o..eO.?.1n...1.w.p.G.{CC....SnZ..r...O.Z./......g....5.K.8..B.&.... *1^....? 0.DNe.$.j3.=..n....;.t....H..QC.'nMA.~=Y..xG.....l.\.D1...$..ZO!.mJ|..d@....\.T.1<..5..#..G....Q..x......;]..a...L.\.`W.{.cE].)v....j.s.?.....K..<UT...CT.......J.*..Q.}..?...a...............U.../..t.i.X.:...".C..{.v..w..c.D.)....,$.V....L..u.-... 0..R.....{W.6.#&4.9V...r{q...>&.lCV...qN.........V...#i.........|....\.q.q.l..."...#.w...z..#_."^...7..i=.h......>.-.....z.<U..0...=}.wX+..#{..<.5Ubxw....7.7~..s|.5(Y..vUj@.m.O.!..,.Gv&..u....&U(Q...>...%.f....9.1.H..X.......=.L.l...i.*;

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):347
                            Entropy (8bit):7.300385035654602
                            Encrypted:false
                            SSDEEP:6:g04zCHEtip9u8008zbpcXdVPKcDFCi9aqY10BnfdTugmiWcPo8aC6ztDsY80T/fY:goEK9o08zdtyFC8PD8cwFCRYTT/N3tJ2
                            MD5:EC89761E8C183C5ADBF6877B13F45828
                            SHA1:C57A8D8EE74F7CAFD8AE6AD8C3748C4597D0F34E
                            SHA-256:CAAA7FA1ABAEE9CD4FC31D563AD61047D017C95574BC29475E09122E157C0839
                            SHA-512:2432E96325AB1B06608A903C7F4B1C2012B0FBB783316A3DDCC9348E6B33C7773CED489F91CD606C83892EB7A240EA08414B24ED81E32530CC718FE5317DEDE5
                            Malicious:false
                            Preview:jT@..B...B.$...D...R. .yB...MN.[.H.Em.46....|.............L.t.Y...Vx..\...&H..5....W.0..lD.}...{.I.XN..g......4.J...j..8.......,g.t. ....&.X..R.....eX.EX..Q....Y.g.6.....(4.........M.......7.<..u.D..y.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Reporting and NEL.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37113
                            Entropy (8bit):7.9954174401770635
                            Encrypted:true
                            SSDEEP:768:1ZQZeKSJW2PqGyyvbD9RHGf3FsIH5JPISHr0GokzcxBN5:1qgKU5PA8hRUFsIZXr0Pec7
                            MD5:1C3CBB8F1FE51CB455CADE5EA4BDEE51
                            SHA1:C397D02F0E35667E1AF8DA2CAF06380CA491D26F
                            SHA-256:6E0F9E2EA751A602E6EAC259A2CF6F411BB4776D6A688893656B441FF5DD9581
                            SHA-512:6B54E7028FD06EC14C29632514BC8C374E22840E0E5797FAB314C9CEDC82A5177982372AD851FD78A49DF56E6638CD0EA434265409249B722F983B22CC06AB2A
                            Malicious:false
                            Preview:P......p&..4Q...i.#.y..a.....@. ...1y#..L...wu.h.T...."b...C..=.}......_.Q..jJ ..1..>MaA..[4..V.....O1..>....C.@..U.`..H.........O`.@9..RQ=..s*..D^.....sV/1..=(~c.8.w....M..5Y.l.??L.S...h*.../..v....|\...>.....yn......).h).2^T-....q.........%1M...&.....T.'....k..u3..O`.2R..C.m.-....SQ.gIG...[.$....+L..vX.....3.._..P3.a....i^...5`.F.)R........J..1m.F.~.MQ....@P.@.....6Q.Xl.....C.....$TT..R..[...z..U....ej.\.W...v..#Q..|lbY.....Q.?.,Hv..Q.ubH...=.h$.T.3`..|My..S..8)...bD..`...).T.,....bk9'....nBC...dZ......oe3..:..S{...Y...&....1....-Y\ufg.@2.c`......I}...o.H...'..8...=..X.J..*....f.R.jYG..PT2>...ZL.4q....^<.l.<.w~].GV..O...~BI..?.n......X".`F+\.`.....~z.....@N.H..HN..h...j.6(.b.L@uL....6U...X.(K.P.`.v..)....;h..N_..,..,.)..].9...gX......v..T..Q.w....l\Yu.j....!..ID..x...a..2......y..;.].....2}.4....^k.. Po..>.~.1.....)../T..4..Jj.o.L.t."X\.\....!..`..r..Pn..Ko...}......&.&.a.s.~....c...c..=K.I.....2.wt.........FK...y]%..R.]l.g.b..-..H.

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):511
                            Entropy (8bit):7.584839010333725
                            Encrypted:false
                            SSDEEP:12:pQI+FeAa4Dtr/umWrmWGpuYr9iXyecwFCRYTT/N3tJRg:+rFoAtr/LWrmPkYr9iXyDYTT9TRg
                            MD5:A533059F3CB1FE57F5392849352E17EA
                            SHA1:C0B46D601AC522962537A5A76EA7D8162D906CD6
                            SHA-256:725D2F49028CB1062715A024AD4FC5D4A00CB37DAE0BC71C33B5E982F2DC09D8
                            SHA-512:E5478A51A8307D086E3AEC6F884B0EE3E9F54DFA3372C525791FA170BBB8485B3037EC57C76CE4FB2758AF8B63F0CE085117C49AC7A18E392B9CBC0D6CCC37F3
                            Malicious:false
                            Preview:.7...^.!.-......G...L.J....T..... U....k`.o......b.O.~...J]....J.{..Q.AF.b.l.....uWu.o...../|a-.6....k{.y.=.w4_...&Y..K..t.....rK....5EH.\..k.4.&..0@.L......f.~............g..[..G..`ck..]..>pc....7bL..d.Kl.s<.z..>...n..Z..X2I.<,|...n".....l.o.......R...<...E....x.I.Y.,.qF....w.@.'y..A@.`u&........V....Y.l2..G..r.%../..r.w...t....[t......s...F?.c.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\CURRENT.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):248
                            Entropy (8bit):7.136320957415997
                            Encrypted:false
                            SSDEEP:6:LuULmdJGA1XmTijecPo8aC6ztDsY80T/f/9FZtOoRg:qULmDGAdmTy7wFCRYTT/N3tJRg
                            MD5:80CCF6257793B4CA61665D047F4CD455
                            SHA1:529C15FBB0DD11C939C8236941DC20C686A7F8EB
                            SHA-256:8E20D52979F09B455B7453157445DDCD96E6F260A0A298BF4B24854E33DEE6B6
                            SHA-512:35434E549E4862068679819606915FABB8AC7060311FBE47EAE3EDF763DE5C72179AB16BAA3E532DC182263F080DFDFF56CD13068646C001C6AFD7A840FB6FFE
                            Malicious:false
                            Preview:...... V...kC.CaD.}...g.@...n..`F....w.@.$y..B@.g.O.X.Z......GTw..4s|.*...B..w.EO1G...r.OM.wz.??R.....Q..YB...b.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):545
                            Entropy (8bit):7.585166568818076
                            Encrypted:false
                            SSDEEP:12:Nk67U3inLlHRVbLjSZBk1zzRkpMaPLJ+2jgZpp62/ND4TwFCRYTT/N3tJRg:26g3inLlHTjACdzRsLYpQ2/NDcYTT9T2
                            MD5:7335E33582FF6D371AD4F02A9E6AB48C
                            SHA1:DDAACC642CEBBF5AF47CA21DC2EC6AB69A1B9463
                            SHA-256:9CF31355F5B2E850609465EC680C5B03B91A9D06733383F885244447F3F64A61
                            SHA-512:EBE58DDD0FA7AE76521E6647E495C42848961FEE71A5C2EE245CCABE2C462516E4CA7F02940D27C7468D063A0A6B9694F86C8E9B5F33812729760F5C14622F48
                            Malicious:false
                            Preview:y..r.b..=d..g..X.!q..l..htBX.<,.k.....;....M..Yk......,.De.wU."...`<.n.z.Gw..jS.E,JTA.P../.@$}...+...X1.W.o..P..a...<..%......+..O7.<...q.....g..o.C.........{.......r<%'..i..A..P&.M.Ev&.}..,eG.oW....qk...1...h%6.......b.oR...t....j...>3..G....P..Y.P(H..]#...E..).....+.h...[6E.R...%..N...'t,.`.=O&|.`....nD.}..u .....n..`F....t.@.)..0.O..9~.K....+...X.fG..YG....r.V.(..^.;....(:j.'%};.....$..[.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):512
                            Entropy (8bit):7.604482608907285
                            Encrypted:false
                            SSDEEP:12:G1FvzJYUkDNWgHgU4vz80vf7OXBV1ATYpBZB+ZcwFCRYTT/N3tJRg:G1FvuWgHgD80H7OOTEncEYTT9TRg
                            MD5:A9A0FD2333D9695D2BE8D17CFAEE3291
                            SHA1:1D5E30C255F7C65FCC348028BE9610D198E15E5D
                            SHA-256:D98CC7FCAF13C9F04FEFAE1EE2D8EFA1333495C236BBA21A99326EDEC29139F3
                            SHA-512:A9FBF94716E71DE29788DE6921782E8CD99A9047E7FB99FCE146E1D584745FD10A0C7F29901FA4773D727BFB13BEB7A0CAC2428ECF8AB4ED243AF45820F09AA5
                            Malicious:false
                            Preview:...F.(....T.;P..^..x...u7t...K..X.{2Q H...C......n.........a.,.....%..Wj..W..r..al.w.C......p.O.r..:.,..f.w.{...H3C.P.[.H...=........_.NTo. ..>.E.T3..at1..).P.6.q>Gs.......H..m,\....8..nH...X....;..:.X2....[_...w.^......5.uc....-...yL[...2.J.`7..y...b..5*...m...eu.*..G..KnD.}....{.I.Y.,.qF....w.@.'y..A@.`...i....f..Y..Da.B.qC..+....PZ ..0.4./bI.n.w.ng........'..!c.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\MANIFEST-000001.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):283
                            Entropy (8bit):7.191115353978752
                            Encrypted:false
                            SSDEEP:6:eZF5FAwR+pWGjYSpmDOfooPEofK/J8IcPo8aC6ztDsY80T/f/9FZtOoRg:e5ykGjYSpmDOQoPET/uVwFCRYTT/N3t0
                            MD5:E6EA0A38F70C5B4C7D6C1FF048874970
                            SHA1:EA9178C8D0A615690EF43301C74F441A99D2DC2F
                            SHA-256:BBC9D6FE444232B24752340C1946B65B9A59954411E043A8B2EB7C55F5304143
                            SHA-512:BEEFF922E22233702C759FBB3BA914708D92D2EFF7C83F8F67BE5E30ADE417718EF8D092A22E5E0A6C0DD3623B8BC8445D26CFDBED60111D870C11EE96CB66AE
                            Malicious:false
                            Preview:...+.....=.< .u.v..f'.....i..HA...u..N.oD.}...R.I.X:..v.....@.$y..B@.`(4.....Rs...;.5U.q.%`5._.v..$Z......H....6../.P:yZ.m...U.a..2.z.4.i.2l.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):131313
                            Entropy (8bit):7.99865947284408
                            Encrypted:true
                            SSDEEP:3072:50LU8qGp1K1Y39VZkREhUtdlT4cyWzeCsc1vkCDKwlRptaTh:5YVzKCtVZkuS0AqCscvF+wl9ih
                            MD5:958043E8DAA10EC6112F046A5112306A
                            SHA1:FB0DDD99C87C8A631539FC17CCC2C4DC1BB985DA
                            SHA-256:4E3C05FDA9437B7B9C35AFF4C4747EB9CDB61E6B6BA6A1C0606A0FD5C31DD223
                            SHA-512:ABCEE203ADA7AE4E26085681C0BB311A2554B227F02088730D96546BF967D7511D45A0CF171C2EA6193FBD30649169778A8EE07C900756302191E4E3E0973C4B
                            Malicious:false
                            Preview:%..~...h........5.g.&p3yQ......<x....S.c.Y..-....d.l.&a."..?.&"......... &............F..V......\#Is..l...^..Y8.%LZ..`.....)...O.;6....M....;.....X.....r.....)..y..@Ij.4..S..."...A;w.9..d$.n\....EN.w]...)N....L.. yD..`.B....J...F.-.9.,..*..H....t^..O......./..P.2..{Su.q0....X.xwUb..k....,..{..z....1l...........}.QR.sZ....J.3.&[(..y.:L....^k.^.%3...!$Qy9.C....X&.Q....7r..c...?..^..~|...I.....b.4u.#.9......2zwV_..........e:.x.S$."~_.w..3..c.vz...(^.z..C...=>.../9x....'...8-.<g=p...~...wV@.>e>.B.R....)Gdh....2.b.J.......p..X..r.i.~.).2Y...=!T......^..+.a..R.Q\.H...Vs C>.r.~...K....9I.g....:........&V*...N4!VV....k.X.D=d.?.Kc...R..L*Z..<Z.&.b2.....I.4..G..E<...0[..'..b...n.N.h@.%..RVE....B.5..f;..'.z.C..r/..n....}...o.~.'...J.1..$n.Md......[kD..9....7.h'.N........G.X.....[.8F.>..s...G..z?....)..b...3p..V%d....../...!N.;..@.@..f. .h`I).M._...'.Ba....D....B..".~.V.+.x.@dcH`..2...(..Sk.....>....H..k.A.Ha.......|.....*..V.......5.S..:h.5.

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\336a045b-df12-4067-9f71-93ee2edb038d\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cookie\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\AcroCef\DC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\AcroCef\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\Acrobat\DC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\Acrobat\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):842
                            Entropy (8bit):7.777668139032565
                            Encrypted:false
                            SSDEEP:24:U2pqNhJ2KQDJPEivdy7RcN3QwZGNuranju3YTT9TRg:U2UNh8lEiqRKzna7Tk
                            MD5:697BF2AAB4F9DDFB45E3FD7B42CD500D
                            SHA1:E123C6B11B6BDEF2A7E4FBE247A61DFE471324EA
                            SHA-256:C0D2C99986C631ACF3DA55BBEB850A7739ED9F91EC1C693E5FECE2380D1F0C3B
                            SHA-512:B072CE3D6F3EE0518845C1079FF7FB10A5902A0F1981E1428BF76558EF1569F2F944928F44A56379090B9439CB9B2F818039C652F372579EBF2EFF958E07EF73
                            Malicious:false
                            Preview:c+1L.R...!..z..k.....o.a..7M......q.....#.....O..'...."8-..g..dF...kL..aB6.9..!.)<.e......0..%...f.$..r.....2.zKs..k..8_j..7...G..t.....a.kzBR...k]...>.F=.flEd.[.4r.~.?U-|....\.mE .6..n..6.?(_..4.t.d$..34.......t.Vt......#..G,../..s-.(.lw*.....C..0.B.L\L...N.)s.?.V..]....\0.`.X....Y...P{.n..9......N.K.|t@.VjE.E..*w....*........^u..2].5...o.r...1.KI..".x..1.6..,0W....r%.&...Q.X....../v.B.8.....}.Fn...k`|@..B..W./O..:1A:.?.N.d.o6.}.<.B.....+......`...T=.....o.I.C.Q.... R.C...j.DR..N=.S..R.-...Yz:..._...P..#...> wYhoR...K.I.#t..[.P].Kb.g.zE....9..].&[.|G%...f..!Ug.cD.}...C.m....b..N.wd.5....$e..B..`(7.....R.,........G.0........\.^3..Kp{..4..=.n.....=..S..6...H..8...A3.+n.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Adobe\Color\Profiles\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\Color\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Adobe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\CEF\User Data\Dictionaries\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\CEF\User Data\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\CEF\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jcp.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8424
                            Entropy (8bit):7.978550355725768
                            Encrypted:false
                            SSDEEP:192:e2LaEk0DMc1JyOF/hRHY7AZEn+syu+/EALr8LXqRYBdVKQKT2JvRKUev:dm2M+TR45+fuOE0iXqRYPVWaRKUK
                            MD5:EDA8F7112857D1824A367AB92A9039E1
                            SHA1:F6900B60F99C9C5BADAC7333161F6A9F319CAA7D
                            SHA-256:721361F38DFDC377AA091B452F43D34BF7FB401FC0A740663A4E3DD89A008265
                            SHA-512:E24FC7856F05DA2DC3A724EAB7B10AA38754EF4B2F8FE5A20185C6F40F0CE20CE1A6FD9F22720B94370C19E39876CAFCB065644744F2A8A8DFC482EB802C502B
                            Malicious:false
                            Preview:.M..j...#.c..u...ws....Q.....@Jm..6.p"3...W.`.YU.Y-.........A..Wb.Nk(.z.8..O........?i.....%......'.s..._.fY. .l....I..S...I.I....~.."....N...[e}M].y3.-/.....s.k.V..+.4.(^.a{n..V}e..j..8.....\...Q....%A..../m.#....i...m.S..FB....LrtV.V.....q....#..c....a.O.i[.+A(.l.S#R.G.....%.....zZlPI.....n.....Lw...~..>-.aj....nsm..HG..........1t7...m.:.'E..<.s.mw..c8<v9.)f.vO.....tE..18>l.._.r..};l|l.v$.y...F..D.;:...XVVkT.....]...'.j.G.>..2.tH.......r.2./.f.O3..Z=.s..qz..D..9c....c.x..-.nZ.a.j.l..7...%h..p.g.....r.."U.7..hB.8aE.........R..b!lR.....-..`.%C_.V.+....9..ol...........<N..0...-... c.dL#..N#.{*||.....e...A..]y....9.V...n.S)Z.QQ.6...wN.c..%Se.^I...B..>...t.....).s.....{.-..1......B..9bH.=a..y..;.{......&R.O{}Af,.\*K.Y[.+.k.'J....v....R".R+4...%.9..'.g....c......S...H..Ddd<a.UH.#..7.v..=0..@..r.u,+...:F..-.F.|....6..8.g....Y'@..Bg.......s...]D.rw.....)..2\.......3t.Q......t.I..8O..- t..I<....A=..j..W....._9..v+./..*..,R+..e..p.....Q...~....3.

                            C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jtx.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):3145960
                            Entropy (8bit):2.450304034050898
                            Encrypted:false
                            SSDEEP:12288:qXSkcr5fNjDUt0xS1vApGy45EqpRkhNC0Brfk9FU9MxhfZzEsk2m:kcr5JJexBNuw0SuSfhk3
                            MD5:F344A65EA7FBD26FC170C9FBFB9ED3FF
                            SHA1:8057BABDAC52B242FA0868B7BD571F9CB264685C
                            SHA-256:B4E9104B9A70F55AFCD73CB62B7AB61C0B96FFBD17D752C20A14765FFA2D4DBD
                            SHA-512:1DC80CC72BF9B54E090387959C7426D3F0DDFFC2CBF3803EBFA7E2A502EFDB9555E5D832FFBD68B36EB12AC4FC6F6D1152C5771F0A880DE869C4DBA299053667
                            Malicious:false
                            Preview:.B.=G)xB(2Bd..t.Y..X#$../..3?B.2.."........l7.QS.os....wr.!.+.>N....~:N.=..NZR..2..u......'.^.....#.&..^.r......S..a+.&4.9.Pv...H.gn.`.T....w.TEHtcX....m..f]..5.Z...........+..z....g.!+g..&a...<..z....a]...+...q7..s.ei....5.7?..YC.Ub.@...e%...w.R...&.W|..^$.w.W'x.0.l...0@.;........).K7G..)...j.p....'.*l....{......#...7........j.[.o...D........`$Cp..H.)...s.4..._.......H..w..V..J....aR.. PO.B..K..GEcs.G........>Wr....i...'.w.DP.R.>.-.u.+.$.rJB..l...+|.y...j...5.......\.N...O#d.e%...H.%..5&5W`^i.@.{.t...6|..N.l....,.=/......iF...K...D.?7..o...0:).*..X...6./..0.....at.|..&.`.....o...._D.o.9.P..d...3a.e5.<...w....q..4u.Q.=.cw.../.ci...../..H*.x....;...05.2@......=..h........c..~.Px$.%cN....@.n...Y.......%../-.wJ.y.%...Y"..1.6P...?..bQy..n.V.$........5=T^..V...Tz=.B..7.-oC7.....!..q.y..s..9......{.c.0....,...)ew..~q..m.n.H5.W+rf.....?..|9..1......%....[..9.......pL.).7.....&.;l`>.......s.]q..qz......i.a.8.8...HJ.#.M....|..$.....N..~....I...-...

                            C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00001.jrs.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):3145968
                            Entropy (8bit):1.9765139376606466
                            Encrypted:false
                            SSDEEP:12288:kyxJg7gIFc/WQCmFWHMzHrrRC0rMaZSSJ01odBGbICCsoFIcgHw5GBu614:Ng7gI9mFEM5r9HQoXfzFIcbMu24
                            MD5:D1DC5106B5B70532376318EB9529B7E1
                            SHA1:4A549A4632D44154788311C155E81CD627FB1560
                            SHA-256:59B2406A752DD053640BD99950C6E96AB7BEC8B7EFDC4C307BA5E22F209351C5
                            SHA-512:20B008D22BA052959AC7FA27F7FAE868276094AFD2D733248B509FC1A802FBEFB2BF308DB62A348895CFC2C0DA01E3E27078CA2EA68D198E10649EC60933FF74
                            Malicious:false
                            Preview:....zo6d.QN..;.;...*..S'..+vE/.C{J.c....f...."..D...g..r.b..%......e......).8<.0.....W...%.D.<h>S...`;....i......?......Q.v..nO6.....(G.m7^&g..~s..%q'...'.7....K.-....j+..xv4....k..C..T..0D.i...O)U..2!.C.gX./....h.d.'.....\.L...]M....s.....;.m.n.a'..q.../....9r....{......3.W.f.....sp.{..6..Z...s%...}.......P..-......mc..>J.......%.]at..N.E...\l.....K...c.~0.0.L..,<.9...Q....^....=..R....K.?.u...g.5..cP.1-ZG..[......u.i.D..............G..2..5..H.;......U...d..=!.f.........\.H..BN.@...v..$.. ....[...g..%.....|a..\. Aw.].<..8...%....@.V.G.#r..........p.x.[...S N.....j*......<...:.N...wo...........Z.y+.(.LA1.S.fy......'..F.NVP..c.zM.+.w...[..2.$.......?.$J...U[U..^k......Q..5..#.....N.D.2..E(Z..>@s../.R....!....>r......^lf.......(..I.$......h..0.-K...-|oP.z...b.x.+".o2...Q.]..p.W$v.zW1s.x..;s."[...S'..W..,..`v..m.L...d....QDu.S.u%.3%.r..0.c>v....;.......<.x.CE.............e).{.M....@x.O....M...&..i!...W{...AD.u.*Da#..T.9..Ed...CzL}..\.Z

                            C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00002.jrs.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:OpenPGP Secret Key
                            Category:dropped
                            Size (bytes):3145968
                            Entropy (8bit):1.9763901118936225
                            Encrypted:false
                            SSDEEP:12288:JzC1sA/hKdyorwHB3Z5Q4RBozxU1G/Q2AVcoQ+11cZYdCCHH:Jz56cI0Y53RO1U1Go22t1cZyCCHH
                            MD5:4A0EB8004310047E673A52374A436C06
                            SHA1:D1A95DAC0A9FDC62E4EC4501DB066CE8D7508DD3
                            SHA-256:BDCD2AC46C3A4BF6E75303AAA6E175671EDB680A3F6AFCEE3B2019482A5DB216
                            SHA-512:D70651B5B2700947B6F45211F2C62B3E44E0EF57924D40A8D7469E0A5D025EB71DADB1D1A0D0E1AE157E103F4AD1A37B8B537BFBA070DD92772DBF682A08AFA8
                            Malicious:false
                            Preview:..w@........L.dN....W.3..L...:..}.......6_.~Zp.a.@.....G...d.r."q;.%o..%R.b..'..........4.6W..RwA..6^N.B.,.s'A..'l40!dI.k..Q.._H..KeBTVl.....A...Y6.$..y#v6u&.g.9$H.x...Q.....g.R.8.....AI...0.h..d..f..e.r3.{..(.Tr..#..p.f.tk.......1.....H%.S.j.U2.v....?..}.........E._.Ek..K..... .@..+. .BgF?K....=.s4v'?j!U3.W.!.#BI..>.~l.:.....o.....P..Mr._....J..drc0.%..W.......<2..$!..r.......K.t....l.^o.IX%c&..i)...!...S...1.g.g.p....W.._.....M>5.......=..........<.a.Z.8[].|...i:.h....g.........+m..+.i......d.Y....4SY..&Do.......(x...<...l....A,T...a.a..l.G`. ... .`....=.8eB..p@$..R....'?.....u.Fb;A*.."...Q...<.....H..3>....C....S~..........L$(u.D..VN~...[t.DyN..5...RO.]X.......6.5...wp;..........D..5.E..y.dO.3m:....Y..+.....;.).$b...Y..T...>...F.}....9..z.O.I-@...V.....0...W..Q.Z.v*.&8./t...../.1..^..0VRa...`......|.y.s>o.}|........(J=+w.Y"...)#TN."..&e..H.......\JP....qA_ .6. .....q.d....r.g.\...m.....%).X........GytKM.....j7z7.5...0?....?5.;|..?s.......

                            C:\Users\user\AppData\Local\Comms\UnistoreDB\USStmp.jtx.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):3145964
                            Entropy (8bit):1.9761965917642368
                            Encrypted:false
                            SSDEEP:12288:QSry/0PSRQYhRIa+/Pf1xosZ1Wuim9X9kO0o8U6bqbL3GzcPV:Qg1+hhRIa+/PfQc6OX9kOYbqbTAcPV
                            MD5:F3AFFB7FEC5DA635BCC1E1EBC5108665
                            SHA1:C5CC66B6D3BE82762955CCB0A293808798CFCF7E
                            SHA-256:3D81C89EE73FDD0E6FE65BD4CDA82F88FC0F56B9B541A43B12326D690977C71E
                            SHA-512:2A552C2C506F50B3935D10228511C0FFCD97B236432C695E07F5D1871D606B66878A0F10DECDDEB482D318AB2AAA6DFFD1D07E71ACA79960F4299244035F6891
                            Malicious:false
                            Preview:.<;..t.."..*.'....:A+.WCJU.L.5....;.......Wm.\R..?...._.l........A..^.p..LPq.m.D.{...Yqj.G..@..6qg.3f.e...Q.C.A4DY.8...X..|..l.7..3...3.+.g....L.GD.p.[.G.J...)F..j.p .L..".F..<.U..x..N...M+.Q....'+%.....5C.1..R.)...(..KK..z4p.....4.(..Sa..8K...xP.4.Z.ml..E..g.y.M.....7.....7.:..../.....B|...1".L...In..0.;6T...n$.P.R.2M.u...C..^.,.}.F......S..7.".9....Y.R...H{>..'.g'..;....H.,.....L.....CV...?.S.!.(.`...J#C..+.......*..U....}....E.%.L. .0*bnI1;.(R..9..........o`...2d....%.R..z<...U&.+.$='.(wVx..o.=x-..,....U.rL.D.U<...fap...X_..V[0....@4.(.."....9$<..Ek?.t.G.a.V..sE..*..^.M/.m.b..).l.Z:.x'h..;4'.....#"...pP.......F.l[-.......@...7.d?....~..&?.%r........jHz%>.....j/%...<.4b...r..K..P.a..F....B..[.u^4.b.p.?.....e.......>l.D...q{.>.A.E....8..q...m..a...-........a.n.....0.......qrl:bhN......[.vD...}U.J&..I.....'8#..o`.. ... .Ho.9G......@.A.].i.d....Z4.=9....K......}.*$.a.....Zk..+.]H.u.....4.:S.2.P.=.d..z=........N.....r|r...Ji..9.....

                            C:\Users\user\AppData\Local\Comms\UnistoreDB\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Comms\UnistoreDB\store.jfm.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):16621
                            Entropy (8bit):7.988832059776782
                            Encrypted:false
                            SSDEEP:384:qlSpD/FOtOI+ZCB8nPpC3DLdDnUA88fQfPBrjE4d85S8/iOeUB:qkOnB0RyPdrb88EhjJdh8/iOdB
                            MD5:E06BF6FD855BEFC43D9590B55AC38523
                            SHA1:00B4146A60C340139C5A46FE7F30EC6CF92D8985
                            SHA-256:48955C41C718A6CDDB80F3DDDAE5F26277573EAED3B00281D2FBEFF63F0F0A8E
                            SHA-512:E4AAADE89731D6C7CC13CB526F1A5FBAE7DA4EABC3B866DDBA9065F050688C93B6C844F1BF746780D215302AFA42D9D96B9DBF8404D128AD8A0B992A6FA9A558
                            Malicious:false
                            Preview:.A~k....PH.N:{..^...xf.$4...2...5...0..@..{...y....+...XC.lc......#...d.tu0($X@.Q.].....ub....-.F5.....S....A.......3..`o.f..'..w.a F;.~_w..L.,D..Bs........._...y....Cw..._.../.J........i..;.......I1....~....u.....a/...}..T.N"K....{^...V..'.W...F...lp.....L...9~.Uho....^..^q.+}....]..`i..........x[Z.C...Ai9._.o.....E.<.IDhf.Z..`.7.$...`J.h9F.....C.....I..Hmw.%.q.-R}.....hT.6.F~nBLU.T..).J@E<...Oj..J.....h..M..#+...z.....q.s1.0zr..m.[..a..%.Z.?.y..lU...0'..8x!`..Lvl..Vr..p..&....A...R.E..\.R...r....5(..xTm.M................#....].'m(....l^..1..oW7....8.....r...+..".F.y:.D.....C....m.b.TI.....F.O.,..I{..Sx...B...k.........?.2`..y8d..g.3+......3!.PM_Y.TpWm.D..0.K..e&A-.w.zV......7....;5m..H....%g..?Q...S...].p..N..i.u+..99.4[..+.8kY.T.f...1.sN.Nr..+....K..J..)y...._R..O.z.tVqH........qQ]l..&....*.y./.X6...PX._.P%._.6/_[..x...o..=..$....m.+.I.0. )....yM.......`A...)...{.[....Fj.=6D.l..1 T..xa.m{..a.t..Ym...^L.n".(.........0.^..vt.t;..#..15v.O-.YO

                            C:\Users\user\AppData\Local\Comms\UnistoreDB\store.vol.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):5767404
                            Entropy (8bit):1.3967398970277485
                            Encrypted:false
                            SSDEEP:12288:3OR45Gnzs2Bk8TdvwafDXydezx+GHAXyVE+CK3MLaJ8uuLy7p0Rdb0r:3OR40g2ByazFhjE+CiMcb0RG
                            MD5:8AEC1831E8B9872E7A170F555B557D20
                            SHA1:4C9E740D58AFD4B23EB66C415E1A298346D3270D
                            SHA-256:13A7E9E1F316672DE048FB6ADFDA7F6021FF6FCC8072E4897094BA3197666668
                            SHA-512:6A30E20213DD792647B9021A2901F3834965E504DC54388CD0A6A6366953A7DB5F6B7C447E7067AFC963106E6F8DC575C33866E34CE0A518689390C569AC63E7
                            Malicious:false
                            Preview:t...].....jb:.h...T..T`a.d..i..&.@.3.|o.........Nr....S.......id.....)H>.."....x.Z.NT..Z..m..r...G.<..Z;y.....&",..<=....U...u.IHi.L.:..Fcn..+.......L..N..V...Bll...>Tv[s..~d"h.I.v;.[!...lF...!K..m.....f..X...A...........Y...c....?.....%..&...a....b.t1....+.....LO.-.o....4._L....c..?.....L.._Y......6.._.w9,eG.p#..P|..DM.^.VzYN*.......]|{$C...<.8'........@I...0......V'....h..}....V..h...}....%.~9.X.=.6...'........v..@......cz..p`.}....^.._M.`..Ec.u.7...8R.......!.H...{..$...}.....1#bp.`<VC...@..b.R...a...5.[..y.~d...[... ./NMq.c...X1.....|.....t....L&.p.....m."...#...v.+....Yx......w&.c]8..2.{.#h"..g,../...R1=....tw.."6....p.=q>q...2.....#...g.....J...=#.L.X79..DK..^..+.~.C./K..:..dD..O.z..].j....{...k"....Y!B...Lgy*..c.q.M!..W~2..E.x.F.n|;sm...z~..\.:..>.....@A...h...T}Y..V..1>W...h.'a...!X.!.[....`.Wy.M.m;EaE{9V.....Z...R......6....P1.e.l..Av@..s .D.......<.6.._.E.._O.T....*..r|H.C\R4.G.`...........Rew-.9...F.m..HI..p.f..]y..&..qj..U

                            C:\Users\user\AppData\Local\Comms\Unistore\data\AggregateCache.uca.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):248
                            Entropy (8bit):7.200837086448252
                            Encrypted:false
                            SSDEEP:6:MhXsBgEZdLPrSUcPo8aC6ztDsY80T/f/9FZtOoRg:MK/awFCRYTT/N3tJRg
                            MD5:D18C6837B51734B017A59E06FB49E217
                            SHA1:F976DAA69E91CA63F2ACA7DC5A108F4D49FFE7DF
                            SHA-256:6E2C2D1D5A2477D5E5FBCB00F185FBAA4062FC280AA955C895D91AA7EF2C3A12
                            SHA-512:26C70EC4DBD183BD003704EA25F4F611C5B2951BD07D2E5B53A8F97000E593895DA1FC6128876D32252548C09A92FA0B82BFED8964B2C83C21C5D5E458B2D704
                            Malicious:false
                            Preview:..Y.cD.S.[.G.o$.:.-..y.....a...$e..B..`(7.....R.,.+..).....t5.oPO.+S....0.Z...r.w...M...2...t.g.....k8....h..n.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Comms\Unistore\data\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Comms\Unistore\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Comms\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):5121
                            Entropy (8bit):7.967886661165355
                            Encrypted:false
                            SSDEEP:96:ijSZZlIRapYTf04atq0Gp2mZsbFb1PZsKjz6OvO:Tx7vGp2wsdfz5vO
                            MD5:43A27E53889B0320EA516D3850E868A0
                            SHA1:8552507F9600A3630171C80CE0AF67ECA34AD0B6
                            SHA-256:2BD02C4EF08D7CE2E861A470102AC80BE66188DDD7D0D33D081C1C599931EB01
                            SHA-512:0E24A42206967C54311EFC8BE84422D0D7DA0D39283C898433C319B0E907F8185AB410872EF2A78981B9FB5C3A1CC09E4ED5923F5DBE47CF18F009E07E039FA0
                            Malicious:false
                            Preview:`......P......:..(7a/MV...X(.9^...~....g.>.N..:l*.....-.5s'C"..jl0.Z:..i......|.F...,Y..<..\.?]..k...}P..#.8y.hr...H.G...........V%n....A.E]_...2.....(.L..(5g.....x.....h"0..g4..Y.S..7.ZRi......j.E.J..VSp.?.BN1q..7.v.@....#R..fe#..72ze4..:..A<.x.3.D........0...EF#..5.......H.]d.......M.d..\.1.{b`........,..g.O3..".....&?.yE+..........7".........5..s.'fB\j..w..&..0o.K;.....}....LO....rh.o.G..".k...q6.IKNU*.A.l...5_(....oH.-....U..`..t..N......T.K..rkm.y....'.7.......V..z.|.d..?..<E...N/..n...aa.Y..V..`.C#/.."...2.U..+.&n...!.l......b..'.......u...].K".........E..c.S,..........u...X.+..Fh.b........H.....:.9.X.^Q..#..R.\.......(7......^..^o...."r.......v<..V.6.........u...|..Y..F..h`.....4..$.\.7..u4cj..m7...I.\Zj:E.Y.n.G.........H.3M|....b.%..e.X.,.L.p...!...........h9TX..."R2P......2..1..BDS...2Ih..X...m......g.......?.......n.N..w.+.H~.......H...w.O.,... .S.....{..(.....f.J.K.hU..z*...)..k.8.;....4..q...w.,..w....zK.P-..f....... ..b..

                            C:\Users\user\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):933
                            Entropy (8bit):7.763779195216599
                            Encrypted:false
                            SSDEEP:24:dXyjEQssUpUHyMV1JKzXfv91YFofxwbqYTT9TRg:AIuSe1snbYDXTk
                            MD5:DDDEB5B36AD2117F5D8624D2A39A1340
                            SHA1:F3B4E3B9852B88B119FAF656C1CA16061F0AEF9B
                            SHA-256:7B90C6D59D27ADC2DD577218A89855D9698E92145CEAD46D89E1B371670DB0C4
                            SHA-512:5C201A6C7F23F9AD8D33AEBA065CF5023CD635A2868E8BA6B00C8127259235BEE0A192AB0EFE137F167C9D18F52FD7035EC157D59DE8B43945629FFEFAE06334
                            Malicious:false
                            Preview:)./.X..^.f..<G....FY....*..../..l.]......0....G..+'.....j...h...R..i.C.V.p..SM......xL.......;..o.$...:.......hvH.|..3l.......<....3.q.....oo.d..q....'.....H.f......5.....b:..*.8...1G.7......kEX.T..TuTR...v!Q.....6).e:..JA.R..f...4..C...z.^.&...e..w...o.Q0.t.......t=(.Z.fOW..S....,..m{;..P.../......rvK...S>..B...0..2..bRv.).i4o/v....#..C.j...k4..f.o|R....;.....f..[z.q..G..S7A...|8..r..6......_.6...eo".\\...4."..&....n...ElpH...|..O.kJ.?..!.L.K....A..r..t7..m.....8.T)..._d..|f.s..p..O.4x.......T...=A..8....i.U..^l...#....&...2DV....K.%.c.J.].sI.2..p.D.q.5!'.#......2x{.QK..j.n.7...........b'.* .U.|-..C"@.aK)=..N.....}aD.}...G.m.....C$....R.Pm.)M..!.]Nn.*.\,.z./..A........4b...t.!.W..@..3.,(.........4..zY.. 1....;.....s....O.@.!..)QH..#.T(_.,.".H....I......I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdp.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1211
                            Entropy (8bit):7.832427307867257
                            Encrypted:false
                            SSDEEP:24:ibaNRVCgFTlLG/G9mMcyR+5pFHKCiWYQFX/qQLCbL0HYTT9TRg:ibaNeulLG/emlyR+5nqwYcr204Tk
                            MD5:A25FAFD5D3F59B782A2AD4DE5644DA9F
                            SHA1:D1E6CD508F0EE23FE5FF33D722CE9ED9A016FF64
                            SHA-256:9E3A65B378F9EE924581692A18DCB02DD520B861DDB692FFF04A047EE6B6A443
                            SHA-512:0F2CD2F7E7733E5686A37CD34C32DBF2229ED1B3F8520338212CC66127819C1AB50346AEDE4AE8E7075DB7AA1029139871F52591C17A43A3E78C72F9EF96C1CC
                            Malicious:false
                            Preview:.zXX[>..0D...H.]4..%.\6..am.W..J.2...f+.}].2.q-.Pse...S"N..pc.....^."~..b.c..K...0x.'.QdU..+..4..(a.T..g-6.\..G..$O...m.....<.K....03..vg.....O...._[..2h.o.U@%.K..jc..r...n3tb*|.;H....sU......v..g ..L...x9DH'.M.K...~...?%..O..Q.E..O....s...M...?E.xb6..d]...3.i|1.j.G|.A.....N...-/>.yL..8=.(..[_@i......OJ7...=42w...(h....L0..bY...{_0[..;..B...Q...U.w...._uL..F...\0$H.G...p.[...jun.-b.a4}o7..C.[...(.`r....t.pY.$..r...A..T.]"@.}o.:TU........K....h...P&\.....?...`....[U.hT.......]...<.)v-.P.8F..... .....2..d<L..N.-..VN.6xa.b.&...sWO.....+...Yz.(...D..((...+.w......0..J..+......j._.t..<w/#.W.6..h..28.7O.J......yT.....g.:N..y....X..Cb.`..../.6.\..`j..[...2...eEd9.629.-....[.p...,m|s..z....}^|.e.f..cY+.#.....w.......|}.l.UMs`.;...=Y..8QG...%".;../..V....fY/.....<.....gQ.C<E.1H..JQ]ybI.l.._..4.._....@..s....._Lc..8.S........d)..r*U..T.{.N.c..M ...O%..A.).c.o...g...."..}}..%e..x........"2.Y.;n..'.A~ek...y..PS.XnD.}...r.I.X...H....u.@.$y..

                            C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdpresource.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):306
                            Entropy (8bit):7.284097627017919
                            Encrypted:false
                            SSDEEP:6:iQrdtKCS9aM5V4CuH1sF2s8SvAfoyN73HnPo8aC6ztDsY80T/f/9FZtOoRg:FrP/S9Z5gHa8djAuXnwFCRYTT/N3tJRg
                            MD5:177FD440D1DBD057F1F1A0B161BD660F
                            SHA1:C8FD60A06152F9DE7AC2D89C193FFD5D566457C9
                            SHA-256:A102485C5CBA6661A1561DF2BE425657A3E96779921C681F008EF3ED628FF077
                            SHA-512:C8EC4E0A4DE855FE70D24632404F632C0DD446763F6E6B86B998375FC6D8D1A83F3480D73BEFB64EA41A4FD7791A6430E169ACF9A07E7BAD51962AF68C992D33
                            Malicious:false
                            Preview:-...'...^. ...v...a..tnV..-..T.X.../r.p..jS..;z...~.nD.}...r.I.X...H......%.....!Y..(.....R.,d.t.#......IKzE_#.m...g| F.Z.I..4~.....y..Ja.zXW........T).(..&.2..O...v.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db-shm.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):33022
                            Entropy (8bit):7.994519299376389
                            Encrypted:true
                            SSDEEP:768:wvUMqYlgG8ssqetERtNjygNfwd2dOlC205Zvb+Hg:w8/Uet+j7N40Ag2059+A
                            MD5:5DBE87D26D4A37FD9F64162D2A027C82
                            SHA1:A23642A7EFC151F4C7298BEEEA80FA9C93EC4401
                            SHA-256:ED348D756790678D0A1B4540A92B5F87820DF218445AD131CF25CDE28F931642
                            SHA-512:ED640FBFC9FC199F2530CA9002705A179D84A5AA06923DCFE9B114CF81872AE560ADF14D45C16B2FFA0890C11CC8D11325C45B6706EF74E995DF86743026D4F5
                            Malicious:true
                            Preview:[.{;.....oj%........r.f./^.....@CP....$...=..k..+....hq..6.@..U.........,h..5.c...)....@.5..+..c..J.y...e.|.1<...$...<Y...,.Ap..E..HI5...L...,..c../.8.......z.Y...e..(2..+......}9.....8?.\...c. .F...&...B..1y....Br9%...e.'}.....=....G(....i.u.>.........."K.....0.....$..V.(.!.<..m......5S.........&G.X.-..1..[..-N.E..a.Y.S...'."..d..).l..e.$.-.B*....zj*.P"..gF.i....u.......S.Q.^I.stc.....-....p..;\:eL..R...3.)^.AP.1.=q(......VC.9...o1.~..g.&.<1..,..f.1...x..l...eW..,... b..J$wR._.V..-....I.l.M......^....h..7..W.X.....]V0.:..P`.bF'r(...l....&..s...wwX....Wz.....)x<Bx...>R..`'.%...Z....fx..=...(lWCS.....]+,..D.|........C..!..0...]5..p.....Z..L..a...Ygg)|)....c...j...x.-{A$... ...jo.p.6G......kv.J.4.S+..........m..4..gB......n.5Cy^...)T.P.......K....bC.jkd.%fg...m.pw..0Kb.:.X1E..`}.>.....S(.s....N..}......|..L5.8p.{. O.xM77.B..|.U .Dm|=5...4.(..x.W......$sg....;./#A.....T).l.[..z...t.$o.......T.<..S.\q(R......J..3w.......=.E}.j.

                            C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db-wal.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):255
                            Entropy (8bit):7.083306256497522
                            Encrypted:false
                            SSDEEP:6:SgUm+wFScDFLrn/YGN3siIvDyicPo8aC6ztDsY80T/f/9FZtOoRg:SgR+6SyFLrnwNLZcwFCRYTT/N3tJRg
                            MD5:6D5F2A598C125027A27E5921712DE393
                            SHA1:9D9946C7DE2A83A1A7DE4EF4A25F8B48536E5E7F
                            SHA-256:DAE9258890D90094D495DAC04EB894F86CF41B7193EB26C51A840AD5EF50DEDB
                            SHA-512:9E28E1087BEB2FF06EEC67F7A8E118B0F57D2A2FD590DDC52A41DF4D6593265704F4173D3516F6CA1142210E9BBF3313161EAFEA906FD6C547C38BAD8FC513F8
                            Malicious:false
                            Preview:cD.}...b....V].#uz...n&xz....q7...5v......,g.t. ....&...oa .Z..m.xc.0.xx...Y/q8.y...rL.8O...\{..sW.~p.f..H.....jOS.Sqy.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1048824
                            Entropy (8bit):4.9821912562107675
                            Encrypted:false
                            SSDEEP:12288:xS5Koy4w9Pk8ZiayqLVHK0UohjqF/oZd7VUorDvlQ72RgoUPyNRe086z:+w9PDNX54ohjcq7VUgD9VRQPym08g
                            MD5:A51478147A54BD330284ECBB7CD050B3
                            SHA1:2EB42902EC1FCB0F817CCB305D19B0A7CB729026
                            SHA-256:60686B465ED4428E73B493931607962823E178F250198EBDE96E6FC2ADDF7423
                            SHA-512:0A17EC2E3A9958B509CDE7D30A70CA11B63109A91866D59E1790BE188D9F30036D8BC7CDF47F56E72EC3D9FBA78553944665256F6075717D0F9529BE6FDDAAC1
                            Malicious:false
                            Preview:r...t.M.$...t..._.y.&\h..v....E..0.."V.[......0.e.bk.q*=..Yr.&`y.@c.7.X...}.$!.eq...l......0e..a..xG..l.9...~.j......d.J.i{V.8C5.h.2v.FJ..gI..:..|FM..e...=..a...4..Rb.|...,.bMON+'.[<....k.S.ux...i:5...}.8....waA.e..?.....6..rk~..M.Er"...8.......\_.$L$.c.PNI..!y.....,L,'q..2.s\..F...)a"8..k......s.n@.8._;].....=Ug?.n..'..DyD0...cw]JI0..u.\Bo...F._.RY...d)[./N..".]......}^.....m.FM]b.{..1.Q...Re...d..M.........iQ...i#..%.2......%......+...uA...K.c.D}..\....0.."}....K.$.$.u(.].@.g...n....9#nFL.:p.E....,.9..0.>Br...m%..j..+lb..V..Cd.,.n.q>.i.._.$.A^..5.........~..#1.6a....F,7.... ..i.*....n.3....e..R..v.....w..|N.6e@.aZ]....t4A.y......?'..8.6.o..}....OWxHQ .<PR...._.{}.7..9.C..c...\....x^c.XN.......>..F.....\l.{ev%V.#......B.H..:...........t..@.5d.i..58.Cb..X.z.E..l..:.=.tU..F. ..A^J.W'._.....S.......z..GI..........U.bF6K..l`W.ZF.d..n.z..w.*W..6t...-..m[/..p....R...%..b&......m.~p;,..*.`.~3I..q.O..B...r..S....t..wR...t..V${...ws....7......aKuZ.C[*../.+

                            C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\ConnectedDevicesPlatform\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\D3DSCache\f4d41c5d09ae781\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):65536
                            Entropy (8bit):0.2907898055015063
                            Encrypted:false
                            SSDEEP:24:kKsjBRi0GfP/pLCA+c0NYtMEWo247vcZA9ul/dHcCPFWoUKSYTT9TR:oBRixfP99+DYMpolgZAgl/dHcMFpPT
                            MD5:B7085F0FE86F743F8FF6E30522412FF9
                            SHA1:C79C5F9579A06B6B920E9ED0829B5E834A985394
                            SHA-256:4B6F89BFED7667E4C4BA3356E78B7097FD14CC2BE88A2BE672F0A307F0BDF30E
                            SHA-512:6A251107BAB5E52C86C6460164DE6AED3AB3FF87789F08238623E511C2498DA7847A3088A2D2831704D22D4067F277E7B27EF158EB6B777372CD516E7AA3EF7D
                            Malicious:false
                            Preview:.Zp...G.... ..>.....\.R6e%D.?I....9t{.I..o..w...k.m....c...G.<....|.4......Mb...k.ni...#...m.|....],.i(.Vc....A.9....y...MA......K.Mk....$.^2.dY.|.....</!.r..-...=...JF.f.J...]f..Lf.<tM..@;h./{....J..a....-&.....;...V3.4+6O.+...<[.....L.7..{-....sB....J...,.n...~=..=..Q.&.T...q#...w.E.x.1>o......P...m.....xz......a5.z..x.Spx.Q.Zi...,:I9........\....ZwV4..Bb...*...g..<,E..<.......e.`.o'..W...Aev.5M....t=-...A.='8..k,....A*..._1..R...?...+...&..6~...$.0-...x...P.!..T.2.....%..L.........4.....&....c..7.lV.e!.[m ../..=.*b..>....E$:^.U.........G.7U....c....J.+.z9-......=K.{......S...q.u..u...4d....fm^...,w.u....)8....J.]... .......,.....~d.4.H.}..{.U.Xs.u|.T..*.n....Ec......r.%..z.3p..,K..._..B.W....$@........8.@..<.......h..UA.t..Bl..y?..0px0....).....]..m;1B.0.y..l..:....E..!D........i.~...#0q..LNh......cK...........T......SQO..-...3o...o..8.pR!.....h.G..n.0...3..~.e.....p..!...].....R3....M..\s...>/Qe..~.......G.G...6

                            C:\Users\user\AppData\Local\D3DSCache\f4d41c5d09ae781\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\D3DSCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\AutofillStates\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-651D6B39-2380.pma.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:OpenPGP Secret Key
                            Category:dropped
                            Size (bytes):4194576
                            Entropy (8bit):1.5382417150973435
                            Encrypted:false
                            SSDEEP:12288:PsbCC3WDX7Bc8JwBaqpCYVHAi0sUJKBzCAk4C0jNxf64jcvKMaQ:SYju13i7KBeM7i4jG1
                            MD5:8774CF9CAA7822FAAFCB9C82E73A5D12
                            SHA1:885700BC044A8688F8D336D0F6508B2FC499256D
                            SHA-256:E31E4DA5B205B54E28DC0F9674F40421C8B523E1C334C0A558BB98642760BC75
                            SHA-512:DE1E433B200F6FCE329226D310B7894F86D2132D421C9006A6AF4606028BB43D72B84FB5344BBC5A3763C8F52162B649E1E80D3E7C83F93DD77DD0B0624048B5
                            Malicious:false
                            Preview:..........m..|$@X.....N.sI.r...<.8.,U.L).-.....IP...lc9..8S.,..............O.Y.,.XF...J.l.^..-.....O..k../l......-.7.$)..)..0Xh..f..AsU.k......X..].r..&#...=.......<.M....D..p...pk.I0.D...............U7!+.]...'/.<..ox...y....S$......P.$x.........4..j$M.\..!.N..9.[...<.v.........6...T..U..}Ss.l..#.l.6.i..7....`...+}&...aM.......f..r..v...N..1.T.Z...=...}.`.+.."...?.(.NA..d8.$&.@.....:...[c..s.Zk.b...Z.0.....z..tX&......I.h.MY.Y..8jZR.Rr.......z.o3d...D.].....#.t......x.A>_\K....F.y.........A.]...,..n..O...I.x..^`........E....0..0.u[.KW|d.St....{p....W.....7...GV..F.B&.....3..+.<...0DqG.$..3.xg._.....R.(....*!.@<........I.K.Tx8..'Z.l.m....z..!.X.".k..4.9.....m48..D.....D.e.H.P$.......e.,o.(.)....6..\..9Y.(.........q.'FGcW..Y0..1....*J.$..j.@.aW.~0..=.r...+..p...-...nz...l......{..v.L...vLf...}..e..d.G.......s.M1.?.J9j....p..z0.....u..V..I.3z=..Q[.,..{.Mi+"....-..C._).......Sh._....(......T.b...&.._.....HY.t%....(3..}.....Q.........C.....

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\CertificateRevocation\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\attachments\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\reports\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):279
                            Entropy (8bit):7.135044240088886
                            Encrypted:false
                            SSDEEP:6:s2E49IzCMNwFlhmqAnIC6CW2TbzTPo8aC6ztDsY80T/f/9FZtOoRg:suWCMiFlhmTICRx/nwFCRYTT/N3tJRg
                            MD5:A7E8A83960056BC8404FF4B288A8BDDD
                            SHA1:73BAE29A40D1B01EA0C56B4E5F786D32996DEDD1
                            SHA-256:816275072E9E375A8CE1B0140425886236FCCB831687710611775DBDE88C0F37
                            SHA-512:8BAF38BCD26549FB43D60E3FCD126FC6D0703AC9A805A139FECBC388295DC27FA7901329C6A5C1063D7058EB2317B7528D0F22149AB5E40C9ED1A7B180BFB85E
                            Malicious:false
                            Preview:..<}$..D..._..1.Q{,=.rD...a..].>[.ha0.QD.}...K.`...@..'....`.@.vy..B@.`(7.....x.D0..m....l...].RZBLs..]!mc00....F.f.=..Dz.Qh......._..:.X..i.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\Crowd Deny\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\FileTypePolicies\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\FirstPartySetsPreloaded\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8422
                            Entropy (8bit):7.976925251257373
                            Encrypted:false
                            SSDEEP:192:ocAhmr+ZOdGurC45rtvot03gfM57JGIDTx1n6gQL5gAxbxp/vaOf:5VyM9CeANMNDHJE5F9Zf
                            MD5:0B83322591D2B781BCD55510A1314F71
                            SHA1:5BA462091637B41E33A5883D3CFE496A250F2313
                            SHA-256:18D2E42248BD8785F9C7BDB8375A1EBAE6BBE8B98510706A4D2617B4A6A2D01D
                            SHA-512:13BB25DE45DBE54539487D88207533467C00A92687B57DF1ECA82F15B9A38F06F1733E87B6B6524CF337CED94652F14B56ABE6BD2963CCF21243397F5ECDFE0E
                            Malicious:false
                            Preview:......;.B>....1..=.NC".C.....BU..,.4..D.-.:....+d.RK%........t.....-.m..@.%Rs?8R.)A}.....;.h#b....t"t..;...-R._.4R..u...j..LE.....0.`h38.\...0.....*z.....h..Z|..Ex..6u....DF.(..>0SD}..{Y.>{AH@0+b..8.t1.C>....L........dn.3T...=b..I...w...e.2.|..O..|....2w*.....'mp..!..`..G.\......;..Z. ...,..;.BKK.UJ..[.YS.|]-e7.?.V..nx....#.b..[.v.........I=X..R.}.8.4...@Ec...I..>.2..<....77.gS.P.........*Z],V.*.v!.ut....WD X.g...Z..2.<WNI.dO..~F..6..K..q .l.]..F.~.]5......X.e....BE..........".Bg..4.+.#..J.}..$..,..~.......j.t..$l.'..=...........~..p......-.........r.......5uU...a+.J.....h....1..Y.e2...Db.W...H.B7..x..I5.;~....)*.4.-j..^f.....sN.D..6..MC1.*D...#..K......].G.I`3X....K...':...m...^.G....9.\..r..Y.....\....L,..a.7.,..EC_....;.:...V.......5.Q(q^.J.....p*K"...u;./.2jS1.\S....7;...^e....f.........<~ .+?.1.6...~.....C.@...%M.^%.V.L..U/.1....."R.s\.>Cp...:..8m...F...F.7$.0...+.....gW...Q.?..jBYi......U6.Y....=....9..9.....C.k.k..U.}V........k.b$...

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):270566
                            Entropy (8bit):7.999364413388287
                            Encrypted:true
                            SSDEEP:6144:nIeDuPh9L/3ooza3BysB89uS6sgjMtjbdi5YflaQYPkDRZ3xXqNo9nkN1x:imoG3EgSdgjMtjYBPk1ZB4o9nc1x
                            MD5:B59E83B78761DAF3665B6E3D6C3342A5
                            SHA1:9CAC76892A96CF383A8C9DD7F515B5D6EDF9721D
                            SHA-256:DCDC151E93036673992722FDD20DA106648423B18EC2F4DD5AD1F96AAA74F0DD
                            SHA-512:959DB600CA01D27CA3099E7CEEBE72D771BD9BB28ED373051CE5F111AA3A1B20CE51C65EDEB21300980C4F6381F6641500297A71B0B07F9F89E00E6E92E5A5FF
                            Malicious:true
                            Preview:..#.|3.....L.U<.I...v.]g..Y/.3 .....7.n...t T'..^.... /..j..Y.m\..z`..=S{..!o.1S_.U.I@..u.M).^f...Ep.]{r..H}.x.._..N?.K:6U.H.|?#.C.......^.^...H..B..P.B..tt'(!.`.J.........).....tD..........^....|.....z...jc..{2.B.EF>Y...Z}R...A....I.I...`Bh...._.......$Z-..>..mdS=....:.mrm=..~<;....CO/.R~....! .E..X....V.{?df.Q.E*O.P58]...f...{.=...<@...A.m.<......\.+.w.p#.'Z.._S......!..Q.L...B.......J....|..J.....:.].....Jf.....d..H..5\./wEnS...z........s...S.6...N.A..;..d.[.Q....a....t..Ez!....h.r..j...3.5Q....B..d..eY..]`.;.`Y.bM....i...w..9+,...B.k...m..eUo]..%Z..Q.....E.......j....tO".oH.{+..A.....3.@.f......j.3.G.i5O..o..\[.J..3i3.).....yL.~.gs|.7'..=...&j.j%..h....Da..............0.m..!,.p.@z14'..g2a...h.E.7M..oX&..l.a..*...[.Q.%.1G.9.R..N.aI...g...U...|.J.n.........M. ....^...N...V'N...-....a......]..\..D#.Xt....e...t...s.Q.*.....yy&....tS..3x.P.,..q..k..w.....A.G..$..Ql...4t>..L.P..T.y..T...8..0.~.t.........C..d.h.l.~i...'.E.......}.#..4{bp

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_2.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8422
                            Entropy (8bit):7.978654328934113
                            Encrypted:false
                            SSDEEP:192:JYSOpVBh38OHNTh9v4MHUrkQPFTehfAuOGu1UDVd:Ji5vtd1i9NOAu/DVd
                            MD5:DA1101BD44547E45BECAA6DADF509FE7
                            SHA1:9E5A647EFE8E49F2EF371D026A3906F59DFA76D8
                            SHA-256:36E3718F3EEB496539ADEE6F0C2C8C9329410C47339600F1C11BAC973C098757
                            SHA-512:CC697F60F0A978F3F747255BE1E024774940EC7D7BFB724D2730D402374A85B76E6473C7F217AE989E1E636424E570CCBEA2FC4DEFB7DD1980064D2B0C67C94C
                            Malicious:false
                            Preview:q.._...|5<....U.uC.-Y...Bn.M..x.%..........=.Oz!.P.@....V.w....W.......z.z...}a....4.1.!...F..LxLE$.){..\+..w#...<5Y.'F.....u.......[...U.n`8.%....=H..|..u..|M\.q.v..[..B.v`i....f...j...{.fh..jM.n..J.r.?-.#.>.I......I...._.7..F0s.z...Rf.Vu0..Ri.U....Rhv...>#..........UD...gXk..^.....).J..3._f..A..J.~.....D.....C....uG.&U.........e...]...8o9..e..h..Fw4j.|.-....e.....f\..'...k...I.....g.{I...t..g.v..}.Fk..IT.`...........+0.<>..v..............h..N(..r.K...a.Z.Fg...s..n.A6.........x..D...;.....q.l(u.;%N?...*B.]../..........Vz.^C.o).....4s..k.u.w...q...r...O...1j.$."C...'..u.....@..U.>g...p.q...+p*....)..i.....k..1...X...@q..w5S..A.?..3. ...2..].P@..5..h<..E....t5.Ds.-s.O.....'W.Z^...g4..<...pjI.CVPJ...hW.9...]...*..Bp$....#Q..T.s..xW..G.h..[.D.}.R....|..E....F.q.O..n.2..:...@....K.....~q.I.9.w.....;.Z.'...t...s...eJ.t.%..|..iGGO.....DjB....k.:.q(..........N.....T.C<.4...*..s.."&&.....h.|....>......K..ib &.T"v..!..+\...y.F...[T..0..J

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:OpenPGP Public Key
                            Category:dropped
                            Size (bytes):8422
                            Entropy (8bit):7.976607427834364
                            Encrypted:false
                            SSDEEP:192:szuqsszYZgdFsUI/sA+s9yp0Ithv0JHNigx5RC0gBtJ6F/Ahe7Rr:szRssEESrsA+s9+0Ithv4igx5RC02Ohn
                            MD5:DEDE2D17E6FEEFFFD71F1BEF3BA37C47
                            SHA1:4547BD9D66B2583AB26C415F48C99B57A9CB331B
                            SHA-256:742ABBBF8B898BACA3FE57006CE34EC6BF66F39AC4B95759BD1672E7EFE5AFA1
                            SHA-512:3E5399E1CE2D21681F84156EE5C93ACD9104805305B6D900D7F0E194637CB281A053D267CFB150F4FC25CEF3B43A5E46EB3A8653476CD1C8ADED9326913A41DA
                            Malicious:false
                            Preview:.F>...0..s.dF..b....M.F:.....P.r.....C<..&u..\.=.....0..I..a7)1.t.N.0......].za.A_g..............6...;u.....L.S0Pi2.".H?...a..x...Q......w..D~u..Ne.A. .4.D.&..\...6..X\M.....#.#.Q..$.X....v....k.....1.L...?./.._[..^.jz.<....&....c.1..._c.....,?..d ..X..//.|M@d..Vj.....M.{.;eC.....F%."a.S.....3./.I.........3PY.uc^{.w..rB|.m.....+."D..i...L.........XK....Q...;z..E.../^...9.%T.*L.-.8.&T..6./..q_>...L.........D..P...6..7.B..)!...$wPHN,E.t.W:.mIxD\18..c..y.......E.S0..0......m.2.aem.Y1..'.N...r.x.7(.....^(&]..>....F.!.*.....3.......~3.WC7...\B.KJc.:..R.c8V.8..>,...42.[....j.........t+..R.>..D..pF..L*.M..g...)1M..,.R&.82w.Py..J|%D.o.2...5......-....._'T..$LXF.....X*.I^+V*D..Jjcnub..~......f....4...5.......h..b.<k...R-t.....=.6$t.b/E.....B..g6.M.H\.Vc.nH.........y.....K...!@./Tx...6..."f.Yg.5....|..I.!_H...)....4..R..-0^....<.B...UM.6PW...Vz9.m.Z.sK...,....q...'.".OC......M'.1.n..i.C.w.:.}9...\M.7.........8.u$.QT......,......[m.f.s.F.!.80.B..

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\index.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):262741
                            Entropy (8bit):7.999246569294339
                            Encrypted:true
                            SSDEEP:6144:uQMOU+Hx3HIx1IHSrE7GU+zIpK+7KLmbb13aB6N6t:uAltoSSKGrzI4+7KwB3ah
                            MD5:FB9CA0632A299C34E3A8533E9D08BB68
                            SHA1:596F578A51DA84C2F03FA840719EF1DC4F82AED5
                            SHA-256:EE47499C9BAF8463A8A40A06E19B05CD590E49D70C4983B4891CC2EB1B1BD4DB
                            SHA-512:05668FFBC8C30A673D51AAFEFED8118BA753A3C87AC8FE0BFEE7B9FEB922860CA92316CF0A4A001F174BBB365AF39C09818E250A82DED324B5E5703230E7A140
                            Malicious:true
                            Preview:E7).......d.r............(\.l....R....u.........?..o...^C....iO.yH.....5:.=.....M]..r.-.|Q...|........A.t,]O!..,.J.3.......RS....8*0a...R.Yi.U..H..#'P...m..\&.....1....P.N.)[.F.........x..#.eYI..f.]...Pv.A..dy.w...Y....<...d-E..:.i.b.'.:..S...{.h..x...#ZJ..3kW.!B#.`71,.(..Q'..`.d.i.%..}.R......PAu.r.C.l#.l6a.v ..K..~fD......[|L.C...&0|..4.R`..R.....%..%*..p..i.9..r......*;..#..?s8..}...L.....L.=...L;.^b.........^(........X.B...!8..`.w.._.!]*.7#...:........K.o.U....J..!.6.....o6...,..X3.}f.......h.]....V.;6......KR.8.]Z..D..7..G..V-|; ..L......%-}....'...1....l.).dQve.....9Y.........}l....<oz.}.......~q.f0.t.z....V3l.y........*..4...U|&0]K.G<f.J{.......&.t.x..@..Z..F..f...w..}F..9oqHi.....!...5.U.u.p....l0.dl.J..%.4.B..-f.R+....8...EZH)~......CB..B..(m...DAE.mE..c.G.9.v...%{..0.......UnY.`.......p7.....f.^.<x 2..X5..I[L..............'.g.YH..BT...m.....6...Z.V...j.%..X...*C^.....@R.{..>U...9D.-q.N...mkB{.......y.R.UW?.5t.Yd.0D.r..E.$.[.:....~..n.

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\GrShaderCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8422
                            Entropy (8bit):7.97884686942164
                            Encrypted:false
                            SSDEEP:192:znBDiVuuUdDN1nhuOcynGKt27TdiFkWOsM+kezxR9gGbMTCqLmGsD:znmuTxhdG827T4ROsMje6G9qzsD
                            MD5:5258B160ED92BF858F97F55436A6599F
                            SHA1:EA21E6F6BEB3E27B49F2547B7769E9D006D1D45C
                            SHA-256:FB40B7C767E40A138E11EF5837EFD278ADF881AF91F3B231D58FF976A445E74F
                            SHA-512:AD816D099267C3F19B39F56E9B3CC48FB8A0256C48FB7DC5A7318E0521C9500B8F026A572C17EA522E55E86E56914D05D6145ACDA4747895DD1EE3483EE89559
                            Malicious:false
                            Preview:....(....|.@.....Q/.x_{1...|..(.\/...eDn.Q..*l+."1.=.^.....w[.E.>....%...7.*\".:..M.&....^.mR.2>...S....ycz.W..c.`....U..;....c/.W.U51Hm.%f.. r....q....F.,I.....9..u.........N....p..ab>.N..g..B#x.F....Pp.zYm........|.-..N.M.L.F..o..@.u.6.-.*........jim3.0...n..0._.....-.r#..u@...D......Z.x..(..U..@..#.v...n...u..D./t.XD.:`U..d$.~..~.... ....(.U....,8.......E.....s....[.[.......t.2.Tr.Aq.6..=.]e@.H..)D.gn...:......w.I.f......#mo.d..3..Q.w..s.........T.45...O...... 86..j.....2W.^.m..+i...*a......O2"/#X.Rop.eYb..m4./;.!$@.+.ti%..3c| .iUg1.{.....I|.%..!...b.J..i...1I..`....~....Ha.W.a..6.#.n,....y.5w.,...#.LP.-.Bo........y..@.-.!<...Jibd.O.gK|....a"^....(l..@...8....v....K..C..6.&.f...4wj....v./.Y......{..4y..S.&.s...$........N.$....wG6..RL..&.......`.8a..T.G1...{..f.iz...V.@ Ou.N.....9|k..MRK..9........0F.I".g...C.!..%.O..,.5.....q..C....".2..AG.+?TT....>~7.L...!.2.E.M..8...5.et{....7...ch.#H'..........{!N[..|...j..D...9Q..`.qd..0n..?..g...5.hGhC

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):270566
                            Entropy (8bit):7.999295307779828
                            Encrypted:true
                            SSDEEP:6144:8SkE3OsMGTGzVob4Xx3w8CwWpkh0aO5o0mpQQ3RlIf8K9Xws:zkE39ZaR93w8vqehBE+s
                            MD5:A704AF645C8CE43284BEDEA8C91D61A0
                            SHA1:61693B048A8E702E93B6931DDB01C33F7E32F714
                            SHA-256:E25FC11CA646D54E39B114D99B182FCBABCD3BE2C5A481467CE032F354CAD7F4
                            SHA-512:EEC8618283B7C744C7CFE19E1294FF84A91C9095D6324132791B1CECF08EBA556C320B594FE3B32EA47EEF838FA47E487534A7F3624793231E67086FF39B8E73
                            Malicious:true
                            Preview:...s........e..49:g..K.<L..I4f.K...S..X..5.wz..e.l....*...A..a..b.W.Z...o...XA.=Z."*.Q...B.......T.................n*..Of...vS..X....J~~../...n...<h_j.."1.4.....F..2..T..?...0....`.:.....u.0..~.f..1.........O;.BY.....~.!.z......J0y..U..`.J^...../Q.]n.0.LW`..Q.8...'?..t(=...W.l.2.........1f....!w..J.h..u........"...".1.e.I}...X|..9.7..x.^..De:.......Jk....3.b.}Sv.z..7,.n...hB...3A.X...O.3........6x..QT....&.....1?.X..["+|.h...8....}..u.?v..?q..g ...=...I.....8re...u..j<7,.~9.8....!.....-.;...i:...P!....U(.kd`..8../i/..Z...5.dTU......j..x....T.7...\...y.!../.X.....q.D0..{0kua..'...M$........z.+..... u...m.&..,1.B.....)R....h...9..Aw.p....t..@.w...2.....Wq.cZ|...*..6....B...u....9t7...'.......b..hu..........:t..{/p?<`>..h.i..x~.*.Q>.. .A......s=......h...(..|.i.'F..U.!....3.(..o..{...>%.t*.N. Ga..jF.....#.;....d.Y.[`...=s*9...<b.).N....K".V........4.4..4A......Z..~.Q..DM.w...vW...#.....b..Ge......y......qpX[..h..|..w`..2.....96....0.

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_2.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8422
                            Entropy (8bit):7.976685443187768
                            Encrypted:false
                            SSDEEP:192:bmWhsBe+ivnOkrXRaZl8M2gXYPxwZF3Hu/n+mi/mxXEXOV:bmWhpDnO6X+l8MDIPWZ5HUXXpV
                            MD5:631518264BA3F7875D95D2389020D74F
                            SHA1:13B9ED2CA274D54515218306D31749557A15FD42
                            SHA-256:FF498977FA443655A60DEF0DD82B10DBAF664ACF2C0C17C771B35A05248EDB6F
                            SHA-512:BA7F8E1EB0EEDDF2595A7E92BC66C55314FB10C53A5AC1A374BBAD985D13050A8E208AADE8A2CF088DA44851941FCE9444BC804BB21BB2A1CA2978959BDC9B98
                            Malicious:false
                            Preview:.*...t....._..9...o.r..B...(....A.?...{.Z.5....W01JI0..._[.G..Q^0+.Ck.!..[e.../.+...u.....>...:.e]Y............E.Q.ecn.....R.OX..........D^+%..r./C......5.._....:......c.[...W.}.)....l..)......u..nJ./"..4..]R3...Q}.<..^.=........../ZCy..vv....(....mH...\.....1....2...p...!..NNS.Z..<.l...5z.2.ml.hJ.8`......@..k..v,z*..8..3.3....U...|.5..vsZ.s...../\;[.9.......wL..j..R../.p.v.}.......\..h....W...|......CS....d{..}.},.j......v..v:..8...UMx .V......g...^...dz.'.##y;E...gp....w].:...?%........g.^v..~.|......V...O...p.....8g..........=.D&|j..K..X\....pf...9...N...=D!...(".|..K,.*Q$pq.../.m.8....XM....NM.cnp.'Lh....o&y.#.....#...G...!....EY..... .m.3.oE....h>..=!!8AvS./.x.`..T.....1._.'....!`..}K0.4...1Iv.....&.[..y./..".W......b.........D..)#./c..<..5..l...i.[....4.$..`..$H_..#...z....lz...BVv89q8r..`......l....;._....rh....TRX....j.Fgi.....~..M.G.`.......].Q.,.cC.a........T.v....Nw.\..h2Zfk~...{E..^^e.......{..]t....!".m..f.;&.u..d#.u.

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_3.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8422
                            Entropy (8bit):7.981289736035982
                            Encrypted:false
                            SSDEEP:192:ZXeDxJ0MCCp0JsJy9aYbIKW9dHb/zFQbckkbDm36szsSAvP8itDIPmSSQ:4D0M70689aYAfFRfm365n8itCmw
                            MD5:FFD12423BD2C3245452526A5A6FFB99F
                            SHA1:3299DA876C79768AA029D93814E08C799292C0B3
                            SHA-256:4E4518D83B1BC475B720DE1D767510B6F9086D18165BDCFD3C228CAE3542EA36
                            SHA-512:6E3097601B1F1B1E73A3DDF1747E4E1F6464D542500AA394674FCA379CFC5A6932CA2F7A20CEE739DA92EC96871CFC2A6C3209F22D7E952C80884467D7792396
                            Malicious:false
                            Preview:K..^......@..I..m.8...'l(_=..fO.4H>...;1M3J.42].....U..~......&.D....f!.w...6.l.0..,i.........W...b.f0W.k....GX_....eP.......>L.o.Vn:D.[.d..Z^rJG..x........F.@a.y.2..#.87i%.>...U........e.D.5.............gd.=....5....?..f..u8T~p`....Y.."J]...c.j.aX.S,.j..c.b!....._.u-r..t..A..M?.82....U.-....@..$...*oYr...`.]..3...J.IW..'..k...x._GLN[..c...JbM.G..1%.4.i..lu...T.G~X7..qo........l.)K.....F...Dw.;._...].M.e..2.......i.u...p.w.;.]....z...K...U.....d.4.<a.=p0o..Z.....:.I..Q..{z\_.......X}F..V...Hz.A(....vQ.....i\.4.I...3....7.,|.T..6..........Y......a.R<.C...Ky.6.L..E....'........i.u.4.{.Pr.-t....e.....f.z..WY..N..'...0./....:...&..St<c........G.x..T....#.\...hf...P.....Y.t..!.8....d..a..}I...cOay....<......_..Zr.....W.1.J..j..a.~.....\!.G.:..S.K....w5....L+.)..@J.h.....7V.9..@..e.E.....@.G.E!..`.8B..c..>.&O...g.,..h..#.. ....{.x-..J...F..Z/#..L..gY.....!...W..3.......NP.)9..)0.:T.....b'h..vu.T.L...l3/'z..T.F.S"J..sz..>S#""..c...p..s4.(.....q........N_K

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\index.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):262741
                            Entropy (8bit):7.999297285146374
                            Encrypted:true
                            SSDEEP:6144:iNiYDWKSV3IpAnyiOXhlSsg1k5EK6fYCeBCSvI9SwKF+EoU2m:AbDWd2oyiORgF1k5YekSQ9SwKoVU2m
                            MD5:D5635E497A2E90686BE576AF6E56FEC7
                            SHA1:89DF98EEEF412A5E2230CE25857ED3D198B21158
                            SHA-256:F2E10ECF47FCFA800BD4A77522ADAE269E06AB87B8EF74EB677F32FEA1BE68AE
                            SHA-512:68C3B8E630A1AC5D3769ACF5541742E65709528416FA6EB4A4B097BF4E8076C71B643D982DDC2F9F215C00E3E8A366E0D8534982440EDD3D5C12FE41B80D8396
                            Malicious:true
                            Preview:...+1;...s.....i.........."...=.i.>cz.+\9....g,....*..Lt>.....C..~M..pF..+J..@....vM7?...V.&Z..&..3...c..y.k..ET...c./.....\5,.7...S.Z.8..\}h..].. kp."...*...m:.a.\..r...umm.PQP/.[/...8.G..MX..........~bs8...?.....6I........8....6.X#V.*g^..E..|.G7..nk.H..`.r.h...Y.._.c...K.....t.gk^.....&...-..0.D....\.?X.D....Lg6.d-N..m`'a.m..*.5.>...[..<.4g...l.71..n...O....}X..1b$......m...k.m....=....sG..]`^zC....FJa..]e....F.h.LhL..O..L.5L.n\od|...sI.y.]..b..19....._..1...J....K....d+K...6Y^......*o.c..:....".v..k..l../..t....H............].d.k..L..<..SF..A...K.ugz@.]....Q....FKv.-.c#..*.[...6IW_^w...%..;.'.fJg%.A.>.-..([;...yh........F...R..vc..J.C%..Vud...Q.$n.%...Z..r..$..Z..;(......lv..4..@.....a...h`...o.w,...;...(F.+.<.......$L..x....+c....e..:A'....-1#.!.o4..]....J.o.>...).22!j..!..X.G.KM....CrbI..2..KG-).X...`;U}UkU!..tKd....dw.^...?.0;LT.D...r..... T..m..9...}..p.r....u.)n......v.G.>.N.a....@H.......p.....e..i....~......9.-|.^^L..f..>uo..O...;.

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):346
                            Entropy (8bit):7.359582645313344
                            Encrypted:false
                            SSDEEP:6:m8VM7QROkr9opGjtER2t466PS3bB3LwC2OHNVIF5VPo8aC6ztDsY80T/f/9FZtOD:Lxy0jQgr90CptVi5VwFCRYTT/N3tJRg
                            MD5:0084CCCE632A3BBBCADDEEC92D48F42B
                            SHA1:1F983CA0FAB66E313FB3E56928F2834BACB6D5C1
                            SHA-256:FC53EB7B900617455DE31B15A463A904F03C26FF8AAC7C5AFCBDF92ADC5F6736
                            SHA-512:F6C316F41104FE53438CD4D5F63C2C3F4AD3BD7AAC221AFB0D94D69D8B1E5A31982E650643037A955D439DC72D3D20921D70E6EF7D1C7EE4F65EC7EBCCC6D049
                            Malicious:false
                            Preview:.}....\w........_..n.XI..;..y.XMn.3.VG...p^.HH....a..8z..ue..-+{.+..M...^..K)_s}XN.u.Y.@.....Of.?>..nD.}...4.I.X...[~.l.w.@.$+..B@.c(7....1.K..{..^.]...!n....`...V.|D......pF.c=|..3..W@...T.q.....Y.<Aj.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):256
                            Entropy (8bit):7.171569531114784
                            Encrypted:false
                            SSDEEP:6:oHk06NMxpmDje3FOFndzOPccPo8aC6ztDsY80T/f/9FZtOoRg:3qmDje36dzOxwFCRYTT/N3tJRg
                            MD5:AE23FDD8BF4EAC9D45ECAE41E89289AA
                            SHA1:6B163EB0BB0856731E6DF4258B7A0A3080EF1718
                            SHA-256:FFDEC08B13F9EF0A6955C9E897C42A26D99511E453C9A1CD5D567C4133909182
                            SHA-512:36CBD2F7BB6827B67DEA8EA6D058D975FB534FB6A39F32FE82852BDCEB1C2ADCA4BA35D511B6119B1446775525207C2EA7B43F2413AFADF70BF52CA88A3C6D82
                            Malicious:false
                            Preview:..F..p...VYYP.nD.}...4.I.X...Ht...u.@.$y..B@.`(4.....R{l.~.x.2*.DD)..N...8.-...F.....v......exB.C.+[..M..._...C.dU.l.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):601604
                            Entropy (8bit):7.9666076299474415
                            Encrypted:false
                            SSDEEP:12288:RTEgSXtRKE/58zqBdmWN8m54UB5Nhw2vzqzqseJuWjHH:RIgCtRbB8Uzqm54UDDvQqseJu4n
                            MD5:17D4BC3FDB9DAF216A80318FCDB119EB
                            SHA1:2FE49C1C24827124F449D00F6078F52D3F0326E8
                            SHA-256:C2D0125B848D12FBE2E3AB8F21632BF711C99CF71A01B3B46E1C3078B36D7772
                            SHA-512:96764F30A33092E2F2C1E90F5BDD513CE3186890573F0D7CCC48B182AF835D08A6F7F32BE8297E521993C51B763544213B18ACE3E5881B4B4E48EB6B264B466F
                            Malicious:false
                            Preview:..P.x1.3.VtL]...W...`v...W.,...(.#x....tb...'....E&.Q..Z.Z.....r1..o..R..lz...m...,.V.....g...5.H.7..&.Z..N..O.c.._..|qz..o*..{=.w..91.......Q.4Z.w...R.Oa.b............N...&3..-..4.....0c.6..9..G...K(@..*..`9.........gd~..e.D.e4..$$..0..Ejws...h...KH.....m........]..}..k....DZ.9.9`./X{...."...&.t..Y../Q. .N.9.Q......v.JL{.k.}....]I>.....T..`..}8.x.9.v.#..4..v..J.....{..i.x.:.s..+...........w..l{.P.U^.^..j9..52........[.7?....x%.y..3...D8n....!..ha.F....N...9Z...+....h...!IWv...n....};...../s............w.5.Q.p%.........().D....+....c.B...!......>=..G....8c...7..j......M.1..GG...v...-X.V..3...%.\....N.3X...,Z.A...}..A..C................"..P+l/iZ,;..._N;......&.\...&i.O,l1..n:.'....Gxj.2.z...9..79..k......?.5..5.../.\.`MI.1a./q.C"...lM.+..[..2...+.~L.E...+w}.C...u.......b..=......#...;..B9..q..F.&.B3.f.kY....{...gy..+....>Whi..M.?X./_.3Pq1...j....Z&.....E....U;..q.?..s........./r.Qe+..c..`.l....r[..V.[#....xD(.-...>....9..R....|

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\MEIPreload\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\MediaFoundationWidevineCdm\x64\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\OnDeviceHeadSuggestModel\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\OptimizationHints\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\OriginTrials\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\PKIMetadata\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\RecoveryImproved\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\SSLErrorAssistant\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\Safe Browsing\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\SafetyTips\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\data_0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8422
                            Entropy (8bit):7.977741725912566
                            Encrypted:false
                            SSDEEP:96:MB0hMGwCGn2Aus1t1p1/uuq41GONXt0Y57Sh94o+mLHTmS/MdMK4DJ4f6:M+hrBWV1p12ud0GWY0h94+5JK4D26
                            MD5:DD05D542E134C831DEE8A938C8198791
                            SHA1:70D217D01A7E6D911FF5C34149F37696A14A5408
                            SHA-256:C6718AAA66AA30391376E915975D60688077FDC56C8F98932C65A2A12E62EE4F
                            SHA-512:10DECD1C12423E03F4D73BFCEB3AA58411437DF2A3E4C47D1C3D4777FCFC1A201523C72782D8603BF45B84308DFAE13F8AE97C05B40827151894E3957F4B53B6
                            Malicious:false
                            Preview:.N7....hL.J..!.CG.l.....%.(.HI&d...D-....+..n....G...r.d.H..3C......[...........Aqn.~=...[...k.A.&.fr.i...3n...BP.L.A..........stLo.k......W.p.C.)...1t.N.e.,..a....n..nkfl.......'r1.[.@....Z..'..T_.....2m..2BW..>....F.~....JR.........>.w..O....f. &..4.7TEL}.....6VCQ...R..{.0B.!..~N8......v$..p|...R..-..[".....S....p.|. ....%...F64h....;.....a.l.`K.....m.T...a.O.".8..C.q..{K3(.I.U#.`..FE...>>.....-.....E.".h...8..t.xi1<l.XV.J*...{H..MLX.&......m..\...`.:![S..bd./$...X`.3.#S...b...._.7...,..o..y...\.?3.. .B...-.D...k3R9..m.{.O...Ll?,...O...ZW`......eaZ[..oi.9'..,.g..`l.h..9_.J...4{|.tHt.Xgf.=..x..TT....B...........LB.%..0../r.+._w.%b..6........IJ.~..C.8=..t{.9.2.f...../[.".Y3X..pR.-.u&}'...\21E.J.ZS...}.j...Ul.....j.._.Z..F....=...Z.|....\...9..}...L.]....R8..\..JG.R....O..H7..Xl...Md......e.i.#>-...X>..c[}.m.....:.0.fo....+.;...g..t...d....p.*.m.j....0.I...4.;D.M.'.{"H..K..a....I .....'......b2\..n.O...`.!R.*v.x|.A..B..3.L1......F...w:}.s.,2..

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:PGP Secret Sub-key -
                            Category:dropped
                            Size (bytes):270566
                            Entropy (8bit):7.999306313388524
                            Encrypted:true
                            SSDEEP:6144:RbeSRDWfen2e8speaZZ/RT0EQY4BQm46brAHTlXigZzU6D4:RbeSRgspGBQLUrAzlSgZU6D4
                            MD5:FA00399E3B33B622A1DB71730883F30B
                            SHA1:56C28C837306EEEA84523E1E4B55658C260C278A
                            SHA-256:B7B9B1877BCDB50DED2684473547BBF0D33809D097AA820D7ABA7739EA040408
                            SHA-512:349836087F6DC5F8FBC9DA1B276E87E4EC2C66990877530D1CE131291F8942621B1FED6CF1270172C42DB4805D9DD5053F0A5894053B00F4DAD8AA537C213007
                            Malicious:true
                            Preview:.'..Gw.k.>[......5.p&I<e_,.a.Ge.f.S.Mq..&4.@q.G...'.......&...38.Y....or..........+TDF.....-X....>;.v..u.nW.V:..6.."T...wJW.p`...x....).%e..)\.D}f.\.....vJ..'s.M)..w..}v..".H...%;...UT.h.....S......7.r .e...M.......1_...#h(.=.0."..V.....;.].!.>.<....G.Zv.B.....".V.....s).8..........jH..u....3...R.'v.#W.N.0_.>.qZ...g..ST....];......{..7.GB.ae_..y...)..f....-.....a.............R..d..(5..M8..zVe3L.|$I.1z.If/.....\.*p......g..L... .3n_.h..J..:....j../.{......c.|%.d......2W.9..m..6&.<.|...? ..h7S.ub......I:;..R...y.GC..@..=D.+..v}.o.3...G.E89t...d.....|5^.h.|..z.|..2..}X..$...0...=.J.s"..NZ>.7.d..0.e.Om....<.r....R..k.E;-t......(.R..M].f...Fa\.}S..q....H....{.B..H...n3y........(....).J.."G.".}<)7A7..%{<...J..v:....<.1e....../.,ta.O~=..\(.....(r#.....p=....n...-.Fy..b"...#...1/p'[..Z.p.D. ..].].U..6.w5......u<`....}./'.....8...A...D../...+k#..H..'..?|.U.....3I.x.-..S..l,..-.....-../>b..g.....b..0..J....D......y..&Z..>.!..........^.3.+..1

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\data_2.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8422
                            Entropy (8bit):7.981693325023222
                            Encrypted:false
                            SSDEEP:192:DlhtWsFneCi76lP49oeDz2Kr0dXsfpgm1PjaOh0:p/WsteC8HlDSKIXsSeaOh0
                            MD5:33713C6ABD084D2153C4C93C4ED09CF9
                            SHA1:D4F31B18CF04DE2B029594399A623FB55315B0F8
                            SHA-256:FCAA7F90212D6730A2EB8982074F0C91EF5D05BB16CD417492863C558DCF7ECE
                            SHA-512:940334B76EEF4B62A7DBAB75F74179C892EAF620DD3712A8AFCC57263C9EB1D1B5EA00A2AD3F01B6F9AD6FEFF8BBC976E497E6A0F263D21541BE679D3AAD1BAB
                            Malicious:false
                            Preview:s.+y./.>...f0..M.i...z`.B..T....{..g...-....Y...xDQ-Y...c...~..!.E. .[......P.`..v......Z._....6_.q.P.7K....?g{......MXNz].Hnu..."....r"1...OH..$..Z..R.au{..Wl.."g..n..R..k.U.]s..@.D..8R....U].t..$..Y......._.b.%.w8.I{.... ,u..sEHX.+y.e.r.'.4i.0.F...%...u..7...n+7......=;.^.34...D".._.....H...J.i...Y.f...J.n.r..k.~... .......J....2.+Jn...?.....j |4brj$.J...h...{../...X..K .^.zA.(........|.5<_..h..=*.jaob.YUw}..^.....Sh..Tr`y..*......kY.....$..L.Q)......[.=r$...C...f..Fp4...(..gs...?...q..w........@.4....<...,.,..4u.<.;.B.L~./w.X..(.F..jS1o.I...p"Z.TFG.8y*.[....`BMQ1...*1?..{.0..).OP&#...O5..{..Ep..I....n%c....tX...`....K.>@..5=[.....^d.....s.i\i.B]...;*.}.).F/..U3.....z..Q..s...J....@....bM....xb)=...e.o...2.....U..$....[..9..T...d..*V.\j._...v*.`v......z..e.m....m....l.$....!7-.T#N...l.K0..I....U.;...L.h..9.p..P.4.l..?..?......o..`8....6l.u..E....=..~.P8$M.c.m...p.......q...../eb..W.5f..}.@<..]5..".9..]....kG/.=......W/.......kI...AA.

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\data_3.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8422
                            Entropy (8bit):7.9773115454472014
                            Encrypted:false
                            SSDEEP:192:6L8n8uYGJJLuNT9gHmzrLZ6XXl2Fc/yqtpm1HaZ:6LUYGJpgjHYXV2FKDtsaZ
                            MD5:479F1977F9A379C9CEBABA6207724F21
                            SHA1:AAC1B47A39B870000E9249B3D4BC8AD575C66B7D
                            SHA-256:2C06136CA63C0B34FE1FABB01600460E2125FD5A0D0B935C43BD7530040EF594
                            SHA-512:C36FC335DD0BFF2322DACDB032DF00205444AF8FDEBBE9AB7780943DF4F56A135E609EFA76F215E1FAA0096DC3A4A9E85F282501E95A18ECFD0E9740835AC2CE
                            Malicious:false
                            Preview:..7.m~3.....2_z....5'. 6.Q.b..uI..*.1. R-..vP.:...4.8.."1L?.m.....~...X.?..P;.K.....lQ....t6.e......f...J...p.....b.o....?...|.g.f.}.B..0.A.m..]=.x...4......o..F.t..j.@I.......Dq.g...v.(.Us.F$.ca....".....!..k..&.{..\...qx..N.........L.'.Y....I.F:...;...VH>|Z...P2$...b......R#.h.0.k..k.....7..v..?2..}..,.*a....hV...[..5{.K...F.s...k^...!.pW.`.0..t.....4%.9.Y~t.'. .......)....vm..S.X..~iYZ..ic.i....%Q....<T.........+..\.z..x8...&B...$.;iD.5[1.F...A\.A.T....Tz.m.3..hP[lk..y...-..6.F..S}..T...?..P./.X}....J...P..L'_..S.`......?y.xV....f.s..].4...[Q.........p.x...+P...R?.../j..2..zq:.M..IOkv..'.6.s^E.......j.w.t2/_qO....~.Y.....F%....}..<.......=.,v...s_.L..TD.D..U.f/%...r..:<.,I|z..h.*m.:....XSN.7..,...6(...2./K.Z...3..y....g.q..#T.(Q.LR ...U.........CU.H..p.,...9K...k.1).k%.als..jIq...R..'.%..5..!7.U;.......Vn..Kouc..i|.>..[.u.._...l.\....w..\...q..c...V+z.u......b.6..7.6&..O..7.....S....{.7......>.S.NwGf........wc...].n..c.k.+.~MQ.H.......w..:...0!.

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\index.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):262741
                            Entropy (8bit):7.999281977780949
                            Encrypted:true
                            SSDEEP:6144:3gfGBUuCxdSYhvCAPoz2el30AHDlA7/JH/L8X0XcdqbHTg:35sHDPGkAJYU0XcUY
                            MD5:CE93498C5DDC81764F84AFEDCC5E24A7
                            SHA1:67E3F1E5EABB26D5F1784551BD9E28F46C2B50F9
                            SHA-256:87E660D3D135804FD6ED00DD180C843BB8DFA052AEC71BC33669391462D09C93
                            SHA-512:509BFE16297009F78B7BFFDB770F7E1B0102F2BF84F6059721C7F3EE87105291082E28C0AF69185D2610E4504CCA68DA8BC3523DAB025187B05475A34730D2EA
                            Malicious:true
                            Preview:t4..|9....A..~&w6 ..w...-...r..b......3T.j...`....X.Mx..Zr.../d..h..D9...2...&...q........z...x..@....46..D^..zx8{.R5w.d_.c.op.#m..F+D@.-..Rc..........}...3ce.....j.E..j=.@...:..D.Bm.........i..i.U9.d_.l.../..B..].@...t...b--...RTT.L..J%..H.......6(..._.*."i*p....=G7....O.SG.......~>"...(......Y......hf...}X.}us.f...If.'v.o.,.T..o.R...r.......D......c.P.&........>.k....K$.L....F..h.'.y.<.\.]6/....W.V.Th.)..&.#..B.A.s...!.c.I]......Q.7{.h..~...Y. x..3....T.C+....n%pKWq...Ia...d.Qy.T.l...@}.......Q.|.h.....z.=].MtP.G.fmr...Up.&....w.j..G..$QZC.s....)...6.}.....q."...5.....T..l...X{.a.cF.-.LR.....ZhfM..b....+..8...K.&....U..y.R.{.([ [J9.~.-....m7.~.*.w..Q.f..U+.QR..Vh2n...2.&..C..}*<.t5y..+Im.v......Nw5.h.>!.s.......4.....!.uI......P...!......I.....4.. lk....."....Z....`../.....~N..;........`..l...9^J$.o....Uv.k..i.).H.Q..!X.Y.4...nX... ..7=)..0..av.{%.vE#...L...................;&F.B.....=..K.%...(^...O..%.Z..j.u(...au...

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\ShaderCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\ThirdPartyModuleList64\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\Variations.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):320
                            Entropy (8bit):7.3278922558156045
                            Encrypted:false
                            SSDEEP:6:P94taJdlmldEloLGvZRONPlF7A7lGpfcUbyqLcwPo8aC6ztDsY80T/f/9FZtOoRg:P2WrS2VvONPltA7lGp0oYwwFCRYTT/Nq
                            MD5:1385DE6728AB57A88A95449B5ABF1D54
                            SHA1:338DDB8910ADAC9123F250CF51E731FC8F7AC9D1
                            SHA-256:84FE4BCEF992295CFF401E302074801DC33BD3C6F57472367D41CCB7D939FFB3
                            SHA-512:8036A3757DC0DB62F6B1B668779137541E804BD264AF0D8FD82EFA1114B0611156C5709317CC93CD91BE06B62DF33539094FEA718643AE5DC53523BF754BA936
                            Malicious:false
                            Preview:f....S.1X..H7.B.&..+d*x._.Y.C..."...D.*b6.`.....\~.).%.=.z^....D]..lrx.=.FD;.:H...tD.}....zX...r].bF....%.@.$y..B@.`(7.$.3.i.$...n.X...)7..q.3.4n&......}...".....N.....e.<.).k...ne.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):49403
                            Entropy (8bit):7.996547802425791
                            Encrypted:true
                            SSDEEP:1536:D2/nx7ZOYxznxskV2vsru07tHG+hUaDwBMQ:On/vB7R3dDwB7
                            MD5:6E048A72A3D865931067B3C0D2B13BFB
                            SHA1:045A3072178F89EC0895560C587F0F03897C6C0B
                            SHA-256:8665366DC39965A67EA48E04DCF4134EBE6027AD3091B206E7A05D58A0F5D438
                            SHA-512:FE74694220393CD0C3C438F15C5B94E2925FB5B129915DD67573DDD15ADB5760FC456A1624EBF6F5E0B1ACB73AFF346E420E8536700C4B85C5F02AD83BD187A7
                            Malicious:true
                            Preview:...*6.W#2....fG3:l6.F<..?..1.._.?..........}....B....h .4l..........$...C...(.p.W.G..V Z...]..P.#.P..x0....0^...F....!.....-...KU.1.K.!.8Q......J...]....._...s%..Wzp.LCH..F.+S...>y......6...Px.D,(.b../.w..{b...J.A..e.......yO....Lr....,h.....n...f.z.I..x5.6?....PDO.r.d&...1. 5Y.$:{..>._cw.._LH...2B....Hz7.b.l...l[...V.RA.O?.y.E..6...B(!... .~...]....m.~.A\.F..'.%..;G).e..k.h}Yd!u.Y...h...d...v..&.....tpN..Cr&2...E...9!#0-.....C...I."|.Q.}E..1.cG......a-...........>K.q0.d......8..._.D..s..i..\D.p..........v:..ZP}..s.O8!W..-$o.Y.r...A.%H...6...pi.[..E...m. .$.Jto).i...Y.(./l.Q>pC..;....1...Mq.f............"/....SQU......5..Z.....E"._.|.J..z....#...w..G..P....$..nJ..@...6.E.@Xca..%...{..l..LY!.V.<.h.'......j{...t..0b.M4l.........e....<su.}.......U.1U..Ety......go1....t.[...6...h6t.......)..12..u...M.G..Y...j.$..0$...^.O.D.z..`.........\)........,.c.8.pk..5.Y.r..K[.......z....v.m..P...:&..`..H.............{.f..=..J.D.tCk[...W\..v.u....c9.;..<db#S..

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\hyphen-data\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Google\Chrome\User Data\pnacl\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\5BB545DF-9D7D-4329-890D-DCD24ED8102F

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):166203
                            Entropy (8bit):5.34090039139375
                            Encrypted:false
                            SSDEEP:1536:n+C7FPgOsB3U9guwwJQ9DQA+zqzhQik4F77nXmvYd8XRTEwreOR6g:GIQ9DQA+zqzMXeMJ
                            MD5:642FDE57619F386F5706FC2117008DA0
                            SHA1:62F5C8A7C912DB8CA06C9A582843D9950D8B977F
                            SHA-256:228E700F9692D6BD7EFFE5739B0F58C9B675385ACF13C339457784A8A74B5C09
                            SHA-512:49A0C157BA8C860B263ACFF18F930B8E432DE063ED677982B175AB04EFE7277E248612677876143D2B57B61452680C70B917C71F414EF3A1364C05D66035DE01
                            Malicious:false
                            Preview:<?xml version="1.0" encoding="utf-8"?>..<o:OfficeConfig xmlns:o="urn:schemas-microsoft-com:office:office">.. <o:services o:GenerationTime="2024-04-24T01:18:31">.. Build: 16.0.17609.40129-->.. <o:default>.. <o:ticket o:headerName="Authorization" o:headerValue="{}" />.. </o:default>.. <o:service o:name="Research">.. <o:url>https://word-edit.officeapps.live.com/we/rrdiscovery.ashx</o:url>.. </o:service>.. <o:service o:name="ORedir">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ORedirSSL">.. <o:url>https://o15.officeredir.microsoft.com/r</o:url>.. </o:service>.. <o:service o:name="ClViewClientHelpId" o:authentication="1">.. <o:url>https://[MAX.BaseHost]/client/results</o:url>.. <o:ticket o:policy="MBI_SSL_SHORT" o:idprovider="1" o:target="[MAX.AuthHost]" o:headerValue="Passport1.4 from-PP='{}&amp;p='" />.. <o:ticket o:idprovider="3" o:headerValue="Bearer {}" o:resourceId="[MAX.ResourceId]" o:authorityUrl="[ADALAuth

                            C:\Users\user\AppData\Local\Microsoft\Office\OTele\onenote.exe.db

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:SQLite 3.x database, last written using SQLite version 3023002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, largest root page 1, unknown 0 encoding, version-valid-for 2
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):0.09216609452072291
                            Encrypted:false
                            SSDEEP:3:lSWFN3l/klslpF/4llfll:l9F8E0/
                            MD5:F138A66469C10D5761C6CBB36F2163C3
                            SHA1:EEA136206474280549586923B7A4A3C6D5DB1E25
                            SHA-256:C712D6C7A60F170A0C6C5EC768D962C58B1F59A2D417E98C7C528A037C427AB6
                            SHA-512:9D25F943B6137DD2981EE75D57BAF3A9E0EE27EEA2DF19591D580F02EC8520D837B8E419A8B1EB7197614A3C6D8793C56EBC848C38295ADA23C31273DAA302D9
                            Malicious:false
                            Preview:SQLite format 3......@ .......................................................................... .....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Microsoft\Office\OTele\onenote.exe.db-journal

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:SQLite Rollback Journal
                            Category:dropped
                            Size (bytes):4616
                            Entropy (8bit):0.13760166725504608
                            Encrypted:false
                            SSDEEP:3:7FEG2l+tIG9/FllkpMRgSWbNFl/sl+ltlslVlllfllGn:7+/l7Gvg9bNFlEs1EP/W
                            MD5:93B0DEAE8621A103FBB6A2D8B91F416C
                            SHA1:D76114D92920883488F6528B423AECD96B7CAFD8
                            SHA-256:09376E0D5A24C2F913725BECEB72A67F62E9265B00AB156A74DAD518D1F60E79
                            SHA-512:EAA9A34CA48CF948BB45F3C0CD85154EEC40A4BF954FC36A0DBF6B5C073862F1CAB6A68F4893829D8A987C5440012272913C8B7E55223F68E67E1D5C4F9CB993
                            Malicious:false
                            Preview:.... .c.......Z....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................SQLite format 3......@ .......................................................................... .................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Microsoft\Office\OTele\onenote.exe.db-shm

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):32768
                            Entropy (8bit):0.04470641479249482
                            Encrypted:false
                            SSDEEP:3:G4l2Ey+YExVe8/l4l2Ey+YExVeDlulL9//Xlvlll1lllwlvlllglbXdbllAlldla:G4l28ze8t4l28ze5qL9XXPH4l942U
                            MD5:ACB1A1C36E7DEE9E3FB288FAD10F4FAD
                            SHA1:C82B5A7576ECEE94E8770C5C6787F976B69025E3
                            SHA-256:1217EBA44113BBB47AA4F46117EC5415E3EDAEEBD86BAB3E1F89DC5A9D503AEC
                            SHA-512:FDD95B263EAA9058CB5404B437C511FA471A17E6FAC587A06A90118470BAEAC1E42ABE4D07687E0780DED1853131463C11BC2599555455CC461E9162FA8AC750
                            Malicious:false
                            Preview:..-..........................?.t#!L.a.M.pp&,;...-..........................?.t#!L.a.M.pp&,;.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Microsoft\Office\OTele\onenote.exe.db-wal

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:SQLite Write-Ahead Log, version 3007000
                            Category:dropped
                            Size (bytes):45352
                            Entropy (8bit):0.3919273255697684
                            Encrypted:false
                            SSDEEP:24:Kr5xk+OTQ3zRD/M8Ev8XUll7DBtDi4kZERDDD9zqt8VtbDBtDi4kZERDHP+p:E5OVQ1XVXUll7DYMxzO8VFDYMDP+p
                            MD5:8B48ABBAFE4BF08B89BD3C7D4C983EF7
                            SHA1:0C77C0E59DF22633079F27BB01E58D9A735EC9E3
                            SHA-256:128AA5273D23DE788EB1DC2A6FB48155A227E4AB24A44843160CD2CA74102FC0
                            SHA-512:CE749F48BA757C2433AEF76D94F9B45972E15C254E7D606C8C437E10E25F842DE5CFC20EAFF13BA1FECD956ADEF01FB4109EC5C1F1BD4A027DC83A5E43CD619C
                            Malicious:false
                            Preview:7....-..........t#!L.a.!.&.i._A........t#!L.a.f...Y!..SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000000.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):49152
                            Entropy (8bit):4.782765802850293
                            Encrypted:false
                            SSDEEP:384:w2+7cz1STfeOOjDR8bNsy6lO1oNsaz4sH5vXmpMSEsnfBf96i/:MDOqZIihjAWksv6
                            MD5:7C77A42E9DF701BAB567E3191A0FE1D8
                            SHA1:8A86BBB52CBFE3ABA0823242080709E7AA3DAF41
                            SHA-256:8DFFEC51158900867804B33665277F6A959906CA27558E897CF847A627E82B9D
                            SHA-512:7C8C9E0B138C338C09B059847BBCE71414BCC9EAF505D2806B79421609DA75DFE71214D9E815E050D631D4F392EAA63705E4FEBC816F8118941F678EDC259FCD
                            Malicious:false
                            Preview:.$-..D.)...7..O.... ....I.+>.J..[.!............H.......0........... .......y.............................................?..................................................................?...?.~...............@*..@...@S=0.....0....@&.....S=0.....0....@&..............+..h_..Hq..............8...............t...X........D...s..8...@...0........... ....... .......P .......'...... ...?...y.........................................?...............................?......................................?...?......\ .@...@|..@q...V.O...x............u......).......?.......x...........................................?.......?...................................................................?...........?.............................................?.............................................................................?...?.........................................................................................?.....................................X.......:....m4U..'.9.r.<~.a......2k....

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000001.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):0.04401584019170665
                            Encrypted:false
                            SSDEEP:3:RRk//:Lk
                            MD5:CD74ABACE8A00B17BD8107BC5982C21E
                            SHA1:D53193CF8A43D766FBFA52976192F44D6B0F79B2
                            SHA-256:B670BC07C9CB554511180DCF3F6A2C7818E8CE6E67B84784F0EA4D35EC61D516
                            SHA-512:1B48A37FCF0F9FB9ED9B31A8F3E36596689BF1EEC6F41F5EFA3C728121944919CE7A81F0379A108D80AA051CFEF07DC296F9C0691FC8855983B2F29EC15C7FEF
                            Malicious:false
                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000002.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):0.4858496758263854
                            Encrypted:false
                            SSDEEP:6:NTc/q+OubxfbxXztltjbGwJVK1zLXl0ww1EVZzOXl0M:Vc/q+/bRbJtXjaqgL10wQEzzO10M
                            MD5:911968468B51DF985DA921F6F7468FCB
                            SHA1:34568F4A745019A220889FA0D118C2A0F2C81B89
                            SHA-256:DB771F69F1A227F917C34FB90EF1BC20B0A1B5DAA3741073ABDA4982E3840D1A
                            SHA-512:D9829D271C0D638D3C7D6674B67C707AFF98B0E2EF7F66D8806445E6AFBBB697281022B175DC00D01C533C21AA028EEF7FF2801FFB5D5DA1D254C185FD5AAB66
                            Malicious:false
                            Preview:2...>...........~.......................................................................................................................................................................................[+......[+.....H.~.....`........................[+.....H.~.....`[+...................................................[+..........................................................[+.P..............................................................................5........m;.H....7.5N.........?.P.............(.,D...H........N...^...............................................................................................................(.,D...H................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000003.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.668608064289114
                            Encrypted:false
                            SSDEEP:96:8pYWr4VDxjueExyL5gLYO5C47yEwbgZrG/:8pYpVNje8L5gLX5CCfwbgZrG/
                            MD5:C8E981AE640086AE3B979F827B96C6C0
                            SHA1:835E6F33EB2B6EDA9F9FF95C19279226529FE317
                            SHA-256:5F5EB8EB5C17AB8E451D8707FA7B1E33DB20526BE4800FB29A3E0EB1E21D2124
                            SHA-512:B216A49FB1C9CB0F06EF6403A103E8B734C558872804CB3CFAD9830C5E477405257BF54710134A89D580DAC03E0D42BA4B00D0EB1E3A8CD217AB1186AB3C7C00
                            Malicious:false
                            Preview:j.......T.......@.............................................................?.........................................................................j...............@.................................2.......2k....$...Dt...99......99q.I@../[.s.V..I.+>.J..[.!.....I....2k....$...Dt....2..99q.I@../[.s.V..99...........99......99.................................................W;......W;...(..f....g.L.V.....L.VGO......k..s.2...^............................99.L.V..l....I................99..|...99X.....99..2...99......99.."...T$....O.T.R..}i.T%j.......l......I...c..,0...e...B4.$..........C@RQ.H..B......Y...........................#...I.r.B).Rr.I.......I.+>.J..[.!....L.VGO......k..s.L.V..W;...(..f....g..W;..l.>.F.O......l.....>...........:.....2k....$...Dt...99q.I@../[.s.V..l.>.F.O..........}i......L.V..c..,0...e...B4.$...........I...M.....0...............................0...........e....4..................T.i.t.l.e.......|{....B.l...R......(....Y......(...D...L.e.c.t.u.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000004.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):8192
                            Entropy (8bit):4.75655317617278
                            Encrypted:false
                            SSDEEP:192:jsy2qBl/f+eXbRoGPXiPwyRi+BSyJUNgLthg9k/kYRbB/+U6:YAOGf7yRiF0tKk/k
                            MD5:9568685BF9F8D89EA816A94F684ABE5F
                            SHA1:9D64E7FE1E12304B4FFB9D890C468DC8F562A38C
                            SHA-256:4786F46A355CCEE7D8FF7D603C11463DF92C0686900A4126F4AAEC3DA16A3B53
                            SHA-512:D68B1BD8BA1534530A49BDA01AC1EAA5A38288FDC821F736E2A654718A9238E0D0315296061CD43FB894A70084127ED6B1568527313E187BFBB0C351098381EF
                            Malicious:false
                            Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZa..4...a.o.]. .b...".a.o.]. .b...".a...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............|.3^E.....anQ....N...^................h.....D..;.-..............>...............................$....I.qk..B.....LZ..............|.3^E.....anQ..........|.3^E.....anQ.........a......a......a..........................................a.j....a.T%;..a......a...W..a.H....a...+..a...S..a...........Z4...........................................4../4......p...............C.a.l.i.b.r.i..................a.:a.ka...z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000005.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):40884
                            Entropy (8bit):7.545929039957292
                            Encrypted:false
                            SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                            MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                            SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                            SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                            SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000006.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):4.402177214754616
                            Encrypted:false
                            SSDEEP:192:zsxKXZ7mJZMojjZ8LucOTS18wZ9faRJtPowXaRRkDU2kez6N+ej9r8VoY:oAx3oZ4ucO+PZ90JtPnaRRkDuez67xZ
                            MD5:2E6FAB4C2BC9F53F1C4A896F2432C0FC
                            SHA1:F0AAC31828AA9A7D0C95F4BABE7708D29279E0FB
                            SHA-256:D199DA6CF5313D208A3C267890D9549AAF88D4BFF4A7A51507A4E9CA66C17653
                            SHA-512:7D6235D891CD2777D9135CDB7DF39402E27B4ED98C8F6B8BC3CEE9C4D9DCD64210F629B0F0C1E9F0166902DCA0AABE8A6B43F413F815EAE00347C184600540B4
                            Malicious:false
                            Preview:2...>...........v........ ...)..2...>...B.......v.......@....(...........................................................................................................................................I.......I.qk..B.....LZ....H......&-.5..i....0....&-.5..i....0......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............y..3.d..'.8P.%6....N...^...................cA.J..\..5.............................................."....I.qk..B.....LZ............y..3.d..'.8P.%6................................................................................................j.".....T.................T............. .A............. ...........3...:...8.....z...y.. x.. ........ ..$...$........D..........7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.5........................Z4...........................................4../4......p.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000007.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                            Category:dropped
                            Size (bytes):24268
                            Entropy (8bit):6.946124661664625
                            Encrypted:false
                            SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                            MD5:3CD906D179F59DDFA112510C7E996351
                            SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                            SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                            SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000008.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):4.57196636031755
                            Encrypted:false
                            SSDEEP:192:fsA5ksI9lgaEo/uCWNhjnmkAUoDDyT+LpSXH7bRpjiyhppKnx2DEd9boRsRIdxdq:UIelga2B3jmkgDDjNsH7bRpxp0x2DEfd
                            MD5:54B34D4A25C90AB8C50E9CE67FCC4D7B
                            SHA1:2523CD98619509BFECDDB0209BFE0683433DEBEB
                            SHA-256:17479D5A6C2A3A320C140117C75BEBB62F10E5AF2C397C2BB56903F3631326CC
                            SHA-512:EFF05591700851E86F72146909A17F3CC2E2F6D4EB1ABA106764CA41584F9F8A38934BE0B22D6BF2CDC752902634EBABA457444BBAE614E3D8BAA3CB996B92F9
                            Malicious:false
                            Preview:2...>...6...z...v...N.... ..X,..2...>...........v.......@...H+...........................................................................................................................................I.......I.qk..B.....LZ.$..N....$....%....b|$.A.$....%....b|$.A.$...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............W..tZu..*..;......N...^................$.Y..-F.5..>gn............P....................................I.qk..B.....LZ............W..tZu..*..;....................................$.......$.......$...........................................$.j.9...$.T.....$.......$...s...$.H.....$...0...$...`.&.$...........$.3.$.:.$.A.$.8.$...z...y.. x.. ........ ..$...$...............7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.1................Z4...........................................4../4......p.........

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000009.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):39010
                            Entropy (8bit):7.362726513389497
                            Encrypted:false
                            SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                            MD5:9700DE02720CDB5A45EDE51F1A4647EC
                            SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                            SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                            SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000A.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):3.95043314949611
                            Encrypted:false
                            SSDEEP:192:QksEPw9jOk1WjerdxL0UReyAFlKG1LUBjd83wqE8B4Y0/5dNUXOqmndkqVduqOW:+EPsjL1PxB0URePJUBZWwqE24H/IGkq7
                            MD5:9D0644366D7213D41BB2E0BE871EC646
                            SHA1:C19FF8070940E755C4DCD5276D35A6AD595E86FC
                            SHA-256:44D5673262C44A3BF403168FB4908FD6D46D966A799B4B23F489F2EE2E817CBF
                            SHA-512:6958527585278C9E2ED2B9C763078D95372D4F23D1B230B40993D18CAC8DADBDBAA1E0E52E5AC72DC63BE47209C0FC7978CDDF5F6FD6A0773123385BE6EE95A9
                            Malicious:false
                            Preview:....>.......B...v.......0 ..x#......>...........v...^...@...h"...........................................................................................................................................I.......I.qk..B.....LZ..z.......z...M.3e%...T...z...M.3e%...T...z..4..M|.....m%...4...I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'.................,...$./G.z.{....N...^.................o..3;H..0.............b...8....................................I.qk..B.....LZ................,...$./G.z.{...................................z.......z.......z..........................................z.......z...M.3e%...T..4..8....4..M|.....m%..2................................I.................................zj.#....zT.G....z.......z..Q...4.H.....4.......4.$.7...4..........4.!.4...z...,4. ............................"......$...7...............T.u.e.s.d.a.y.,. .J.u.l.y. .2.8.,.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000B.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):59707
                            Entropy (8bit):7.858445368171059
                            Encrypted:false
                            SSDEEP:1536:k76rvGc8WKC2/UX1uEgVRY/jvv9CblyL/T:k77Z5C2/Ow1e9CblCT
                            MD5:47ADB0DF6FDA756920225A099B722322
                            SHA1:851946B8C2BD0BB351BAEECA9E5BB6648A87D7CA
                            SHA-256:EC8CD7250F3D82E900E99114869777EE859EC73EFFABED108815F65742078C3A
                            SHA-512:85A9920E1CE4A2FCCEBAFA425C925DF33580FA3C3C00178F058539B2FBC0163866DB8A41B320E2EF2CD217F00FFA06A1A831C728D3F9F910C9EAC58B5DA76E2D
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..A..Qaq"....2........B#..R.b3$..8xrC4&'W.%e.(.c.d.5E6Ff..h..SsTt..u...Gg..H.....................!.1..AQ.aq.".......2..st.BR..56.r#3.b.S.4c%...$d.CT............?....3.7...G:../P....z..K.:6..w......6....... .z7...~.....{gdF60...9....{...'[N....m.........z...g{.......7...4..1..=.z...._..p...m..Icd.~.v..9.P..0Z(.<j.......R6zm.....v.z...>x..)=g........zo{..w..f..y.t.....%.D..#.}.I.>).H.QM..cLD..x.../.^y.{.............y.=^.......I.T.......U..0_?...u..og..3.ky..K....6w...Dc......~........ik.z....N...en......_.....x....._u...4.{..P...>.....}.......>.R.....m.....[mt.....}.........|.....m......~....B.F.]C.36..q....yg...{]...+.DZv.9<.o..;..N.n&im.,....w.3...V.s...Y..e#$.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000C.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):3.8708725786827576
                            Encrypted:false
                            SSDEEP:192:ssYLW05rr+SO8daX/FthzRl+6THZCwJPQS9dUH2krI:x+39O8d0/hzRlTFCZadX
                            MD5:BB970B22014782EEFD7301AF666E1399
                            SHA1:ED4AE5679819BA7DE2DC3331CF7FB91932629AE8
                            SHA-256:8BA7EEDAE0DFA3C3B3E07274848CBBD5478F99B7F6397B0CE67024B18E0A8704
                            SHA-512:BE1D9E626543B29E5AA208688D02A869E10774F3BE6762D8CF2E99AC7989ABF180C7BA08CF01862BFCE12F15AB6813B650A218F4BDAD0CBB7977684FD70C0B22
                            Malicious:false
                            Preview:2...>...........v........ .. "..2...>...d...<...v.......@....!...........................................................................................................................................I.......I.qk..B.....LZ.+/.<....+/`1.x.+...(.*..+/`1.x.+...(.*..+/..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............F.CNJ...........N...^................../GclJ.!.................................................D....I.qk..B.....LZ..............F.CNJ.........................................+/......+/......+/..........................................+/j.....+/T.T...+/......+/..|...+/..;...+/..h...+/......+/ .W.....'.+/2.+/..z...,4. ...."......$>........4..p..7......S.u.m.m.a.r.y.........................+/3.+/8.+/..z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.9..............+/

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000D.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                            Category:dropped
                            Size (bytes):27862
                            Entropy (8bit):7.238903610770013
                            Encrypted:false
                            SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                            MD5:E62F2908FA5F7189ED8EEBD413928DEE
                            SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                            SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                            SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000E.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:big endian ispell hash file (?),
                            Category:dropped
                            Size (bytes):20480
                            Entropy (8bit):5.3125765134550385
                            Encrypted:false
                            SSDEEP:384:i1cENC5WagB4COUx+Z1krmQPmwbJ3AGtY4CplApiyDhKd28ybDYzgXXg:Uz4mekCAk0b9Aw
                            MD5:32BDB495E7AB5D1746DA61C2672AD1D4
                            SHA1:59DFB1DF7A1B68C74718759E6B1566D1130702CA
                            SHA-256:A7D07DCD4A5BCE4AF8CA7A48E67F5C98B9A8DAB6ED0AEDE3B9D31CCCDC281604
                            SHA-512:E9706C7E2A5514E509767A707DAF1CE09536A5CE0C4671046B0A0B5997FDE53E89BC3B9A9B9FFBD2896AED70C75D8364492DFDCB3C8391E4695576FD90D85DE1
                            Malicious:false
                            Preview:...@....8...........P...(@..( ..`L.........@................l....J..( .. K.................................................................................@.....................K..( ...K..............+.......+...;.H.12.....Bt.......t...=;..(.i.tbl.J...5.r.!b.Q.}H.J..../.....(....=%./...MzJ%..A.z.3..W..Mz.........../......./...................................................).T....{7.T.Q.....T......'T......)T......,T!d..{.wT%A...MzT.Q...........0...........e....4.........................A..:4E.2..p1......(...`.i.....(...(...B.a.c.k.g.r.o.u.n.d. .-. .Y.e.l.l.o.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.1.9...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e...{7......{7..5'.C.v...Y}E..,.......,Ou!.I.k....~.2...........\...............D...t....)..{7............'...,...............0...........e....4........................yf.....F.Q.........(...pO;.....(.......S.t.a.t.e.m.e.n.t...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000F.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.100434952455907
                            Encrypted:false
                            SSDEEP:96:EDsOJx7JzJ33yFSOGrqIEauyXe9CrBVTCRLDxJzJmfJiJgJh:UsixVdHP7rq1auyXe9CrDORLDLdmxuc
                            MD5:36E32F4108F344ED96B06FCA89AC955A
                            SHA1:67E5BC3916FB3EB4A8A31431AEBBCC55D5956F2B
                            SHA-256:1BB8A7E931CF54484F8804B4BBBA85D6D68CEE270C0BDCE282445C88F1CFC9DD
                            SHA-512:BFB07CD14D09EDACB8FC410E76DEB0807F5555B17034991DFEC99C6D460F278020E2C6BA01463DC567527269D5E394DBFF91E7C70CEB5979726D17B56B755B7D
                            Malicious:false
                            Preview:2...>....... ...v....................................................?....?.............................................................................2...>.......|...v...H............................I.......I.qk..B.....LZ)]+.....)]+...:.UK....)]+...:.UK....)]+..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................x.-..0J.$."V.....N...^...............a...>).A.....>.........f........................................I.qk..B.....LZ...............x.-..0J.$."V............x.-..0J.$."V..........)]+.....)]+.....)]+.........................................)]+j....)]+T.]..)]+.....)]+..B..)]+H....)]+..B..)]+..>.))]+..J...................;........4...4...4.."..............)]+.)]+.)]+..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........)]+.....)]+....#)]+............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000G.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.080350788654962
                            Encrypted:false
                            SSDEEP:96:r5js7YqxszAXsMEAXs9khdCT8RyODKqaao9tbBc:Ns/sUspAXs9khdCQRyOKjG
                            MD5:F15E3E05A7A8C857E1F778FBC7776B20
                            SHA1:319C761A1379347976ACA9CEB452EFE528FF6371
                            SHA-256:8073AA80805C1FA57BFE0AFADB1C89DC3CDA03B7D01A0B78453CD0EC9ED65D42
                            SHA-512:B93D1C6B6FFA6E36007D004C06E7ABD0AC67517BE51B2F47CAC5EC0FC858912FB6D5C5C972BB8376CE698741BED8133146F2C1ABB782F4DB646B0CE5D1A82DD1
                            Malicious:false
                            Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ.H.......H......9.......H......9.......H...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............A~.....2>Qs.b.6....N...^.................Y7t.g@..Z..{w........f........................................I.qk..B.....LZ.............A~.....2>Qs.b.6.........A~.....2>Qs.b.6..........H.......H.......H...........................................H.j.....H.T.]...H.......H...B...H.H.....H...B...H...>.).H...J...................;........4...4...4.."...............H...H...H...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........H.......H.....#.H.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000H.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.020882078195494
                            Encrypted:false
                            SSDEEP:48:BstHPKM6IW7MbtEPEE3pPWXtW9TYSTo5rd6rLIedXiz3RrAg:BssRIW7MbDE3QXA9TYSTARiNwA
                            MD5:FAC81FC29DC9F10EF12FB5A81963F5C8
                            SHA1:FA91C0D576EBE246BB462ED0493396A0DA6758C3
                            SHA-256:90A6C7425294CE998CEA7482FBF8B5951FDE4AAC8F94467FB50547F48AC72080
                            SHA-512:FE54BBEABAB22D5CB82460B59495B883C33C600793955E341F7F286A8FCB6F909C65A1D753A96FC68F9B26409252F1322907E13307C1DF51ADEB2089EEFBAE64
                            Malicious:false
                            Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ...........l......NR.......l......NR.........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............m.^?).&...r.......N...^...............$7L.'.:N....d..p........f........................................I.qk..B.....LZ..............m.^?).&...r.............m.^?).&...r...........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000I.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.051925810045155
                            Encrypted:false
                            SSDEEP:48:Jfswij4Xvoebt0FSEl5XE9KXWacToDrdnrhSIodXYHYU6vK2rIechZ/Y+Whxg:Jfs1eb+SETXE91acT+Rrh8SX8
                            MD5:8B86658147A379F2A7C8222DFCAB1339
                            SHA1:B7C015D8ECF452B06DA48A21E94653316BBCFB5E
                            SHA-256:BA6C5AE090931DF298E5F19313501C651F59CA3F51AE19198D897BE4055B12C2
                            SHA-512:8375A2E26EE20277A794F15AE010985C2032DEB3670A1F371C1A92A9B53CE6734578EF165E0230B466179401AFF1F77E6F15F58BE1162EAE428831BD65ACA091
                            Malicious:false
                            Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ..g.......g...x.......K...g...x.......K...g..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............|T..g.=.6Bic...Z....N...^...............at:...E.3..."........f........................................I.qk..B.....LZ............|T..g.=.6Bic...Z........|T..g.=.6Bic...Z...........g.......g.......g...........................................gj......gT.]....g.......g..B....gH......g..B....g..>.)..g..J...................;........4...4...4.."................g...g...g..z...y.. x.. ...........$........4......7...7........................;........4...4...4...........g.......g....#..g............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000J.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.080773139346554
                            Encrypted:false
                            SSDEEP:96:T20sbYAX2GZ5EHhMX7M9lutT1RyExwpkrwOGNh:60sb9X2qmHhMX7M94tRRyExwpkrwlN
                            MD5:10502BCF6CC8CDE6638C246BC9EB5B7B
                            SHA1:8CF2012BBAF8538DEB85EC68C1C2AFBDB6F5D06E
                            SHA-256:658C05983E7138EBD677ED0219764FFA60212CA4473AE223B43D35AE33D7B023
                            SHA-512:46BA7B03314C3E8F9335A686F92757FF204BCE3E79E9C3647549A5BAB63F864784F08027F60E3B6747D50E288A8FBB90EA05318EFBCEE82C8F540F9DC13AFE3C
                            Malicious:false
                            Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ...........f....Q....)S...f....Q....)S.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............V..s,...r.. .iY....N...^...............(...MH3B....._.........f........................................I.qk..B.....LZ............V..s,...r.. .iY........V..s,...r.. .iY........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000K.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.072731558711374
                            Encrypted:false
                            SSDEEP:48:YxsoQKNsQKAxUyTSV+t32iEEjXk9FaEPToqrdDrqIrdX9dRosQkn4wM2zJ:qso9LHUNknEiXk9gEPT7RPXQLklM2z
                            MD5:63782E9FFB863E8FAF3168E95417ED8C
                            SHA1:C8A7242AAE36783B15DFC9DED6607774490C0078
                            SHA-256:228EC7930CFA806D889B37EB4F0A1B4A3BF143E2EBD16E12F9DD64CA87AFCB62
                            SHA-512:4F9FF78E53E6A872A4FDB64269E9C988B39C8BBF7FE41A7DE7B70BC25A535C4B7015C0E8BF43C490BAB162263917C466C030A1659160F9B7E831169E8AC7F920
                            Malicious:false
                            Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ...........{.O.,wm1..*{...{.O.,wm1..*{.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............g..Y......S.(.O?....N...^...............s.TJ.Y.G..ve.h.i........f........................................I.qk..B.....LZ............g..Y......S.(.O?........g..Y......S.(.O?........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000L.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.086350101975093
                            Encrypted:false
                            SSDEEP:48:YTe2sMOehFidytTeeEYwmXM9+QmTow0rdmrfIidXSlRPtJJ:H2sWh0yRhEYbXM95mT30R2R4/
                            MD5:6199E897C6326784AF70A786949A9BF9
                            SHA1:F9D843DB51FD78B1D091AF5F754E4D37340A57A5
                            SHA-256:BAE9652744A37888E7E347C6FA5709559D3FFCB4846311AA375CF32149B5B9F0
                            SHA-512:0876798022DC671F1C81D5FAE6BB28E2301F1CA8B3C86C03718FCEB4D9A75639EF6CBDAF55DF35D9C1B7564EF4B4268EE8153D33F569DBC89D04E70489719F43
                            Malicious:false
                            Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J...........................A.......A...E~"..6.~.7...I.......I.qk..B.....LZA...E~"..6.~.7..A....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............0.+B.$.P]........N...^..................E.|.F.& <.4.3........f........................................I.qk..B.....LZ..............0.+B.$.P]..............0.+B.$.P].............A.......A.......A...........................................A..j....A..T.]..A.......A....B..A..H....A....B..A....>.)A....J...................;........4...4...4.."..............A...A...A....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........A.......A......#A..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000M.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.064182572196546
                            Encrypted:false
                            SSDEEP:48:YNM6zs8VgqK/bkgkV0tW12En6rpXg9DtLeuToSrdvlxrsITdX5JK0RPXhb/KA2hg:6s//bCV0YAEsXg9ZLXTjRHVf
                            MD5:F9E6DAC9172248443A4FE3224F2FFBB9
                            SHA1:6787B9DF82D9A32CB534BF56D8A831BB06BDA46E
                            SHA-256:78EE1E670ABD482E13EDA8E238705AE1A435C2F870DE2B66BF2049111AE25D94
                            SHA-512:BB85D6245884906F20A07B3F52B5A6908C2580F46DF020F464AB4A7F5930D6C158C1DD86891A3EA315899A6E2C683AEBBBFA045541A74AC4861429B0177ECD32
                            Malicious:false
                            Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J...........................u0......u0.W.....&...DS..I.......I.qk..B.....LZu0.W.....&...DS.u0...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............HqUJ..............N...^...............F.x9..L.....0.P........f........................................I.qk..B.....LZ..............HqUJ....................HqUJ...................u0......u0......u0..........................................u0.j....u0.T.]..u0......u0...B..u0.H....u0...B..u0...>.)u0...J...................;........4...4...4.."..............u0..u0..u0...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........u0......u0.....#u0.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000N.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.0877180116116065
                            Encrypted:false
                            SSDEEP:96:9ks9a/Ja/Ma/QZDZYwEXg+XY9s0YmTXRjOpa/Ma/M/1a/Ba/9xa/y:9ks9a/Ja/Ma/QZDGXg+XY9RYmDRjOpaZ
                            MD5:560523F1B9A5ED2D1DDF8D13CC79454E
                            SHA1:3CCC35C619C3F212922AF2BFB77B037BEB659A6D
                            SHA-256:C450A51B159784C6D54BA5F251651591908AB3E6446F67DADFEEF285BE5670EC
                            SHA-512:14E3688C900F450C790B8B5FEC11C1F0D0D0CB0A875A55CECF6FF55E515F110BF24FA7AFB8A9077BC881C0C850B56775A452681EE7DFB86723CF574EEB7EB851
                            Malicious:false
                            Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J.......................................B...+..@!....I.......I.qk..B.....LZ....B...+..@!........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............N.S_.....[.b.:.....N...^...............F.?.Y|.G...1.e..........f........................................I.qk..B.....LZ.............N.S_.....[.b.:..........N.S_.....[.b.:.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000O.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.080532173786952
                            Encrypted:false
                            SSDEEP:96:6i2sVC4nblbEXXc9eqtTJRIhZCXCmCRCMCXCnCCuC:esVC4bOXXc95t9RIhZCXCmCRCMCXCCCL
                            MD5:844D818DB207107866CEB9548390BB37
                            SHA1:A85BA8FC607E0B397373A7EA0157D41AFF791B58
                            SHA-256:3CE6F984D6549B552D0DDAB65120968295D412F08FCC2E0F5AFBAADEA845CAF8
                            SHA-512:A795499C2DBC20E73B5122B9675FBEF3C8C240E27F193DD831C90A5A64C401C1C912CC9F0739BA1AAFE858E84BA1DFCFAEEAE96DBD1FBA9D98BDBBB29FFC465F
                            Malicious:false
                            Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZyQ......yQ.x.......im.yQ.x.......im.yQ...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............2."....r.m.#......N...^................J9.UsH.{ v;R..........f........................................I.qk..B.....LZ.............2."....r.m.#...........2."....r.m.#...........yQ......yQ......yQ..........................................yQ.j....yQ.T.]..yQ......yQ...B..yQ.H....yQ...B..yQ...>.)yQ...J...................;........4...4...4.."..............yQ..yQ..yQ...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........yQ......yQ.....#yQ.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000P.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.047935897007364
                            Encrypted:false
                            SSDEEP:96:esJIXs+rEftXQ9h9TdRf7kqUpxxqrjDy:esiX+FXQ9h95Rf7k
                            MD5:ABC5C53D7C4748D27090E1EC83382C32
                            SHA1:C713C5E5469C6306736ABCA2405CC6BE88B03394
                            SHA-256:68E4CCB5E8A9CDA1EAB8EC0E13AA3BEC5B54148A66795A8AE28FBDE83E0F3F64
                            SHA-512:8E0C9128942DB163A3EE103B4BB8B5FBE7126D525849140CC739E076F6CD33F7B390EF27B7381E01D382301FF3E48663E650D39F69DD05093DEC5683BB3A3C91
                            Malicious:false
                            Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ.............|...zt...~.....|...zt...~.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'......................U..?.'....N...^................Si...sC.Px.3..........f........................................I.qk..B.....LZ.....................U..?.'.................U..?.'........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000Q.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.064448243190853
                            Encrypted:false
                            SSDEEP:48:YpsSLSM+ccQO/Ut+WEFnMXU9d7ToKrd2trIIndXBVR5Ji7YPF:yspact/U7EFMXU9d7T/RehX
                            MD5:4589A797A804FBF10DAA6574E55137F5
                            SHA1:AD9CA2B3750CFB8C5ABBA2EDBE64749164686F67
                            SHA-256:2955B28732125668DD85ACCE32098E95B1765B7E91CF72E8326FA6E544FD38AD
                            SHA-512:B51AC56473BA33B86F875A2F77E0D532CDAB2CB089E38C6CF41507276BC463CB4BCBB5868FAA6846222F00F6C67D29C0FCD52C96780DAFFA0DFCCF9CF3B29E89
                            Malicious:false
                            Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZTal.....Tal...,Y......Tal...,Y......Tal..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............N..%..........V....N...^...............n.....D..g./.g.........f........................................I.qk..B.....LZ............N..%..........V........N..%..........V.........Tal.....Tal.....Tal.........................................Talj....TalT.]..Tal.....Tal..B..TalH....Tal..B..Tal..>.)Tal..J...................;........4...4...4.."..............Tal.Tal.Tal..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........Tal.....Tal....#Tal............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000R.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.102631306945948
                            Encrypted:false
                            SSDEEP:48:xsUhrRYqb4t/htH8EtSOXpO9i5TosrdfokrrlIVdXTukms8a:xsGeqb4ZbH8EHXU9i5TNRfHr0Y+8
                            MD5:9B6C3B3449F305241B6A0A167E2532A5
                            SHA1:B21139DDE7B0928989F32DADC52CBA023AE1D3C8
                            SHA-256:DB785B738520CDA7C1F6208245BAF42698B90387BA8D9FDE18EFF1BFD6585696
                            SHA-512:12BB67209EF7B711869DB7A1CA1FEA21370F1E4EDB13FEFA45B55056DAADFF1BA3E04A5B44F5529AB5FFC48D7D72C07C2A2C6E9660901888523FC3D564C23281
                            Malicious:false
                            Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ..Y.......Y.31..,%c,!...Y.31..,%c,!...Y..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............^Et$o..3-,.=n.@....N...^................p.Qe4.J.l.............f........................................I.qk..B.....LZ.............^Et$o..3-,.=n.@.........^Et$o..3-,.=n.@...........Y.......Y.......Y...........................................Yj......YT.]....Y.......Y..B....YH......Y..B....Y..>.)..Y..J...................;........4...4...4.."................Y...Y...Y..z...y.. x.. ...........$........4......7...7........................;........4...4...4...........Y.......Y....#..Y............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000S.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.033755994798817
                            Encrypted:false
                            SSDEEP:48:hsPm9noEhKJtRtkEno3ZcXfc9jCirJTorrdlruIodXcwvkrEd5XZHQoa:hsE5KJ5kExX09jC8TKRpIpOo
                            MD5:FC0BAAC32006F482ED6A3E19B1A0AA85
                            SHA1:0955840BB761741880556FA9F95D4FBDC7D4F829
                            SHA-256:DAF9740BBD9AA0C0208E3BD0E2768FB977DB7D74DB03227F2C420E58CF2641BB
                            SHA-512:91E39C44D32CABE34F07E000E774C89F7CF3928289F0E00B7667D3ADF92F170A1D0A0016F4BAC4986F0D8658C193EBE60F64446C1A5FF925C4E940390A46B2EA
                            Malicious:false
                            Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ..............g.-.*.X........g.-.*.X.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............,.f.U... `..+$[....N...^................-.....I..&...........f........................................I.qk..B.....LZ.............,.f.U... `..+$[.........,.f.U... `..+$[........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000T.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.097020699052482
                            Encrypted:false
                            SSDEEP:96:1sSwtp9GEFmLy+8E1bXMb963TjRRcuvtunUmEQI:1sSwtp9GEP+Z1bXMb963HRRcOtunUmEl
                            MD5:5EB803360C3632627F6BB04B0198C233
                            SHA1:DCA7C18AE93DA0A505B9C08D856907D65BDE8E12
                            SHA-256:DC94CE817B8EFF89FB73B4E839660BF2B9E1EBE23F5E97A2A8C9417CD5AB341D
                            SHA-512:99A3E712987DAB4512C3C6996E35DA651ED6FBD06291DF5E476C640D1AC56961B6993D91D1C86D5F7FF45EE21D53ADBC6E5C7ED01563DA9B554EDCA5C47189ED
                            Malicious:false
                            Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZv.......v..V.p....`*...v..V.p....`*...v....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...................E........#....N...^...................O+.C.. j...X........f........................................I.qk..B.....LZ..................E........#..............E........#.........v.......v.......v...........................................v..j....v..T.]..v.......v....B..v..H....v....B..v....>.)v....J...................;........4...4...4.."..............v...v...v....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........v.......v......#v..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000U.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.128950107024672
                            Encrypted:false
                            SSDEEP:48:c3dsYJqgOv0tOwYEtAXk9ZvpBMToHrdjreIodX4jRy5upig:+sTgOv02E6Xk9ZhBMTCRv4CyY
                            MD5:8633A74C1A960267D04933A555C114E4
                            SHA1:4FADBE6B8CA682A1F57043E8C1E4C8DE89C18E87
                            SHA-256:11BC56EC6B637D5336725FC372EFA49E7A03B0B94DD7C17D9FCECDBAA1B32453
                            SHA-512:C666FD49A51956E845C0D3B6760B02E41E3DDA974F5E5B7BB92ABF6B0711E97A8C79EA6670D2FD72F56884CA8C3F5E47508C1D8B2F3D26F2E1DE3617C60BBC0E
                            Malicious:false
                            Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................I.......I.qk..B.....LZ?......?..L....0!.=.c.?..L....0!.=.c.?...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................4)M...z..K.IW....N...^...............z.#|.B.I...)5Fx|........f........................................I.qk..B.....LZ...............4)M...z..K.IW...........4)M...z..K.IW.........?......?......?..........................................?.j....?.T.]..?......?..B..?.H....?...B..?...>.)?...J...................;........4...4...4.."..............?..?..?...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........?......?.....#?.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000000V.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.174273325378395
                            Encrypted:false
                            SSDEEP:48:RMs7Fzyz6FbFmAUoP2Ett5t8EPlOiKXxK9Wyj0ToordQrSAEIX2dXiDi3i/JFbFZ:KsIS+Etx8EP0Xs9WY0TBRIIKd
                            MD5:C869BFCB8A19816DCD875C3540917548
                            SHA1:118897B37E0DF204691C4C319EBB5A4ED903098D
                            SHA-256:277F700B8BC96AE12B3BA92617423525C8D78D2DDFC80D33A9F07A615AA21C28
                            SHA-512:456AAD2552A75A8671734C56A720FACEA83083CB65CC7411EAE2910227B12E2F6B2EC38B9A76640E5CD5AD9D40C148BB3F38C264EB3A94F916AA3CB0E44D1D45
                            Malicious:false
                            Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................I.......I.qk..B.....LZ............p..,*kf.&^.....p..,*kf.&^......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............jO..`....ML5`......N...^....................B....*..Q........f........................................I.qk..B.....LZ............jO..`....ML5`..........jO..`....ML5`..........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000010.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.136929260143504
                            Encrypted:false
                            SSDEEP:48:FspVsnIDo9LktJWR+EBAC+rtrcXbrc9JRrpToardSrAIPdXvxmtnTp5:FsoNkjWUEBA7tcXHc9JDTXRKRdC
                            MD5:4B4A83CBB220FBC1ACB7D8D5D8184F5C
                            SHA1:D1929394E3F27B74185AFECF7B0640DB2D32DD3D
                            SHA-256:CE3040086197C59F61927AE4F32ABE5825C6CC673A4E074818A128C331A59DBB
                            SHA-512:C4B2989DCC4FB56CD76EF566E8CEE5C8F1DA7CC0755D4A767B992AADFEEB137A4858F59FF8DF59B344D4EF8067A9B20F82A6E235A725D14AB5196496D2DA019E
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZM%......M%......5`U".s.M%......5`U".s.M%...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............G.>..2.../2.b..F....N...^.................lb...K..|..%B.........f........................................I.qk..B.....LZ............G.>..2.../2.b..F........G.>..2.../2.b..F.........M%......M%......M%..........................................M%.j....M%.T.]..M%......M%..B..M%.H....M%...B..M%...>.)M%...J...................;........4...4...4.."..............M%..M%..M%...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........M%......M%.....#M%.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000011.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.102866857942101
                            Encrypted:false
                            SSDEEP:48:dscZZHWXjaCB65t+HeE7CW+kXfk9n7HsTo5rdSrmIydXh0AxEW/IEbVrt:dsFno5RE7okXfk97MTQRKqHh
                            MD5:50EBF2814EC4A9629421AF86F3136E06
                            SHA1:A50A2F6B83600002ED5434FCAC22F4A468EDC6FE
                            SHA-256:5BE6B8442CB649A5586ABABFCECD92671FFE6938AC1B8411E58DCEE8D8908455
                            SHA-512:2CF191B2A350DAEFE91F8BD8D5B9662047B1AEB12346CBA50FB0B5688A452DEBA6F4BCB124DB84596284410C03C757AD5FE2F4743D49A82E6337E2E14FFD07A8
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ..............>.9......e......>.9......e.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................f.pA.:.....L.....N...^...............?.+...AJ.lA............f........................................I.qk..B.....LZ...............f.pA.:.....L............f.pA.:.....L.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000012.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.1306711166735965
                            Encrypted:false
                            SSDEEP:48:psbYK0XAKHvtw+EEC/pXEt97WTojrdSr3IAdXUamQV:psl0XAivtEE8XEt9CTSRKDX
                            MD5:6200CB109F620184D67FA91A617632EF
                            SHA1:4B5C2777B12D7B3AD78AF58AB94BB3E00E1A47D0
                            SHA-256:FD2E91ED440A7F80506060DDBE6762D4EC3BDA139DAF914706DF41BC9766E1C9
                            SHA-512:B2721A5BED9E0D027A52B81728E5F87BC090244D40181A7B876FA18261CF909EF6BF8DF4D8F7953F294629A7BE5DAABC8B94FC89FE36631CCA932163D72324C4
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.x.......x..rc....g9....x..rc....g9....x...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............e!.l....&..~.@.....N...^...............@..Je:.G.0.$&D.........f........................................I.qk..B.....LZ.............e!.l....&..~.@..........e!.l....&..~.@...........x.......x.......x...........................................x.j.....x.T.]...x.......x...B...x.H.....x...B...x...>.).x...J...................;........4...4...4.."...............x...x...x...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........x.......x.....#.x.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000013.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.117354994420598
                            Encrypted:false
                            SSDEEP:96:97svlR6XQaLiwE25XM9/KTaRKgXRWJqcA:97svlR6XQaeNeXM9/K2RKgXRWJqc
                            MD5:9FE1018E65231F2D39A5FCF9D0158B45
                            SHA1:72AF01BCDD3CD5AB759A4C693C2D0246F33CAF11
                            SHA-256:D789E3372B776F5921B2F9B16FB5D20CB2EE1289B3918CF1B1E7AAD6887806BC
                            SHA-512:EA1989419D6C68219C8E442D5048F788C8F508E700D80EA7C202008A3BAC7A3908B6EC87C7A25A92BEECF5107CEE68ADC68C275A4A5F3E45A5EB141CBD152A2F
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZI6y.....I6y....$.,...0I6y....$.,...0I6y..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................(...4J..a.D.....N...^...............Q.2..16E..W...*........f........................................I.qk..B.....LZ................(...4J..a.D.............(...4J..a.D..........I6y.....I6y.....I6y.........................................I6yj....I6yT.]..I6y.....I6y..B..I6yH....I6y..B..I6y..>.)I6y..J...................;........4...4...4.."..............I6y.I6y.I6y..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........I6y.....I6y....#I6y............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000014.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.151101875948801
                            Encrypted:false
                            SSDEEP:48:1vsbDGYLAgAQtfm2UqY8EG9CCZXX89oEkToY6rdSrlICdXm6zLCtzqwAB:psCgAQs2m8EiHX89oRTQRKD9
                            MD5:0D6988DDDB103795CB2D8E9105FE209C
                            SHA1:C9797E162B6D24E91117F574D0D0A91E061032E6
                            SHA-256:D3AA72E85116A6344B15D4BDDAA041CB4E04EB5248D9EB53100CBAEB72BFFA3F
                            SHA-512:5D58AA0CAEA7810C27793001E33C1FF2C02ABA2260A935045351B515922ACF4C5393D8998829F8130FCB691981768DF57CAF2FFF5B874E0456302B84D6CE7048
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZy.......y....`..-.:}&a.6y....`..-.:}&a.6y....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............@.I=.D.=A._#.......N...^.................d.iY.N.w...p6........f........................................I.qk..B.....LZ.............@.I=.D.=A._#............@.I=.D.=A._#............y.......y.......y...........................................y..j....y..T.]..y.......y...B..y..H....y....B..y....>.)y....J...................;........4...4...4.."..............y...y...y....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........y.......y......#y..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000015.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.133911225776184
                            Encrypted:false
                            SSDEEP:48:kmPsPGLAN3jP5tUmEnpDCZPmXO/9BF/ToIrdSrtIFdXbCYopGRsgnrYBPd3:1sNRjP5BE1NXO/9PT5RKwxsgk
                            MD5:1BAAF256047F69B2D912A8B638EE4BE9
                            SHA1:822B2260C16B924C7F9CB46EA1D0C8C09E6D3CD7
                            SHA-256:63C448A108E3AE7A35D9D38FCF6C555D1EF2C058C6E4F6CAEA090F564BC0FE63
                            SHA-512:FC248C0A6096F063F3279F6F7FFF4EDD022F4EF4CEC4EB13BE844EC32443C247018EBE598D1B9F0F05B4DD3BEBA3E2A7250AE3EC6C22B7DFE4B4EB0B8BAE832D
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.l.......l....$.6"..*z.j.l....$.6"..*z.j.l...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............%.L >..!.....u2....N...^.................U...G...H%...........f........................................I.qk..B.....LZ.............%.L >..!.....u2.........%.L >..!.....u2..........l.......l.......l...........................................l.j.....l.T.]...l.......l...B...l.H.....l...B...l...>.).l...J...................;........4...4...4.."...............l...l...l...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........l.......l.....#.l.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000016.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.121582735666145
                            Encrypted:false
                            SSDEEP:96:y0sRlo9Q6g3bChEmnX895JT9RKreoZ5II7G:BsP6gr/YX89zBRKr
                            MD5:3B68E67568F8C0439CEBDAE544DB1D4C
                            SHA1:68E23EE1EF53612F3E8C2C20B15B735DC5289F57
                            SHA-256:468DFCE8F1051441FA72A3C348DBA24EE0E1B80EB193B5A2D4D2F24B08A984F8
                            SHA-512:921141B287FD8E4CD22302528E975F8BEBA7DC52D68027DB75F8620DC1368ACA9D07EC39BDE5C6A128EB63CEEB1E01F2E8C07131D6C8ED0103FDD9D5099DD99A
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.Wi......Wi....%9]a.q)v.Wi....%9]a.q)v.Wi..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'......................w..Y.(.....N...^...............&.a.n#.@.B...l..........f........................................I.qk..B.....LZ.....................w..Y.(..................w..Y.(...........Wi......Wi......Wi..........................................Wij.....WiT.]...Wi......Wi..B...WiH.....Wi..B...Wi..>.).Wi..J...................;........4...4...4.."...............Wi..Wi..Wi..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........Wi......Wi....#.Wi............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000017.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.112712423064446
                            Encrypted:false
                            SSDEEP:48:K0sYWRJWintG3PgElCC58XPw9EJCwL5u5TofrdSrGIUdXggib0Q5aStFit1HH:K0sBJWinooElC3XPw9PwLI5TSRKc1
                            MD5:4AEA43EE35F5C0EBBB171EB2BC25154E
                            SHA1:CAE9A1E51FA45121367129CB9B03E75F93184CE3
                            SHA-256:B5532F7C774935B51D3B2E39518D986DA8C62D60B1EBBDB40A822AF45955C480
                            SHA-512:47BBBF940FD159F8724EEA715238394EF7B845D836C557921BA4E1D68E8C395724394CC06D93C7B2578DA9465D00177067B8B91ED69B08D38D3CFE74CEB717B5
                            Malicious:false
                            Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZe.p.....e.pS.)..&Q]{qu0;e.pS.)..&Q]{qu0;e.p..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............=..#!.(J.z.}......N...^..................g.K{K. ...W0j........f........................................I.qk..B.....LZ.............=..#!.(J.z.}...........=..#!.(J.z.}...........e.p.....e.p.....e.p.........................................e.pj....e.pT.]..e.p.....e.p..B..e.pH....e.p..B..e.p..>.)e.p..J...................;........4...4...4.."..............e.p.e.p.e.p..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........e.p.....e.p....#e.p............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000018.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):3.9830304620256785
                            Encrypted:false
                            SSDEEP:48:KssVVPIEO78kS7ZCw8tZY8E6tiC+GTXg9+nTo8trdSrbIYkdXDh6y0QQavDmnJ6W:Kssz9O78r789E6c7MXg9ATZRKGCci
                            MD5:FAF0DE05BE8B93670C8B640D7985E841
                            SHA1:7F1E72ECE41EE2BFD711A9169A1BD36AC3AA8554
                            SHA-256:7F1B5A5FACFF2B3C5A62CDC2FD8E5170A1159BBD4C49858F8598C0D7204142A1
                            SHA-512:A4331A697E7034C6496C295F75E0800E05AFC0A602AF2355198F9B5812D0174AA20FB96446F94D0CF10DC2539D536DDA038A9F4459DAEDD72D6961BC9515EA36
                            Malicious:false
                            Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZ.............r...S.7i.a......r...S.7i.a......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............#..t...9h.]~......N...^.............../F..>..A.t.J..M.........f........................................I.qk..B.....LZ.............#..t...9h.]~...........#..t...9h.]~..........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000019.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.113704362088093
                            Encrypted:false
                            SSDEEP:48:QTsNpf/UolitAaiEIWCCYyXw9Hgj8ToRrdSruEEI2dXCX7NJvl:QTsD/UoliihEPJXw9HgQToRKubsnv
                            MD5:3CC2AA3D4D8072F2832777932385631D
                            SHA1:927DA5B8ED2AA37CD514BCCA3C8765B59C58DE5A
                            SHA-256:A3ED2489393F306C4A5DF67953C6DCC601DE6F60E953082BD03FA3F092793C83
                            SHA-512:E8396C19700EC62E36AE960ADB736AC77A35D013690F31A0250CF4D879B748CDB1535521AADC100D33E788D9E99C7B83F4F0C37ABBAE34C5398F621CBD977C46
                            Malicious:false
                            Preview:2...>...........v..."...................................................................................................................................2...>...........v...V............................I.......I.qk..B.....LZv.......v..Wpb..8.K.."yv..Wpb..8.K.."yv....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............^ai........"f|......N...^...............I..bJ..C...,l(..........f........................................I.qk..B.....LZ............^ai........"f|..........^ai........"f|...........v.......v.......v...........................................v..j....v..T.]..v.......v....B..v..H....v....B..v....>.)v....J...................;........4...4...4.."..............v...v...v....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........v.......v......#v..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001A.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.068046132870941
                            Encrypted:false
                            SSDEEP:48:82stYI5itYDOEVC/OoXno9vxTomrdSr+ITdXhaT0tQF:Fs/5i8OEVLoXno9pT7RKjo/
                            MD5:DEBB0C0C2747C68610F419353335E06E
                            SHA1:E7768FDFF89F2449D696AEB925DB3EA3E4CD47EF
                            SHA-256:B125D91251898B819441CCCEDEDD5CD705A33D3651A8818C45C7EF2646612724
                            SHA-512:BE5E48CC5B6043CEB965BE8CADB0A8683E469BE78C1785DA8CB5BB2C231F12FF966DCF98F5AD0382FD816C330FC9F4B4B903494D90205233210147C7C69D6502
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ?.6.....?.6......G.....G?.6......G.....G?.6..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............^.Q.y$..#zo5R:gI....N...^................I..B.I..qW............f........................................I.qk..B.....LZ............^.Q.y$..#zo5R:gI........^.Q.y$..#zo5R:gI.........?.6.....?.6.....?.6.........................................?.6j....?.6T.]..?.6.....?.6..B..?.6H....?.6..B..?.6..>.)?.6..J...................;........4...4...4.."..............?.6.?.6.?.6..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........?.6.....?.6....#?.6............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001B.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.136838558611529
                            Encrypted:false
                            SSDEEP:96:81osrzbOWkEsWM7KX9K9H2zWTZRKABKwuE7wRfx:81osrzb5x87KX9K9H2zW9RKABKwuE7w/
                            MD5:531C3961903B6C868FA851E003DCF613
                            SHA1:579AFBC4FA307159C22B7C528FDF49C7905D1D80
                            SHA-256:5B395F551AF9C46C200C2E584BE0123CEFF2A15F98B342EBA73F33F779B74EF5
                            SHA-512:0264C7B087B84D95660AB5903B3CAF64CF68124ACAEA8199BD219B1F9F6ABE36A8D444D58EFDE5A3BE8462B7572CF5833441AA792964AE8C975E8C4397F58679
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ...........U..>./...#V....U..>./...#V......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................+....<Z.e.o},....N...^...............'...<./G.....~.........f........................................I.qk..B.....LZ...............+....<Z.e.o},...........+....<Z.e.o},........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001C.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.1033366560725275
                            Encrypted:false
                            SSDEEP:96:O0sqVst6tUPiiER3ciXw9YTgRKTmot2G+IW:O0sqqt6tU6PxTXw9YcRK6ot2G+I
                            MD5:D9A1A06F1BAC70F9D438EAC640CB4DC1
                            SHA1:D4748C83B6EECD07C08E2FDAE8051E669F5B3230
                            SHA-256:DF30E015B09041B18A2808562BD7D695F54B3315C69993D00256791E8871E4B9
                            SHA-512:277810C3773C5DEAFB5EF746B50A377DC22D97536C26049C29C78BD6FFD185F26DE1606C4B8F28A9913D40E810D9E7D9E187F2091156683B6E37F43674CEC1CC
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.oW......oW.....+.Y......oW.....+.Y......oW..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............T.$...x..ur.nEE.....N...^...............u..... N..N.............f........................................I.qk..B.....LZ............T.$...x..ur.nEE.........T.$...x..ur.nEE...........oW......oW......oW..........................................oWj.....oWT.]...oW......oW..B...oWH.....oW..B...oW..>.).oW..J...................;........4...4...4.."...............oW..oW..oW..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........oW......oW....#.oW............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001D.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.12469372014053
                            Encrypted:false
                            SSDEEP:48:gashTIAh1LrSh0tADYTKeENAIWCp2hlXs9PnLl0TobrdSrssI4dXQm5hK35SoW9:ls3uyCD4ENA1s2bXs9PLl0TmRKsSn
                            MD5:B9B2760B32E884ABE890048E07391F75
                            SHA1:1921084A1630EB97ACFFE9F2BFA6A4F20117E4E0
                            SHA-256:7C8D0114F994532EEC8EEAD39316F18182485BE2AE4DE0D106BD5CB57412141D
                            SHA-512:51649487C33D9EEB662EE9F90FA21063A3CABD554664ACB4A06A5879193218E86924E5B810DA07BC02CE0FDF0BF0196A6610E3D0D0D92119B943DC88F434F2AC
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ<n|.....<n|..G.....g..H)<n|..G.....g..H)<n|..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............zC.O...0>.E.L.j....N...^.................v.5.zH....~..*........f........................................I.qk..B.....LZ.............zC.O...0>.E.L.j.........zC.O...0>.E.L.j.........<n|.....<n|.....<n|.........................................<n|j....<n|T.]..<n|.....<n|..B..<n|H....<n|..B..<n|..>.)<n|..J...................;........4...4...4.."..............<n|.<n|.<n|..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........<n|.....<n|....#<n|............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001E.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.036312874882139
                            Encrypted:false
                            SSDEEP:96:KMs8G21XXak2swEyr6Xo9PTARKTGHXat2EZI:7s851XKk/yOXo9PkRKTGHXat2ES
                            MD5:CB5751608546B85F83746AC2C2B3F9AE
                            SHA1:0AF8EC9B5C14A699C6685268C9D42E373D597B5D
                            SHA-256:1188F215DAA171F0D1AE8D00F9CB04A965F997B6C130946EB365F98ED0946EFA
                            SHA-512:CCE6B31A893F7AE37898C9EFA7ACCA8753913E0BBCBDFE55828A78336C50E599A69DE915A8CE36D4E8A7092CE331D21C675F47393F195A09D8E05ADE78894996
                            Malicious:false
                            Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZk.......k..3..P.'.....k..3..P.'.....k....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............e...ze .....:..+....N...^.................I.ne.E.n .[..5........f........................................I.qk..B.....LZ............e...ze .....:..+........e...ze .....:..+.........k.......k.......k...........................................k..j....k..T.]..k.......k....B..k..H....k....B..k....>.)k....J...................;........4...4...4.."..............k...k...k....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........k.......k......#k..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001F.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.118506339984326
                            Encrypted:false
                            SSDEEP:48:FZMssHRog2TG42wbt3sEJlCDcXHEmk9HR/G5mTodrdSrdIv2dX2GISmVAZTTFI5R:FZMssxpw2wbGEX1Xm9BmmTgRKDvjBUh
                            MD5:B1D77D3674CE9B573DC5CD41AAA27A36
                            SHA1:8D5A3EA8BD8AA262E9A456760212396F77F9FCF1
                            SHA-256:B37E0C2555E8D2F76A1E7F27DB960849846E339393CC03510CAEE5AE782C5A9E
                            SHA-512:D2E8914E8144BBBAF34D0846FABDA6DB332618ED31BACEC86F55DD4606F1A3CCD3369D3FBF3CED3A2F89991EA35A55BDAFF4F6B33CFB967E0D1D20DC1F42C11A
                            Malicious:false
                            Preview:2...>.......(...v.......................................................................................................................................2...>...........v...P............................I.......I.qk..B.....LZ............ .#.6.?/.j#.... .#.6.?/.j#.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Ma|M_.....a....l....N...^...............C...v..B...D.dB.........f........................................I.qk..B.....LZ............Ma|M_.....a....l........Ma|M_.....a....l........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001G.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):8192
                            Entropy (8bit):3.598326095112602
                            Encrypted:false
                            SSDEEP:96:ZDMGVKQLC0kEqArjkE8EG4ImEVjc4IrH4IAXqxNbNs+kj:uwKQnq8tZODVjUrXtxNbNs+kj
                            MD5:F08419C341F3608BA1F1420FE280F321
                            SHA1:A6570101904EF747D4CD1DA8BE88731258855169
                            SHA-256:324716FC20FBC632D3A998FD02AC7A1E864AD55DBDC5B4C50A50F811D26B9D90
                            SHA-512:66CE88FD45AB1598597429D76A36CC407C64B8D4B4038FA1A91ED082A1CE4B1BB2015ACDE1B984618C7CC52DF3D8EA18F75E2E9EA676E07B62FE22D06756D109
                            Malicious:false
                            Preview:\...8...................................................................................................................................................\...8...............0...........................z9......z9..!.".!.|...q.N.......N....ZA...lW.X}....D./.-.,B........c~..l.'...V!...ac~...:.M.p..9.....W..:............:.......:.................................................7VB.....7VB..EPJ..w.`.).:.......:.M.p..9.....W.2...........^...............\...N.....(.R.<.7VB.....c~...:.......N..T.v....(T)...R.<T....7VBT.2..c..T)S...:...J...:..."...:...j......R.<.....c~...c..,0...e...B4.$...........GP..A..}.....J......................W.......W!h~7....k.!.............D./.-.,B.......s....a..D......z9..!.".!.|...q.z9..c...XSW@....@..'c.......>.......l.......c~..l.'...V!...a.......&.N...m.N....ZA...lW.X...........0...........e....4.............."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w.......B.^....F...r.QH.....(...........(..."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001H.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):20480
                            Entropy (8bit):4.613151176441738
                            Encrypted:false
                            SSDEEP:384:t5HRovUvugf3uQuivau4uRtMDfBIYuuZe7CVraRMo7EzDZbqNp72TgSIDfY6e:t5H+vUvugf3uQuMa3uRWDfiYugeWVrm6
                            MD5:28B8A679B4AB5B99F89685DEB82D5955
                            SHA1:2B5797553961177485135F4F0F8A6AFD17DDA816
                            SHA-256:7FC7EA9E0F30D4E1E5741D3CFED69D075F194C26856211A58269BD19B4A6B2B5
                            SHA-512:2099A697553D29799037B1D63FCF551E7AF1CD9C51245B4CA52AC8BAA83410E82AB28BFDB1BCF1336EC29BB0BC9E07778356D8F7E2CEF8541480DA326CEBE171
                            Malicious:false
                            Preview:....>...........v........@..( ..`J..........>...t...8...v........H..( ..PI..................................................................................>...........v........I..( ...I...............I.......I.qk..B.....LZF.......F...9=..9.1....D/f(@.g.!b.a....D/f.F...9=..9.1....F....I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'................=......}.i.N.....N...^...............g.n...NI....hj..............J...............................4....I.qk..B.....LZ...............=......}.i.N..................................F.......F.......F...........................................D/f(.6..D/f(.z..D/f ....D/f$....D/f ....D/f(.5..D/f ....D/f$........F..3F..8F....z...y.. x.. ...........$........!..7!..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3..............Z4...........................................4../4......p...............C.a.l.i.b.r.i.....

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001I.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                            Category:dropped
                            Size (bytes):22203
                            Entropy (8bit):6.977175130747846
                            Encrypted:false
                            SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                            MD5:2D3128554F6286809B2C8E99DE5FD3F6
                            SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                            SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                            SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                            Malicious:false
                            Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001J.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):8192
                            Entropy (8bit):3.9685355362940453
                            Encrypted:false
                            SSDEEP:192:jsCAEoZ7coP20XhSXTR/MxkOOpsrB9kHnKGXq:Y7rNcoP22hSDR/eOpsrrkHKG
                            MD5:5525343432AD411AEEDFDD733A981BFA
                            SHA1:5FEB54DAFBF55953DA3173D5416C01D44F267012
                            SHA-256:28288E656B6B1A94C4DFB6AF0ED786C0A69ADAE00778ED162A348660C3C2802F
                            SHA-512:F24ACD64722D8A5B362E02F79CFA1CE9A107427EA1E5C0B6B575053427B451B6D9A4C9C1232BB25EBDA166C2173DC265FD938D6E98859CC198FB70B1E29E0465
                            Malicious:false
                            Preview:2...>...........v.......................................................................................................................................2...>.......Z...v...&............................I.......I.qk..B.....LZA.<.)...A.<.h[....q.9...A.<.h[....q.9...A.<..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............\..$.5.%.W......N...^................T..c.I.5.t.D.5.................................................I.qk..B.....LZ..............\..$.5.%.W............\..$.5.%.W...........A.<.....A.<.....A.<.........................................A.<j.h..A.<T)...A.<.....A.<..L..A.<H.]..A.<.....A.<..H..A.<..}.......Z4...........................................4../4......p...............C.a.l.i.b.r.i..................A.<.A.<.A.<..z...y.. x.. ...........$........4...!..7!..7...............A.<:A.<FA.<GA.<..z...y.. x.. ...........$..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001K.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):52945
                            Entropy (8bit):7.6490972666456765
                            Encrypted:false
                            SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                            MD5:AD003F032F32FAC4672D4CE237FA5C5B
                            SHA1:AE234931B452F0D649D91291763B919CF350EA49
                            SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                            SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001L.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):3.542671804323532
                            Encrypted:false
                            SSDEEP:192:Cs5tj431n5NTjD19X1VkUOuRtIuTnnGcmHh01np4hU9c1j5MNmYwEm:P4FzTjD1lbkjuRtFn8K1np4h4c1j6L
                            MD5:A1BE90F04EB800E7B5B832AF05E197ED
                            SHA1:26EBB1C9E44138A89B505AAF2D6AEA91DABE3FED
                            SHA-256:B5B2742C3F837EC63BE02710EAB14C0F41230C18551D9307E2E10BCC4D1DEF67
                            SHA-512:696990D0776864AF5E45ACC7DC58CC080A2F8C6F9C705752706DF41C48DAAE0C02BC3E83531FF6426200FC5168BC3A3625B0BFCE90153E3386DDEDEA9929EC04
                            Malicious:false
                            Preview:2...>...........v.......................................................................................................................................2...>.......@...v................................I.......I.qk..B.....LZ].B.9...].B...e...`.,^..].B...e...`.,^..].B..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............cX....5D...H.....N...^.................Z...bL....-s..............................................r....I.qk..B.....LZ............cX....5D...H.........cX....5D...H..........].B.....].B.....].B.........................................].Bj....].BT.H..].B.....].B..\..].BH....].B..3..].B..O..].B..........Z4...........................................4../4......p...............C.a.l.i.b.r.i..................].B.].B.].B..z...y.. x.. ...........$........4...!..7!..7...............].B:].BF].B..z...y.. x.. ...........$......

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001M.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):25622
                            Entropy (8bit):7.058784902089801
                            Encrypted:false
                            SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                            MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                            SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                            SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                            SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001N.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):20480
                            Entropy (8bit):3.20069934160581
                            Encrypted:false
                            SSDEEP:384:i0SsxWYNIeOagIu9rSEGKFRSO1aualK4A2y6XnAMvbMR5:iRsxrNIMgIu9rbGKFRj4ualHA2y6Xn
                            MD5:7A9F8F816B379E93409A36A8A281DCF3
                            SHA1:6FBEAADA06AA6C3D2F502D544B2C586D9062C245
                            SHA-256:09656975C7CE1788A332DA8F4B7FED8B163530C0045C3427AD9042A81E1DEBB5
                            SHA-512:C634842C6646CA2EE3942F65B0B743C946117A9789146F2CF8D5AC3857418620E8304B6535A3FB3E8E2D13122D7E21684DC4FB7E4901FB60BD4612E0C72C7E5E
                            Malicious:false
                            Preview:2...>...........v.......0 .../......Z......,7.>?9m.........Z......,7.>?9m......I.qk..B.....LZ................................2...>.......B...v........-..............v........-..8....................I.......I.qk..B.....LZW...T...W....q..<....'..W....q..<....'..W....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Z......,7.>?9m.....N...^...............Z_...,H..[q...........................Z......,7.>?9m.........Z_...,H..[q...............Z......,7.>?9m..................................W.......W.......W...........................................W..j.e..W..T....W.......W.....W....a..W.......W.......W.. .H.......z.......R...................!..7......}.....W.i.n.g.d.i.n.g.s. .3.......................Z4...........................................4../4......p...............C.a.l.i.b.r.i..................W....z... ..$..............

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001O.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):15740
                            Entropy (8bit):6.0674556182683945
                            Encrypted:false
                            SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                            MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                            SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                            SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                            SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001P.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):3.770362095517941
                            Encrypted:false
                            SSDEEP:192:FseYmVqr0rWPBWR9qXIsTbzRtEdHyfeXxealC4XtVN9JpEWMeDFm6EFxK:6eY+s0rW0AIibzRtIHyGXnTXtVPJpE8/
                            MD5:3DE98E165475D2689FD2B8B6AED00510
                            SHA1:1DE5871489F0857506DB943664F0CF946DF4EDEA
                            SHA-256:A6F15B0E0B44FC3BDFEE2B3CFB12C44026E8FC7FF03EEFAA2186715394008F1F
                            SHA-512:C84D8381AE4D471BE8503C460B06D0DF8DE72F13A347051368DF7EAB449F56D60B58EE8D21B81410EAEEBDC3FC811E1E577EF7B749394FBA38ED32003EB4573D
                            Malicious:false
                            Preview:2...>...x.......v........ ..`!..2...>...........v.......@................................................................................................................................................I.......I.qk..B.....LZ....9...........+..k..........+..k.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............T{6..).3...U.......N...^.................x..M..A.....................................................I.qk..B.....LZ.............T{6..).3...U...................................................................................................j.......T.Q...............n.....H.........9.......V...............Z4...........................................4../4......p...............C.a.l.i.b.r.i...............................z...y.. x.. ...........$........4...!..7!..7..............'...%.........z...,4. ...........$>........4

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001Q.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):55804
                            Entropy (8bit):7.433623355028275
                            Encrypted:false
                            SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                            MD5:4126992F65FE53D3E3E78F6B27FD49DC
                            SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                            SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                            SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001R.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):4.6362755485038285
                            Encrypted:false
                            SSDEEP:192:tgsQgVZTGpJG9xIAJwKujsqoCUvK2Fs/Hcw58mX/nNmyhIRtYQAed5GyC7gg9Koo:/Q0ZTGpJGnIAfuoqoCPosvcw240RtFAf
                            MD5:6E0E948A0DB93D9B743C97238AE904A0
                            SHA1:D61EE811E0DEB674116737B81A4B6187CF591699
                            SHA-256:A7D2ACF6C3C817FE433CB13F37FB96D4247B55D6E6EAA92BEC96777C1CAC8581
                            SHA-512:65704B877D360395A092B6B11F110AA6C1AC03986209B37D6BCB797CB57373D91ED24C5CBE305973D33A89458531CC6532F0F8BA13BFA3E86D693FF2FCBA9226
                            Malicious:false
                            Preview:....>.......>...v.......0 ..h+......>...........v...Z...@...X*...........................................................................................................................................I.......I.qk..B.....LZ.".......".7z...>>7Y.=u..".7z...>>7Y.=u'."...I.qk..B.....LZ.I..7+....M..a.(~..7+............I.......I...................................................I.t.....I................................................................4..'...'.............^ca.C..@.jW..ad.....N...^................V0C.|.O.d@>. xA.................................................I.qk..B.....LZ............^ca.C..@.jW..ad..................................."......."......."..........................................7+...|..7+.(....7+.(.z...".j.N...".T)...."......."...b...". .......'.".8."...z...,4. ...."......$>........4.."..7......A.g.e.n.d.a.:.........................Z4...........................................4../4......p...............C.a.l.i.b.r.i..................."..."..."...z...y.. x.. ..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001S.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):41893
                            Entropy (8bit):7.52654558351485
                            Encrypted:false
                            SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                            MD5:F25427EFECFEE786D5A9F630726DD140
                            SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                            SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                            SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001T.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):4.578266489601026
                            Encrypted:false
                            SSDEEP:192:nsumH2sXBF9f4/+Yd0xwdUJYTwGUCDehGHhQoXjoG/U6RtkGSx/B5nWRUkY99hax:sCsXBHA/+YdZUJsLFDehmhH7vRtAx//u
                            MD5:A2B69833CBEFE33A9CA755A9234E7458
                            SHA1:0E9A68388C8ADB612188C7EEC6E80A288F0D049D
                            SHA-256:DDA4477CE020C309CA88AC202E8DFD6FAE89EF567381512ECF6FA46B5EED952E
                            SHA-512:A49179F72E062B44876D73392BDDA0B46E3E51E3C8F0F173AF6F2C5DF5BF450EAF7475578D91217D445D4C8A686ED31EBCE54412CF27A3906FD4D904429B315E
                            Malicious:false
                            Preview:2...>.......,...v....... .. +..2...>.......|...v...H...@....*...........................................................................................................................................I.......I.qk..B.....LZ2L[.G...2L[g..<..6......2L[g..<..6......2L[..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'......................@..T.....N...^...............0=b.R..H.._....I........V...x....................................I.qk..B.....LZ.....................@..T..................................2L[.....2L[.....2L[.........................................2L[j.A..2L[T....2L[.....2L[..r..2L[.....2L[ .7..2L[.....2L[ .........Z4...........................................4../4......p...............C.a.l.i.b.r.i..................2L[.2L[.2L[..z...y.. x.. ...........$........4...!..7!..7...............2L[;2L[.2L[..z...y.. x.. ...........$......

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001U.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):14177
                            Entropy (8bit):5.705782002886174
                            Encrypted:false
                            SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                            MD5:7CDCE7EEBF795998DA6CAC11D363291C
                            SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                            SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                            SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000001V.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):49152
                            Entropy (8bit):4.675179960179007
                            Encrypted:false
                            SSDEEP:384:vKog3lXN2puViGR+Rkp/AmbfQ8JLvpB0EPx8cK0bU1u8NY6lQs8A8AXMRZ6M7oxf:axN2vGftFBMNBlGJKvM36b
                            MD5:78BFF816F891389B28021C9F8036332A
                            SHA1:67E1C18238DD0AEE87409831571A19C6522EE372
                            SHA-256:604F2384FC21BF7FB010BFA8DA9473D1FF675BEDC3A9939D3ABD998F434C5EB4
                            SHA-512:1DFCEBA1474871AB20C694DC996703A09F2013DCD8FD24E666C84431DC70EC4F1402940FDE6385B47718F1F909C5571AFCA23C89C9F93AB2B475818961EBB9AF
                            Malicious:false
                            Preview:....&...2&.......%..J&...... ..H@...a..H...........&....%.......%..f&...... ..H@...a......................................................................&....%.......%......... ..H@...a..h........?.......?....'H...^GQt.i.......i..../....a.(>....g)".............jKA...d.+..(>...jKA..QI..Hx.:...S.QI............X.......X..................................................?.T%......T.1..0..T....8..T.......T.$.....T.......T%...N.HT"............0...........e....4........................u.^s.Q.@.).~b.......(...@kO.....(..."...P.l.a.i.n. .a.n.d. .S.i.m.p.l.e...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.5.2...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e.........#.......#....{..%y..??k................F...7..s.2...........2....................?......8...........%5..Gb#...................i...c..,0...e...B4.$........{p.....G...^...?@kO.....................Y.......Yq2.MM.o.v...+-3c.....-3c].e...u%.0Z..#`...`.. ..X..Q#`..*<A.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000020.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.34319553617969
                            Encrypted:false
                            SSDEEP:48:4sv19KFFoSTDYtxoz73E8oieX0/W9k1uvcrrdhSry3iGtXVWC49SoV:4sDsom80TE8WX0/W9xvGRApGu
                            MD5:7E13FEF725C21A97534299700AA95116
                            SHA1:348905EA6458949E0A74BB2703B2669C2937E55F
                            SHA-256:61E27C51C9817084CF386C8892F9C6484E8E03B756D3B2E28A67C72DF61F9AE0
                            SHA-512:5DBC4CA157067316ED8FB95A818BE0171300CB20358FE7107BC833BF89304897E32E8A5BCB1A947DC0E40946852186351DBA14F8F9C24E24192B939DCBBC95CF
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ................aV...........aV........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............A.-TL...f..........N...^...................l.LH.p..k..........f........................................I.qk..B.....LZ.............A.-TL...f...............A.-TL...f..............................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000021.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 814x105, components 3
                            Category:dropped
                            Size (bytes):12654
                            Entropy (8bit):7.745439197485533
                            Encrypted:false
                            SSDEEP:384:JheN2cq6MLu6MLGu54cHeNzhcmhcDu53eNE3UPkhrxvu:Ji2Wix7fzVsbE3Zm
                            MD5:4BCCCDBB4273ECEBE216C84930A8D0B2
                            SHA1:FFBF617787E27BC94D9BAF89F2FE34A2BD42794B
                            SHA-256:474F9A8C25D5E21192315397EA995B1E11E2C1608157C6E0277688091BFD136A
                            SHA-512:DAD73A8C0E293B88685C0C71EF15E0DC95EE39B7FC9F849DE5D634173FD9FA0AF0AA96742D9E94BE03556AA4A817D5001C95A6736EAD5D5DF03661876785EB74
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................................................C.......................................................................i..............................................E.....................U....V...f..ASTc.......de.1Qq...!Rb....Ca."r.................................B....................b....Ra.....!Qc.....AS.1U.."C...2Bq...$#3%&.............?......3.....~......:..g..s"......:..g..s"..ic..Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. ..0...Q_..X..V5E~..c..X...@u...cTW...0...Q_..;.m.....@w...Q.+....*.4W...lUFh....v..._..wn...dW....y._..v..E~...*...@wn...dW....y._...v..U..@wn...d..{`;.|U.2g...*.3...:.0?ViN.z.@w...4.M.:m..`~..i7...q...I....J.`l...W..n..PQTiB...6....+..sj.*."...6....+..WA...x..A........(.N6`..AD.q.....'S...t.Q:.l.......f.]..N..0.. .u8..A........_W..Y...}.C...~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~.v..?U..^.r..}..Bep

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000022.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.383271121480513
                            Encrypted:false
                            SSDEEP:96:ngsQBNdeQS2cojDxEpUX/49VzzWlRAVkLPIyQdqbEmQWwIyylyya:ngsq+d28pUXA9Vzz4RAuLPIyf7wIyyUT
                            MD5:4851B23E4733D69828BE4C89D641F314
                            SHA1:924C4DB915DE64FC4B1C120D6E3663B355D20C2C
                            SHA-256:D6C60544D88FBDE44B33C1502E486BDDF32FD9022D6DAD9BB10B4256BA576EEF
                            SHA-512:0AD9596A7C6FA597C2254832945E282B657F98AE48129AA6CBFF2C4F35AFF7FB608A2AD73B2CA597594BF2F9B91679510CA93E4C5A18709B9DCF6C291D24FB75
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ............/...N0.G|4...../...N0.G|4....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................X..+Q...6H.....N...^................u....H...6.nM........f........................................I.qk..B.....LZ.................X..+Q...6H..............X..+Q...6H.....................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4......................#..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000023.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 728x77, components 3
                            Category:dropped
                            Size (bytes):2695
                            Entropy (8bit):7.434963358385164
                            Encrypted:false
                            SSDEEP:48:N9YMsguOZgKAz2vcaQU4R8r4BU0/Rc4nbIQdsohw13ZmFLY6KsVvMdBL2mr:/hsEgNz2v5T/rQC67SoWniHK4EdBH
                            MD5:B23DE98D5B4AFC269ED7EBFDDECE9716
                            SHA1:10AF507A8079293A9AE0E3B96CF63A949B4588AA
                            SHA-256:646586CB71742A2369A529876B41AF6A472C35CC508D1AE5D8395D55784814F2
                            SHA-512:BBACBE205EC0A4F4E3AB7E2B1DEE36FCF087DDF77C7D18B53AEA4B15984A47C64E19F9B8D8FA568620619CEA0361D94FE7ABEA6E502EC6ECAEFE957F42ED7EE8
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......M....".......................................,.......................1....!ABQRq.2a."CbS.......................................................Qa1A............?....{............i........l..-D.q.~..|cS.S...R\..d.8,!.....]f$....Q..di.;~5......vj......MqCe..=.*.f^..=.}.Cm]qCd..s=..u.e..v..t'.,.....S.s..N...>.d4'.,..k...N...d..9....G...y....6J.Y.l.{Vf...^B..i.3.z....:5W#4@.S\fj.%..Mb.5.v.5......S.E..#.v.I.....I......m..H....D..|.Y|...W.Wf..o..U.0.E..@.T.....................................'.S../...Z......!J..1K..rI...T.f.>.+.N..o.....\..^u........e..q.qK.GXP..-...F8".;5J...]Y......j.a.,R.......J.N........z}<qu..J.)`.}X:..}.............B...[. ......,B.).b.......(Y.O....c\.o.e&.W.#Bo..N|..N8.#J.>1D.1..b.&....q.#..UT%,.d.....m&..^...VXA..b.nbTV~.....^........q..#./.I..=Q..=..Y.*.Ib...VZ+......Y.........'.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000024.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.377677294991255
                            Encrypted:false
                            SSDEEP:48:8s1mo4A6QBtjq0E/EQrSXhfS9NTcdrdhSrr7tXMA9TfJ:8sRv6uNrE/1rSXhfS9NTARAH5
                            MD5:C12223215F0F46DD4D2E8D580FED4B69
                            SHA1:02721D67387453F748502ABDF5C83622658991A1
                            SHA-256:E8C02671D4E9523872C09576B134FB05499CA8CDE02F587B49E631C9D2749E7C
                            SHA-512:C6B03A4D4AB89287DC96FD80E833A16629A0A348CAABAE20D762163CA34FABB7EEB4C2A692D6E18DF20D4234DF0F63EB620B1F92EFF29EAF0C339C3682827C43
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ...........Q........;K"....Q........;K"......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............6....N.,H5T../.....N...^...............:N.z.N.C.....().........f........................................I.qk..B.....LZ.............6....N.,H5T../..........6....N.,H5T../.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000025.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 69x630, components 3
                            Category:dropped
                            Size (bytes):11040
                            Entropy (8bit):7.929583162638891
                            Encrypted:false
                            SSDEEP:192:u99+91V42ho91V42ho91V42ho91V4235z9pUkDCyixxo4PS6b8tEy3BcWWhhSy0b:ubKD4/D4/D4/D4uzX38u4PNYJ2zhhmb
                            MD5:02775A1E41CF53AC771D820003903913
                            SHA1:2951A94A05ECF65E86D44C3C663B9B44BAD2BC9D
                            SHA-256:83245F217DEAE4A4143B565E13C045DBB32A9063E8C6B2E43BB15CD76C5F9219
                            SHA-512:5A1FCC24BDD5EE16BC2C9BACF45BCECF35ED895EAC22D2C4EE99C1B7E79C8E8B9E5186E3D026BA08FF70E08113F0A88FBF5E61C57AF4F3EA9BA80CE9F33410E9
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................................................C.......................................................................v.E.............................................S..........................Aa..!12Qqw.....3568rv........".....4Btu.....#Rs.(W..bg.................................D.....................1..2.!4Aqrs....Qa......t..."3BRb....#.$S.Cc..............?...K/h._+.N6.-.a...5...;.r....,...0B.s(..zp..4.%r|q..E.Q^.../...C.R..?u.q8XN.>.e..:..gJ...._.n>.70G,..(........3b.&.5m...Q../...7Ie..k....e.l6..&..`Gt.P.Y^r...=..Y.e...N.B...O.#..J+........u.V;G.'.....V.]8..C.]..........E.....c..w&lX..f..\T.J?...F.,..m|..93........,.....+.R..WG...%.....(@.....p].iEz<.8.^...J.h.....a8P.1......(z..y~.........H.Z^.>..<.....L.k..IG...R.(.%..m....&u...B|.....@]ey.W.J...!d..R.8...[..>8....(.G......!.)X.....,'..F2.Z.t..Aw./..Z..#..i.kK.......b.i...qR.(....RE.............O.XP.#..(...9J..]...,.2.[w....KrW'...tY.......{~.:.+..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000026.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.499438129475946
                            Encrypted:false
                            SSDEEP:96:+sSgK1b4tpzWEP3FxXq9+FcRLIQpKXPPQAF:+sSgK1b4tpn/LXq9+FcRLIQpKXPPQA
                            MD5:5001D0890E51384145C09F921C9B0B13
                            SHA1:5683D19335653068B4CC9AC1BAED5753B1915162
                            SHA-256:FCCC5168F827665FB0E3684D269CEFD016C1F6095F32F7257EB9C25EE73BB757
                            SHA-512:420A59DCFEEA846F4229677FFBEA971EC94E4759E51108A40036A014FFE3F1E681F2D4C3C150F2E33EF4759E55062B7E028735C2900BBBCC36F6B1453FA8C479
                            Malicious:false
                            Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v................................I.......I.qk..B.....LZ..R.......R...D..G........R...D..G........R..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............)....u.%V.-..[.....N...^...............b...3.-L...F*E$.........Z................................... ....I.qk..B.....LZ.............)....u.%V.-..[..........)....u.%V.-..[............R.......R.......R...........................................Rj......RT%c....R.......R..G....R..H....R..>....R.......R .3...................;........4...4...4.."................R...R...R..z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4...........R.......R....#..R............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000027.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 105x441, components 3
                            Category:dropped
                            Size (bytes):2268
                            Entropy (8bit):7.384274251000273
                            Encrypted:false
                            SSDEEP:48:N9YMn9H5gXlM26vroVXWxyNnl1LmLR+rn4FOeewGhDbby:/h9SlMdgm09ll8R2/rby
                            MD5:09A7AE94AA8E517298A9618A13D6E0E2
                            SHA1:FA5181A7414BA32F816BF0C4278EC20C615E8B1A
                            SHA-256:3C68C7EE798E62A4A99C740153F3980D7DF029605C843410942C7F85E794823B
                            SHA-512:074E9A2BE2039D0AFEAD360157550B934FABD0CB86B5AF476C1FBC885EE60331F5A68EAF70BF76E23C8248A20FB900346839F4AA8892370B5889E64948DCC6E2
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........i..".......................................3......................!.A..1Q."q.2BRa.b...#$................................... .......................!12AqQ.............?..D.z.4....;.....7...3.t<!..d.O.....+O+.;.z6.4cz7E.........U.Z)-..@..y...........}(W...<.xv/...5.ew......yN....n.Tk.Tm.Ty.vA=...T..U....h...e.8.5%....'......e^......L.g.$.~e..O.._...... .F`.....xnL.<.......]jfv...}..\G..c.......-%...#.C.|.].`..^..W..c..B..5D.QSTaZ.5A=....BU..z%.4.h.6..=..U...W.$..l...7.:...........IPQT_...~..i..x....~.l.|.n.J..TV.21.Tg.....................j.z!+.-............"j.j...)*..TT...."....T.Tc.**j..............j.z!*.h...&.&.&..e.%..TksTW%G.?".l+$..c._9..[x...TU..........i~X..#'.qm?ttO.....}*.i...q.....9..r..?..W..d.w...f;..q...tZh..0.....2.......OD%Q-.......$......56.K.O...y._..*_C.k..p9.p..O..vu...'........0v

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000028.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 76x97, components 3
                            Category:dropped
                            Size (bytes):784
                            Entropy (8bit):6.962539208465222
                            Encrypted:false
                            SSDEEP:12:869YM8fij0W/xfuCp7ovv1bidiMn3bGi6AETQcdH8SADjoZgV6v9jUEvS3/g:N9YMWeI424diMn3yinsQeHvADu9QEvJ
                            MD5:14105A831FE32590E52C2E2E41879624
                            SHA1:078FA63FC7DB5830E9059DF02D56882240429D90
                            SHA-256:D0A3A1C3CD63C4023FE5716CBE2C211307D0E277E444D9EF76C7FC097A845FD4
                            SHA-512:8FC0ED24E8EC14C46EA523D9265DE28F85C5FC57AA54AD5B9CA162E95F79221E2AD3DD67D1293CF756B67F3D3DECAE122254134EA8D4D00DDED02114B5383947
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......a.L..".......................................-........................!A."1.Qbq....2Ba.........................................................1............?.....3.Ty\......vs....>.>..a.W..s89.d...Z}......rz...`...Z.r.do....u.W.%....gf.>.L..xz....B8=w...g.~g."HD...$..IKJ......nn..*ly..I....L...\q...Q;6.KrxZ.,...j$..ZQ..)f...q`.*..C1..cZ2]-..\.~..J.....^..(.f..9m?..C.NI.UL..X.fy.Z.........+n....r."Z...d..R./\.#...kd.D.5.!...h.3*s-+.......Xjt..}i..rK..y.../>u..]N.....Y..J......1.x./.....F6.......I...._3...k.sM.+..v;.%|.f.~.......:y....S....UKovh...W'........lF... .................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000029.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):8192
                            Entropy (8bit):2.7284422447903127
                            Encrypted:false
                            SSDEEP:96:BspeQ7zVkBzxIMfWEBpvXz9ZOYPRQ5fK:BspeQyHIAXvXz9ZOYPRCf
                            MD5:0E3EE00EDCD8531449C10105CA28AA10
                            SHA1:0AF3B5B97D28FD369F8594FCC45D895A8AD5D2AC
                            SHA-256:E8A1118F5E2566B832142D23AF94D9B2B4C41CD31B73C3AB3462FFD84AEEA0EB
                            SHA-512:155E69C53B4DDB215C3D441ACFBEAD3E551A89065F3723BA7D6FC9A82524BF5E427313A7D736CF0E381DD4FEC534B91F84BB0A6891A9FAEA2A809B4AF7E96D55
                            Malicious:false
                            Preview:2...>...........v.......................................................................................................................................2...>...........v................................I.......I.qk..B.....LZ3.......3.......%..|jI,.3.......%..|jI,.3....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................>....7.6.^_.....N...^......................J.[.I.#.............................................^....I.qk..B.....LZ...............>....7.6.^_............>....7.6.^_..........3.......3.......3...........................................3..j....3..T.l..3.......3....Q..3....Q..3....>..3.......3.. .3...................;........4...4...4.."..............3...3...3....z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4.........3.......3......#3..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002A.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 95x498, components 3
                            Category:dropped
                            Size (bytes):3009
                            Entropy (8bit):7.493528353751471
                            Encrypted:false
                            SSDEEP:48:aRCTf+0hagMrbAZMJShPdvF/5OzlQFlDF7npkDdWvVBTEnBLT6NrgCX0:D+0YgMrApL553JtEdEVcL2NcX
                            MD5:D9BD80D40B458EDB2A318F639561579A
                            SHA1:83BA01519F3C7C1525C2EA4C2D9B40F28B2F2E5E
                            SHA-256:509A6945FACFB3DDC7BE6EE8B82797AD0C72DB5755486EE878125A959CC09B59
                            SHA-512:C368499667028180A922DD015980C29865AEF4A890C83E87AE29F6A27DC323DD729E6FB1C34A2168A148E6A7A972F65A5FC8ACE6981AF1D4E7057D99681CB366
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666........_.........................................:.......................r.!12BQ...3Aaq.."CRb.....#4$c.S.....................................................1A............?..p..-.....u0$.......l......)..o.FTd..DG....... .t*e..jO..Z.U......r..j.O.,..VD./.....V5D.&......A..Zi....E.N....*..........#..M<|.2.Y.../QO.x.cTM4......+.F;V.x.de*....]e..O.x.c\Y........r..j.O.,..T...hw..k.^.[B..J.sEl.w.x.m.5%zzt0..T.......b..<\.3Q..W</..!.xh6..Z..\.+M.o.Y..1............#.........|.a.l.KR>..U......e....@...\.1Z...Y...[....F.6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....Uh....FkYm.m`P...W .V.g..FjVj.\..1Q6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002B.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 700x114, components 3
                            Category:dropped
                            Size (bytes):2266
                            Entropy (8bit):5.563021222358941
                            Encrypted:false
                            SSDEEP:24:TuRCTP9rSTfIEe1HbcVY1YbDXq8eCI0bf2QQe0GVDQAzZw:aRCTN7HbcW1YbDXq+I07Ien0AVw
                            MD5:DB8A181E3F0EAD4A9472099E42ED6BE3
                            SHA1:92096AF05CC6167B1AA816811A1160B809393FA2
                            SHA-256:E9746B4E9AE9CE7B3B0068779DB3E113E2DFC9880F25373D745D0E700E69A906
                            SHA-512:A9E246E10E28D057090BA9F034ECE6131780D7F794C5C9421523388997C7EDFBB49BC32B863B6C6668911B359C304AA54969B48CB9234950D5CECD2A6F3EFFF8
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666......r...........................................5.......................!1AQ..2a...."Rq..#3BSr..C..................................................................?...X.....U...j...F.W.V]'KV.uWt.iT...{.......`.(.....V%..=.....z......V..ct+.U.B...@.............................................{.....5.........0...x4....c..;...........+......|.7E.%.9.1+}..d.........+.V#.P.HUL.E...g.li...8.>U.";0pi.]5.\..zo..."@.........................................y.6.mLN..S.....@...i..A..p.......~|V9.+.Xy.........+,L.....7Z7..p...-X...\.....:-...i....v.1...-..H....9.zk....l....^.......:.."^.t.Q.F...X..B..$............................................a.%f&3..1.5+.X..'b7bwr.).e.x....!...H...aa_..kD...b..g..p..K^.k..qX.[,.........Q...U..x...YMvj...w..:k.....j.W.8..4....c.u.}m.....o.=@.......j.S.t.|.....5h.y.%.~...G

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002C.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.231203588237326
                            Encrypted:false
                            SSDEEP:96:YZs1lBrp8r8EsXlG9O4q5QRQy46mcO+o:isdrpysX49OV5QRJPrO
                            MD5:AAE2C94DE28E0CFAF0372EB5EEDEC169
                            SHA1:EF492F4014CFB3D7DB9CDCA2E550B6DC09943C20
                            SHA-256:A7DECF569F65E237DA6B2963619759C60082497D6DC387C6CF90BEA2B5705F5E
                            SHA-512:E3E2FF8A2949A9106D7059B2DC1104AE313B2A98444F635DAD0A4784E7C5882ED4CB9F4A230A242170317EC4B2AEB945B99864E0DAF9ADFF2E41692B78C5362F
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ..S.......S,..t.2.=G)C...S,..t.2.=G)C...S..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............j..w.$.............N...^................*J....G....R(|.........f........................................I.qk..B.....LZ.............j..w.$..................j..w.$....................S.......S.......S...........................................Sj......ST.]....S.......S..B....SH......S..B....S..>.)..S..J...................;........4...4...4.."................S...S...S..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........S.......S....#..S............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002D.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 813 x 99, 8-bit/color RGBA, non-interlaced
                            Category:dropped
                            Size (bytes):99293
                            Entropy (8bit):7.9690121496708555
                            Encrypted:false
                            SSDEEP:1536:Moq1jVORV5NO5xLCBaaNk4vhpCr1CH/DATOQlWvHMHojiaAMrxArLFRZPj19AWFz:eVEbouBaIk4T8uDGOQlVHvaAMkhDh95V
                            MD5:EA45266A770EEA27A24A5BB3BE688B14
                            SHA1:9F0B23B3C8EBA4FC3C521E875EF876FBE018F3C8
                            SHA-256:EDAD0F03E6FF99FEF9EF8E8B834CE74F26CD23C5F8C067F5CEE66F304181E64D
                            SHA-512:D4EE36BDA897BBD643A699A0332DD00DE9CDCC6F46D861789BAD259A4BF87868AE3B4CFAAB6DFAF29941C7055B77A95D76BAA86A4A0DB2BF3BAF7E3317F03EB9
                            Malicious:false
                            Preview:.PNG........IHDR...-...c............sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..[Oh\E...y3kv........`.%m.R..6.1.4).o..Ki...D.......P!.].=..K...C[....f.}o7VPJIg...{3.|....d.....i..=.4.u0...n y......@j..Q..f)..mQ...4-SJ..9.d.?..5\-....:b.W..i...c.5..{..pj#.....B1C/.I.......].Su.k?.2..:.9Q...5.U...UZ...e..U.c],..2.}...1..)W./..Epr.Zt.....K.=..{......e..."...v..B.4.#....A.V1.".V}t..[..2f..Y..V9.".6.......(..gbm.P.....Y%2.c.z.:Q.2.<tYF.....u.@..KJ.;u.q:.].....$.....V....Hqk..DW.l.e.j.Z.YP?:'R..*.<........6...m@..r..j2..HK"|..L.Nc..D..y.9..B4$.......`.3.m1LE....7(OU\+./.O...%6T..w......h....).I.&n...*......#..W.41...5.#.`..I...<.?.|..*+Q.....#i........$,..n...`.s....[..E. T.w..j.,&-.r..;a....#.>(.P......f...MU\3*..;B....)..5....z..(....-...a.....}y.l..E...z>......&..g.$.....*T...N....E:./.>..#...^..E.0..%......(..@..W.X.NDM.<~.]A.>..fW.O.y.'...Z...h..).F..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002E.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.3225886411821275
                            Encrypted:false
                            SSDEEP:96:YZssU0ky0+idEPQcXI4c9a54RQyf2HY0ZtTb:issU0kRp6PQcXI4c9a54RJf240ZtT
                            MD5:C1B072C6255BFF64879556CCA5D81692
                            SHA1:936BDA1D419EF3FB59F67DD65270D9B121E5775A
                            SHA-256:EEE2C31F17BFD8CB4DDE7FA2148EEB4F8BD6D9E78869319D8F5DE6A3694CD976
                            SHA-512:34636747BD656C737E692A53D083FB81E5C739E72F4BE166E6E30493375517268871E1F3191A83880E672534AD4AB0C5792C5220BA7BFD2EFEA0D2FCC1470379
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ2.m.....2.m...2.+}..M.fq2.m...2.+}..M.fq2.m..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............i.....?"..L.q.....N...^...................Pm.G.XM=k6.x........f........................................I.qk..B.....LZ.............i.....?"..L.q..........i.....?"..L.q..........2.m.....2.m.....2.m.........................................2.mj....2.mT.]..2.m.....2.m..B..2.mH....2.m..B..2.m..>.)2.m..J...................;........4...4...4.."..............2.m.2.m.2.m..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........2.m.....2.m....#2.m............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002F.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 780x107, components 3
                            Category:dropped
                            Size (bytes):2898
                            Entropy (8bit):7.551512280854713
                            Encrypted:false
                            SSDEEP:48:N9YMTXc4gpw+EIWnqQ5G+NE9VTzRFvS4+Xh+AKrNx+JuCluc3Eeky8etajhDCFex:/hDc4rPIoNEzbS4+XhOrGJu1cUHeoVey
                            MD5:7C7D9922101488124D2E4666709198AC
                            SHA1:00CC44A1B84D4D94A0ACE8834491EB5F65D04619
                            SHA-256:20016E5FA1A32DCE5AF4E92872597E36432185A7BB2E61C91F362BD68484529B
                            SHA-512:882944B2CF040485899128E03B7499C540D481E45FE8017DBF4FE0330157B2D8ABB7334DDB31C112BA0EFE3722A554883917C54155A7F60044D2D7F3D848260F
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......k....".......................................2...........................c.....TUb...Sa...QRqr..............................!.....................Q...R..!..............?...$.)m.1...%%bV.J..H....-.%a[...I"WJ..:.X.:TT.$.......N.-NR.E..-NR.E...9..E....$.k.....B.I,I)..J...kr..+)..I,Yj..YbI..+,J..e..Z..V.e.$V..TV.X..V.YQZ.EQ..U%PY[.[.R.EP............................| F.. ...j*...!m.!j.I%.j.$...YeEYYEEUE..eY[.hEEUeEil.....%..el...V..TUYA.U.UTTUT.Z..UQQUQE...V.,...UlE.U[.lEP.P.@......................................R1...AR1m.....#..$:.T.p..IJ.t.....A..AH.,5..]F!a.XJFaa. ..a.!*.aa. X.e.......bB.b..,HX[,!..,,.c0.,..U..X..(,,...B(.,..4..B.`..".a..-......"...........................>D..IKEb...t.....)u.....)K.%+L\.J]i)*b.JR.IIL\i)u....T............T.....qs.it.iJ...])ZJb.....X....U.A...V1..B.R1....X...,.c...,%X...,%#0...,H

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002G.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.342664394259068
                            Encrypted:false
                            SSDEEP:96:+sUoceo/EShGXZ9BMRQyRtnbXXJ13L183IjGb:+sNcfs5XZ9BMRJRtLXJ
                            MD5:0C74B0D8C4EE690FDAF68ACAC3F82513
                            SHA1:8DF743B33E6871BFF1C01C583FCBCB5DC47B4574
                            SHA-256:6477DC53D11158C2A909E813B3DF35DC141AA0F59D95315FEB50605120E03138
                            SHA-512:33B4C2CC3E8A80D38F11B620156DA08197A2C8F84845F54252306753BD1561B524D3FAB9E49F8DDF57B47BC554D27523A6A175787CEE29E2DB7E6A0D7E8A8711
                            Malicious:false
                            Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ.*'......*'..F..z,r.c...*'..F..z,r.c...*'..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............".{......go5.B....N...^................b.....L.~ ."..\........f........................................I.qk..B.....LZ..............".{......go5.B..........".{......go5.B..........*'......*'......*'..........................................*'j.....*'T.]...*'......*'..B...*'H.....*'..B...*'..>.).*'..J...................;........4...4...4.."...............*'..*'..*'..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........*'......*'....#.*'............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002H.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 613x144, components 3
                            Category:dropped
                            Size (bytes):29187
                            Entropy (8bit):7.971308326749753
                            Encrypted:false
                            SSDEEP:768:RwjBOlCk+nYnGagKJWJhwMJiRO22ZIm4VXvXx1tA6BQs:i8snY3JW7uROlEfbtVL
                            MD5:DF99CAAAB9A7DE97B63343E60A699AB6
                            SHA1:B84334135CFB73BC6EF55F85926770D5AC6DFEA8
                            SHA-256:74C131777E7C437FD654427417097BC01B0813BA8E1E50E4B937BD50A1BEBCDB
                            SHA-512:5D15AAAA8B71DDFE01A7C0ADE16D9E1F5E9AAE484BCD711B38CCB103ED9564CAAC23A0031471167B660E15972D70179C2A387509B213C05D60261042A0456025
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................................................C.........................................................................e..............................................`.............................!1Qq...2ARa..."#.....3BSbr...$4C...Tcs......%&DUd...E....56Fe....................................H........................!1Qa..Aq..."b....2R...BSr..#...3..Cc....$%4...............?...b.d.8T1.;#.S.DO...~.R.......3.xe...z.6..."m..k...;*.'.f.5^.....m..<$....8.R.j.D.v..>...*dT..vGbt...I......sEWp.r3.. ..G...6.....w...l.S..q...b.....-R....^Zu5+u6...A..Z].:...5..Uzn.,l.L.....?%.*.S.+zVg7.=.s.Q.....8..:,c.......ZE...>'IF..W.0.d.......c.e.d.V.t..S$.DNR.[....g..#i.$. .U.SK2.....k...J5u u\R.....T.[4..A.O..,.T..................] .i...B.m.^f....._...{S.....<......:..|D...+...NA....Y.^f.1|..%K~1..B..^...S..v=.c..g.tX[..kTJ..t.gr....R..@.F....5j..2.K.9..g.1N.....*.U...^w......>+.l.v...@N....%Qd...t.Ni.....0;lggm...K".+!.,.....[J...>..?f.]._;

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002I.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.319991390072871
                            Encrypted:false
                            SSDEEP:96:Tgs0P5OTD+8INmEYY6UXMNZ9mi7RQy5Yg:Ms0oTjexrX89mi7RJK
                            MD5:E478D47F2FDDB2CC62AAEE36689DE215
                            SHA1:09477EAA3EE6A78A7B9BB868D302E8CA11003767
                            SHA-256:225B78EE78E0FCC699C391D3680102ED1164F49E7A0D11662703DA981D49F9AB
                            SHA-512:0C69AEEB49246867205C13CB1C2A659BD370F00D6CD6E40A0562FC02FEC73C398FE822A2EA20D66324D69F094CEFB7FE3B5F5B46D5B4AA40876B988CE7242B06
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..t.......t.j...,}.#......t.j...,}.#......t..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............9.le.SV..C.y..m....N...^..................N..EI.....eK.........f........................................I.qk..B.....LZ............9.le.SV..C.y..m........9.le.SV..C.y..m...........t.......t.......t...........................................tj......tT.]....t.......t..B....tH......t..B....t..>.)..t..J...................;........4...4...4.."................t...t...t..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........t.......t....#..t............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002J.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 276x139, components 3
                            Category:dropped
                            Size (bytes):4819
                            Entropy (8bit):7.874649683222419
                            Encrypted:false
                            SSDEEP:96:/hnQiz+ET2/hDi+tv34VtpWfowTHgegb6hhLT1NTS:5nQ6TAhLtvIzMvbi6hhF0
                            MD5:5D6C1F361BC04403555BE945E28E53FC
                            SHA1:00C254F7B3BC0289590C2BBDBB39C8EC2E2B2821
                            SHA-256:131D637CDC5D0B094FB9FAD17F4D2A1ACE0D03613588155AACAA2D1CB4E16DA9
                            SHA-512:34D2C0929FCC3CC10D0A2121BD55BFA9A07062C2A7B8F101071164C946895DBCB2777641E79DE4193D57A3F0778DD4F1351FAF333B7E4B4DBE31A32DD69C51F9
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................<........................!1..AQaq"...2B...#Rb..r..$3CS.cs..................................................!1A............?.............u....p.p($.Y...9,j...V.*..S86yh.G.#m.5..9...6Y.."C.R:.[..-.7U3c:..].;.....f.?%..<T...&F.Lh.N...m]..x.D.g<B.....k..S........>j.K....#U..Z....<e.:..8....o..xq.[..4v..U..y...k... k....A#..A...pn.jJ.I.7:..{.b..ns.t,...8.Td.I....m.I.5Z.).-.. ]..X.Do%.....?..4jV.`llt.E...5...u.|..\F.=.F.r<...5dV....xc.%..&...4,...f...3..H.<......eQ...P.J....7...lLc..?..-.fR..7.#.6.......}:.]'.ny..........e;u.Y..$0...i..-....f..9(....}..T,.Inb...+=Cca7....WULA1@.s...4uY5.N.f.c..].ks.....3v..~..k..m)...f gNE`S......#.....Z..6.uc.m...#k.s.f*.l.$6..?..xC.Cm.`...N2..&H...._.&.E...[....f.Z./...!.a{K..#.V.5..v.B....1...9..B.&....%s.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002K.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.373795484877386
                            Encrypted:false
                            SSDEEP:96:jeshlDr5wmvPEVRZXF9YARQysdCp+NkApG7e:jesh9r5wJ/ZXF9YARJssp+NkApme
                            MD5:93CB00AB92D5EC1215C9BC45E5A28C6B
                            SHA1:076191D84F82068D160466E200B2507155816913
                            SHA-256:B4733DE3737C5390CB3B3092C266DC0D5EEB4F7779D09A59FD1054BAD3D5276F
                            SHA-512:20D82AF8BC8A5B2F8F03CE8BDACA51359DFA9AA82756C7648ADC28BF5773AFA3DA46348F9822E068557CE0EB20DAB719041C5FECBDEAD400CE7716FB500D5EDF
                            Malicious:false
                            Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZCW......CW..c..mEa....CW..c..mEa....CW...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............B...Z..4.H..g\j....N...^...............qC.....E..;.n..........f........................................I.qk..B.....LZ.............B...Z..4.H..g\j.........B...Z..4.H..g\j.........CW......CW......CW..........................................CW.j....CW.T.]..CW......CW..B..CW.H....CW...B..CW...>.)CW...J...................;........4...4...4.."..............CW..CW..CW...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........CW......CW.....#CW.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002L.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 814x45, components 3
                            Category:dropped
                            Size (bytes):1717
                            Entropy (8bit):7.154087739587035
                            Encrypted:false
                            SSDEEP:48:N9YMzO6BOfqH/dAIWpdAIWpdAIWpdAIWUtr/SD:/hzJgfqHaPYPYPYPUt/i
                            MD5:943371B39CA847674998535110462220
                            SHA1:5CA79B7BD7E0E93271463FAEF3280F1644CBA073
                            SHA-256:9C552717E8D5079BBB226948641FF13532DF3D7BE434C6CE545F1692FA57D45A
                            SHA-512:812541836C8B6F356A4D530E5CCF1CFDCC4CA54AF048CAC19FE86707CE5EA0F41D73C501821AC627AD330291EF58C040DFC017923A7886CEEC308048DA2CE7C9
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................&.....................U.....1T..S.R.Q.................................................R....Q.a............?..d.. ...............................................+A...Z+E...V+E...U..R.....}........Q..Ah....Ah..b.AX..b.PZ+A...V+E...V..J*....Q...b.Q..Ah....Ah..b.Ah..b.PZ*.(.@z.?.`;2.......................................................Q...b.Q..EZ*.(..Z>.G.....`Z+E......J*....F+D...F+E.......b.Q...h....PZ+E...V+E......J*....F+D...F+E..............[u#...a-...f<.9^[...l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m..0.....l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002M.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.306248651102693
                            Encrypted:false
                            SSDEEP:96:asCqjWes7EKd5nXkDs9/cRQyxn2H8glfjgsw5v:as3WOKLXkDs9/cRJxn2H
                            MD5:E7A92F388D178E45A1AB36D534B26B62
                            SHA1:4AD36A922726BB4E9254ED3CE33FEDB4220A43A1
                            SHA-256:AA4E485812133B0A42A2347D1A64A67C5E63153B5A6389867F5A688E4CA79832
                            SHA-512:B7AFF032BAE452509E6C9D49E7F554428CBEE14FFCBC3B0AD4B46DD45D4657EEE4EEFA255A9BBF9AC6C677FAA606F751F7DC4F840219A0AF648A65DF2502CEFD
                            Malicious:false
                            Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ.`$......`$...y.'f....A..`$...y.'f....A..`$..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............1j......z....r.....N...^..................LF..F.|.ea...........f........................................I.qk..B.....LZ.............1j......z....r..........1j......z....r...........`$......`$......`$..........................................`$j.....`$T.]...`$......`$..B...`$H.....`$..B...`$..>.).`$..J...................;........4...4...4.."...............`$..`$..`$..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........`$......`$....#.`$............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002N.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 262x277, components 3
                            Category:dropped
                            Size (bytes):3555
                            Entropy (8bit):7.686253071499049
                            Encrypted:false
                            SSDEEP:96:/h3JeYCQV5Hn++9HBdAjU78S/mjLLwqnqahJD:53Je8b+EBdAjm8S/mjLLRnphJD
                            MD5:8A5444524F467A45A5A10245F89C855A
                            SHA1:ACE68D567B02B68275E0345C86DB1139C0EC1386
                            SHA-256:7D2B01F17354D9237A6AB99D5B9AFDF0E1CC43687125848B0C2DEDFB44CE3843
                            SHA-512:8151B447B60D110C32EC1EF286B941FFC09B99140F41BBACF5A1650A385FF4D13C0DDB2878E9A470FC7CFCC95A1AB6E44F6DE72562B0FFE093DC8A3C3C7FCC14
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................2........................!1AQ.a."2q.B..#R...3C................................ .......................!1.AQBq............?........)&vD.)3Hn*..X+....r...tmL.k..(.E...R. .Z..&...,fJ...!...6..S\t3.=...g&..Bqe.)_U.....1......-..fl.................J...u.i.mU..K..v.w.0O..E.h..D~K.(..9.,8..E.}.............i.\.....t."v..q..C............<..|3.........................*Q..../c.....f.}8....D..|k..Z......0..~..c..e..m(...|.c..'.5.5............==bx.5x.8...T;....=.--.pc...I;.V.m..,(....}...NH.ho....Q..U.E$.~...w.t>.S\....'f.{.+.g._.t....;>.....P...........-..G.h..2...J.% !.E97Ir.D..N....j...oE._...._...".?.......#".S.........Q.Tc.I..*I..k.......=$.........sk1Jp.\K.....F.3.Q..q..J....N..[l.&....OR4bB|..2ul....J...B.$&H..9#j.f.n./........?R~....B.I.@..........m

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002O.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.279855789252748
                            Encrypted:false
                            SSDEEP:48:f0sqcTR9nsE0VOtiPj75ElrXXE9KzDoQArdQqrbw+3R3BXZbs90BvZUC+:f0sqs50VO8EBX09QHARQyE4ZZkC
                            MD5:279DCA45F97CE58E6BDBDEEDCF662535
                            SHA1:6650267351519FF45A9C857986E83A748C50E87B
                            SHA-256:BF775DD6565D1AADB0994BC3FEAD3B22CA53806B248B51D88D9E576151F820E2
                            SHA-512:EB9DCE0EF19A0E6E62CDC6415323DDF9085F10AEF652DB571ED7AC384AA4B1A7A5F44294E82F380BD099AD244AD3588145C9C9ACDDE7A231F1BBFC8C58A3E453
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.................x..............x..........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................."...3z....(.....N...^...............F]f.FZ.F......o........f........................................I.qk..B.....LZ................"...3z....(............."...3z....(.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002P.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 70x626, components 3
                            Category:dropped
                            Size (bytes):3428
                            Entropy (8bit):7.766473352510893
                            Encrypted:false
                            SSDEEP:96:/hdu7isPwAp7zesusUyYAatNG87llTONQYS:5di5tfuQ9atNZlaC
                            MD5:EE9E2DF458733B61333E8A82F7A2613D
                            SHA1:A86704C969F51B86D6A05ED51C6C60214ED9FA89
                            SHA-256:BE4F0E6C89FCE91B9EBD2623567F7DFC259E0E3C77C9158742B8F64B724DF673
                            SHA-512:BFB5D6DD6B66EE21E946E90D1E482384CD10244308562DDA814189602681DADDE5752B80519E5B8515F115A71BD6BB4317A59BE65B8B5E3474AED119F8303569
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......r.F.."........................................H............................!Qaq.."12.....#3ARbr...$B...cd...&CSu.....................................+.......................12..aAQ.!#q.."................?...#...3.Za......rV.5&...../"..i.t...j..W........d.FL.V.2K....]t.f.d.NK..:.....f...... ......2.[...#..D...ZK....p.z.E.N..T..L.-....1....2.\.6FIr2..zS\U#..........fB\t..5J..~q...D....A.......!....MY..../.HY..../e.M.Y.n.~..,....'..Pc...l...d2..m.f.it$..qx-z*...._..].cOO....n..&.....FIA.....2J2..d:<qc..6.I.G.N....f.K..Dx.-.......`....2.FZ."K7.r}..<.P.Z.da.Y.....8..s....G.....b.e..g .S.......FL.Z,&..q.MG.J+..x\..m...qN=.....)..`...&Y...S....u6{.z.g.....@......FL.ZL&.Iv.w..8....U..v...*.q.B.v_./A..#.#.g.j........*J;...u...W.Ao...%....#$.....M..^\{W.SO...s,.N.....c).,.B.Gv...."k..z."..S]H.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002Q.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.348111249343912
                            Encrypted:false
                            SSDEEP:96:IspO7xN82IA/EXNrx1/pXM/p99DoRQy5YiVY3p:Isc7n87AsXNX/pXM/p99DoRJ5Y
                            MD5:4CB97D8E407C5659FA28490FCE85BE62
                            SHA1:85762292C4F9C4CC79475C5FB991E3B369E553E2
                            SHA-256:6AA29AFFB432085F3F04CBCA17BFBFD50BE0103ECDE63CAE32098A5DE360E833
                            SHA-512:43EE21C59D5039D90F71F625CA48ECC18418790DD1F360253ADD621587B606F342646817D8A3142A3E8A75A8B08F530D91B39970EB5CD60935BC144B30B7511B
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ...........g....1N].."W....g....1N].."W......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............R...B...,0|.......N...^................?$....F..x...8B........f........................................I.qk..B.....LZ..............R...B...,0|.............R...B...,0|...........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002R.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 177 x 123, 8-bit/color RGBA, non-interlaced
                            Category:dropped
                            Size (bytes):65589
                            Entropy (8bit):7.960181939300061
                            Encrypted:false
                            SSDEEP:1536:2Hlrjw3xL//DPgff+9j6yPWvHMHjkbfnwHO3AW3GL:2H2zDUU+yPVHITwNfL
                            MD5:8B48DA9F89264D14B83FF9969F869577
                            SHA1:E1BD58E2D80FEEF56DC514F3F0B3AB9669F22F95
                            SHA-256:62AD3C277E54F03F1ADB44062407346F789E63859B7AFABFD64BE6AF5E9F66EC
                            SHA-512:03B783EC968DF3F648504D068D64DD1AE110E28110FE5B3401C9D04F44897DBE0CBB5680D42CA4C665FA94A6CED4B559106EB3C06C9BF2C5B14951ECBFFAC8AE
                            Malicious:false
                            Preview:.PNG........IHDR.......{.....;Za.....sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..Y=.+I....t.y...,^vv....;. "|. .i7.....$.2g..']pH@p..]b....H.H.......d'@ B...U.xm..3{3k?..5n.._}U...3......~..>...g.....f..t...t:...p>..Si..d:..k:.Lf..t6.K.i....d<...x.8\.8.+lc...)i.$.r.....x.t.BG.R.cm.c...p.:&.6.4..K.......^...~b].0....oBYv..u.'.=.K.Q.g)6.....4.!.M......4.=....G.%.Sr........nxC.F..t.U........1...J.t..eQ....".... |...81.$D.!.>...........$...^.vY..EY8tb..'.P.g#O....S*..0'.V....x.W..........k.......s.C.S...J%.iVb..].........3....j.}*.z....+.s..@..K.....\x.C..e.Qq.....;N.....;....,....^.*..$F..{G...8.#....8'..&....8..5.....3(P._....S......|".....u.cr....+a-....&V..x...iI-<|a.{E.c.X.......?..&.C....'........(.x....>...M.?.9..#X......l...0...Z.F..<.z.0}Q..Z1..........?h..`E$K.2o.A*c^.......*..D..uL=.}.#*0.. M!.A.C......|_..(.Y........!E... .O...`;....M+..x.u~g...q>...N."D^..K..x..D.`.!.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002S.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.3687681266402905
                            Encrypted:false
                            SSDEEP:48:IlsQCadfARNt6yFpEmdPPWXkyf0W9+Ho1rdQqrogOBXBnkgqOy:is2dfARN0yvEmd2Xkyf99IERQyXOnG
                            MD5:91FA109BE8A4206541A296F0E486EAF9
                            SHA1:D6C3571BCB97C151023C85F8CC640BFF08EF7374
                            SHA-256:BB1D1C1C3B2A3649FE45F75845CDCE100E58B14D0122C0457D34077ED8787C24
                            SHA-512:848F4F6F0B01A66C9D3E4DFE39D7C1EC5CDE68A6D43CAB0A2D2F915853C8232E31980575EC2CAC9C2DE0F430C9169BACDD2BA9A18CA8519C4C8D1AAA800FDD9D
                            Malicious:false
                            Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZ............,../...||......,../...||.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................\.-.4.../z......N...^................}v...B.....0.........f........................................I.qk..B.....LZ................\.-.4.../z..............\.-.4.../z......................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002T.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 17x608, components 3
                            Category:dropped
                            Size (bytes):1873
                            Entropy (8bit):7.534961703340853
                            Encrypted:false
                            SSDEEP:48:N9YMw9kGzE4xTdow1C3kyIkyM66KeJY3fOxJ:/h8HzE4xTdoUCUyxyD6LCvSJ
                            MD5:4FC8500BD304AD127AF4B5E269DFF59B
                            SHA1:9A5E3432358A0FCDECE86AEB967319B93A65D14A
                            SHA-256:B4DAA90D5A53FCBC85119050B5B76962443C4DD18D7F42CDC6D4E0AD8EFAD872
                            SHA-512:E5E07054A522EB91EFD39722AFB3776389632B8F5F923C1D29796716D68CEC93BE5E44F79913804CEC7ED631FF520CBBBAAB841E01FB90AF8E8ADF84DCD47481
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......`...."........................................>.......................tu.....45.!#$%1s."fr...2Fq..AQe.Eav............................... .........................!AQR.............?..e4.bbu."m.G......u.S.-Qq.b.a..'#..E.......u.|:.f[O..jS.S.&....=.....[.....S...N.~~...'...q....N.T.Oyf..a.6..%.I.1j.e~.4..[5.WW.Y..Xp.gn...u.......Gb.O.W..k.!mJgfq....~.F.......m..}bn4.5........s,F...z.b)..O..*...5).-.-\....=`.fP....%...A..Q.&..9.....QQbD.%.:u.f...r$.10..W.F.T..MI...9...ZQH._..).....D..n.F].........*.:.j...!6Z..S....0...B.6..Ga..S.O.....U8S_.J.>...i..?..<.P..........M..F.T.C..7.E...`.4BKcMh1j....4y...+.|.^......2[.WG.W..+......E..r/V^".R...."..6..hht..f...........;E..Kx....)}Le.A.x.>..$/).._S.n.L......}..H^Sw...2. .v.io...../.........x.>..$/).._S.n.t^;O.....n...[.S...h.v.io...../....:/...[..7yK.c-

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002U.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.399399222939958
                            Encrypted:false
                            SSDEEP:48:XCsLkfzVFLm0UI3tUEe7X29l8Oot7rdQVruf680BXtjA1PkNfR01afee:XCs8m0UI3WEQX29JARQ5y0n
                            MD5:A02B7287ADCFA3CA8BD033616F30D8A8
                            SHA1:76DDD34C2DF2A0C8D34FFED3C042A39962B21D30
                            SHA-256:DDF6182E9ABD65E1AC3648E2175692136E167F34CAB27BA1FEE642635783C446
                            SHA-512:C8489975798E34E2EDC4352C17AB03C00A7EE80A9F11F936257F0B9855A8A03FF848935746D2EC14A90BE04B8FD087E51C0F457B315381FFADED60CF76C97066
                            Malicious:false
                            Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v...............................................1.E./.'.I.......I.qk..B.....LZ........1.E./.'.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............\._.....T.~.$....N...^................."..!.L.`.ng.U........Z........................................I.qk..B.....LZ..............\._.....T.~.$..........\._.....T.~.$........................................................................j.......T$c...............G.......H.......>............. .3...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000002V.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 357x69, components 3
                            Category:dropped
                            Size (bytes):5465
                            Entropy (8bit):7.79401348966645
                            Encrypted:false
                            SSDEEP:96:X0cZneDWlIKmXwxacOHHI6EhzNlSSDDgafbofgt7mGrw:XleDWlIJwQHihRdgu8imGk
                            MD5:8470F9A96B6C6CAD9EE60961E96D19B2
                            SHA1:AFE1F01FFA4E4CB06B1D770C9C59DA75B434D1AC
                            SHA-256:2DF453410796AEC7B9EFEC00059B6CE64BCF67313A95AE458BA600EA5DE14811
                            SHA-512:CAE5C2ED091BA49761F0348516D53491E578FB165F32F93AC7DAD927383E9A398B06229FAC6A8233777DF708E5001AE0037A1FA960293BDA49892C40B37F2240
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................................................C.......................................................................E.e.............................................8...............................!"1...2A#Qa.$34bBDSqt..........................................................?.....`0.....O...3Sd..@..5.0....Q.pw....;....!pN.DR....`0......N^...k.=.u.e.7{.b........?z....zV...M.....P:a.SPj.....WRK.=x.2.h..2..AS..s..A..|.Z/f$D.YX1pr......}G6._.~..)j...+.s.r".{..q..-.^@...#w|.H..*.K)....g...y..`0......2.w@.Ro.d....@...K....}...&... y..f.y.0.|DC..>p.[E.2......v..N.)Z..4.RF.D.8]..Z.|f/..+\ID.r/.o........0i..*.G.O..uj..RN. ....j...xnF...Q.Ls.U.c.D0m....z.k.P;f...b.=..L.hH.,./;.U..`sa.I...?*...I....M.0<.u....!..C..U.T.....s.Q......_..7K..*.....?....R\&=.<.u..oQ}WZ..Yu...{Fe3.h...@.s..mW.G..^....1.W.#[.q2.&u.c.G......`J./..X.C....M;.....3k$}.i.3...#/x.m.Oh.}FH]. ..5NNDIS.-.M~...6..w.d....P.;..k...........v*..T..L.P...s.!B.4..w

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000030.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 14x341, components 3
                            Category:dropped
                            Size (bytes):3361
                            Entropy (8bit):7.619405839796034
                            Encrypted:false
                            SSDEEP:96:zDqnxqMt6gGr/Nln5ANln5ANln5ANln5ANln5ANln5ANln5ANllHN6:CxqMQr/rn5Arn5Arn5Arn5Arn5Arn5AN
                            MD5:A994063FF2ABEB78917C5382B2F5FA8C
                            SHA1:BD5C4D816B04A2B6596DFE38DB01228F553FACCC
                            SHA-256:D72900E8DA72D1A7F3729971AA558E1E9B6E9CF9A0D51E83852E567256DBBFEF
                            SHA-512:CF2279033DD3EDFE6F6F9E5C517BEBD9A52863EEFD90F57F7A5AE0E0485E705254BE7ED6B50E6CA142669687727AE85E2E6035F69930B75F2E6D3EEFA961EF88
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................................................C.......................................................................U..........................................>...............................8H........59...$%&7F#'Ddf.....................................>.................................58EG........!#124$%&ACFbcde............?...n.p..v..a.~.._.>......#....8.....w.G...&.W...i...%6m..K;...4."...=..?.~......P..O...j.l..AW.jo..,..=d.h.ta..../.."...z|).J.......Ww._..<Wp.3+8...-5...G:..2.D..I>o..K.F;-.....#...`...6..T...M.....OOgV~..5...np...P..TYr...........b..{r.2.9..].DA.%C....=.v.z......CK."..R..l..y}.i..;.{....JzS.....~.?..Z....=c.h~*..p.@(@..G.....O.]...Hsd.xf".V]..S"..w...4e>....3*U.7..|M.x...|\......FD./.cIe.;.bId..+=...w.......[.k>....}.u...j.xZ.....Q4..+.....B....1O~\......I..h....LaXJ%&.w.<C...n/`.W..U.W.U.}~...}>..^.0.J.....@....LN.b.......5W...m].Eu...:....G..:4.=4ixx..@_0=.mab.T.U.....w..~.V.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000031.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.330626263816812
                            Encrypted:false
                            SSDEEP:96:gNsrJIjIDPhLREBX1v9WRkRQyP5EZKgIjaSyEf9:gNstvDPhSBX1v9WRkRJP5EZKgW
                            MD5:527A8D944EE806ADE13D2723C527F653
                            SHA1:72151BFA9D607573FB2948DA392D70A866D802EB
                            SHA-256:6EB51418C85C13F3EFD8411B1E2609C3AC71A3FAB048DA9326EE6B3FAA069679
                            SHA-512:82329A4CE08416E9862ABB8C0C55DD9E79945DDEAF8E9414F06497479582F0CFFA72608E81797633E8408E9E09A88D302F328D2538C73B4A48D2E5314EB9FD26
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ...........N"..2........N"..2..........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................X..4.e...^.....N...^...............D.g.\..J.....]@........f........................................I.qk..B.....LZ................X..4.e...^.............X..4.e...^.........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000032.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:15:20], progressive, precision 8, 604x784, components 3
                            Category:dropped
                            Size (bytes):140755
                            Entropy (8bit):7.9013245181576695
                            Encrypted:false
                            SSDEEP:3072:i/aDiblRsFcOco8dofE5Zx1+NQI8Wh9aiOe5NTO:mnbM+TxaAi98W3aiOwTO
                            MD5:CC087700C07D674D69AFDFDA0FA9825C
                            SHA1:F11113DF69DACDB255C6CBCFB29C1D1CCE40B346
                            SHA-256:A7FA7F092EFF43030A56342C39A765F8D5CC48C7DB815DDFC8C1E5EC40117FAE
                            SHA-512:843202D975EFA91E73287052A893584B6E5AE601F91612B56539AA2F73D1AD3F997FCAD1E711E0F483A2E91D46D9643D0B026B43F4E94116A5D2FB6551536034
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:15:20.............................\.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.......J...\O.,......../$..........OE.m.o......T....Z..l.g.-....m.?...Y....3......"....].j.X.k.S.k.....4..R....{....?F.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000033.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.364140374537992
                            Encrypted:false
                            SSDEEP:48:YuSsnNH8xz29Hdt4hPEuVLxeXle9eTo9rdQqrzYQWBXDDc0pxIJvDwmL4FT:YVs6iHdq1EuVwX49eT8RQyrWx/
                            MD5:C370C3B0AC0E7753050CE82B3B8168BC
                            SHA1:C3ACF595A595BB1755B980951249EB23A02D87D4
                            SHA-256:D63446EA1D32EEA9F926EC7866B9058C28C0115C49E21E1F939B2D3849237554
                            SHA-512:58AA19D2F6924AEA18FD0D3321E9F94B29BC8904BBBD6364C451CB73EFDFB4CFBA016FBFC011DD5FE311C0A4CDC68F87A8644AABFE7FCE05A03FC0A44A71CC74
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.{.......{.4-G..1..uUE..{.4-G..1..uUE..{...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............-..#....9...Cc....N...^...............g.^....G....N..........f........................................I.qk..B.....LZ.............-..#....9...Cc.........-..#....9...Cc..........{.......{.......{...........................................{.j.....{.T.]...{.......{..B...{.H.....{...B...{...>.).{...J...................;........4...4...4.."...............{...{...{...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........{.......{.....#.{.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000034.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:13:06], progressive, precision 8, 570x779, components 3
                            Category:dropped
                            Size (bytes):129887
                            Entropy (8bit):7.8877849553452695
                            Encrypted:false
                            SSDEEP:3072:QS1x1rXglsteJ79wHi4vNQR5yBlUdOSILe9hSj9jeWMPjdlOJ:vvglst1HiwWR5yBA2LeS9jd1
                            MD5:737E96E41D79D3BDACE7AB4F8CBF6274
                            SHA1:E6202A41A4F86B27D9EBCAEF7670B16C0ED67CF2
                            SHA-256:7966F3D8A2D61ECB49A35E163781858E052C0B122A18A1238AFE27B57E2850E8
                            SHA-512:D398C8521DB2FB3F8456FE792CF37472F3B851DD7298DB20E2DB79144F8E846D051878E77E5EF5D00E6840EDB90C6E2D97935BC1023A15FC45038CCE731E9895
                            Malicious:false
                            Preview:......JFIF.....H.H.....iExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:13:06.............................:.......................................................&.(.................................3.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................u.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...W..I:..*....a....Aa ...w.T.M.v.........3x.......8Y....$.."-..m.I.0~sxB[@..=...:..\.Y?....@O.L;9i..U....?.5">+9.s\Z..vN

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000035.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.355623539229566
                            Encrypted:false
                            SSDEEP:48:YuU/soFn1V9tHO2yLEr7LlXN9Xk92Ro5rdQqrHtDBX0CpxZ9J:YNssV9EEr7pXN9U92RIRQyVn
                            MD5:45F18E4EEDEA767CD2C22168054AFB75
                            SHA1:1AD741988F5999CC15BDD25AE9C88D5F43400B36
                            SHA-256:A5AB2C243019D1F6B06F9A0377E0F61350C52D1E7A89096667EC25475D887570
                            SHA-512:9D705893B53C3BF0BCC7F90C320DB4B7620D57F8CCD08F1D2165C5EB25F6A24D527DB0E3697F01E0B81E16688F57BB91DF748ACB9BF88780EA309DE42ABF0DA4
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ~W......~W........O<.V."~W........O<.V."~W...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............`.T4..............N...^...............Q.....TC.?if............f........................................I.qk..B.....LZ............`.T4..................`.T4...................~W......~W......~W..........................................~W.j....~W.T.]..~W......~W..B..~W.H....~W...B..~W...>.)~W...J...................;........4...4...4.."..............~W..~W..~W...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........~W......~W.....#~W.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000036.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):84941
                            Entropy (8bit):7.966881945560921
                            Encrypted:false
                            SSDEEP:1536:X3sWfhTVd+xu6rA6SOONM0/YFXnviDwoPCaNSm+z/ze/fWNj7GfigeKyCGzw+QKW:nsOhdDJOwY1voPCaom+z/zeHAfGihCG8
                            MD5:CB84C108A76C2AFFCAC2551A3C1EAD56
                            SHA1:8BB7C2A12B056C1ED12EBBAE5BC9F60CCE880FFE
                            SHA-256:139BB0E79F89C3DDEF79B1716A5FBAB4C07DF5785FB3CDF6B4EEDDBF6C078452
                            SHA-512:6EF85144E9A7ACD0FF2E52A5FF42093153EFB69127B1C8549EEBC49B6CC196A46B65EE39A2CAD0206F6A41476D8B5B35D29EAC9942B8F84972B32E14CAFEED27
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d....................................................................................!.1A.Qa..q...........".2..BRbr#.T.3C....S$.cs.D..4%5......................!1A..Qaq."2..BR....3...b#.r.C4.............?.......m.q..'O.....r......_.1....8h....?.....O]~..k......GO...''._...!....o........''..g..H?k.......1...?.....z......>...+0..................GO...''._.........}.O.Z|.L?...........?.........[~t.......}......NO.....v.......J.......?..g..H?k......GO,m..r}o.z.....}......dC.9?..g..H_..........?.....O]~...m...C?.z..f....W.=u.B..m..C.-?.a.....3._.?.......o....np.M....g..H_............9?..g..H...../..kO...''._...!~...o.....0.M....g..H.........../......O]~.~...o.......7..+.... ..l?.}........&....3._./....?.........W.=u.C..m..C.+?..o.W.=u.A.^.O....:......_.........}..t

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000037.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.317615445750807
                            Encrypted:false
                            SSDEEP:48:YumsR8VxmTPtg78Ee+hBXUL9OmolrdQqrjxrMs4BX0AnG7PDhgGNaO:Yps4CPKwEPHX49OmcRQyFAs4QJ
                            MD5:52C7DFE57044279078165D6760DD2C23
                            SHA1:5407C7E7376D4F5982EC6AEC35F7EB4CAA84E81F
                            SHA-256:4E3840EABCD2ED747843CF5C45CCD1F82E310EA8595D1001A1007595B27F776C
                            SHA-512:2B5D5364413334A25AFED061E88AFEEEEFA3664B548074B2E468D54B3F3A36CAAE152601E847B1D5CF4DE0CA16E6D53300E635131C80BABDF124B0B8B57B8F1C
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.............bR.-..".........bR.-..".........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............b..#l.'g..G..p....N...^................{.~..zB.{J.............f........................................I.qk..B.....LZ............b..#l.'g..G..p........b..#l.'g..G..p........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000038.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 40 x 623, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):1569
                            Entropy (8bit):7.583832946136897
                            Encrypted:false
                            SSDEEP:24:KArPoy/sSfmBL0EGEsRgeTLLXFnViAAEslVorlP0i8OmO57EnGAkYelBKMN:9oQPTgeL5ViAe8rQs7HAkrlc+
                            MD5:07DB3F43DE7C1392C67802E74707DAA6
                            SHA1:C173ADB1999065C5E1E6DBEF934B4D4D7AF0CC23
                            SHA-256:51E05999A1C9F17DF28CB474E57DD8E64BDAB824874A532C20A23766A01F8967
                            SHA-512:E509255519D4E521E82332FF418DD5A6BBBC8476399A0D9C3D81542C1CABA535B2D79E5BC90F73F9EE8468643302137671934ABD600FC696F16161C91FEAC111
                            Malicious:false
                            Preview:.PNG........IHDR...(...o.....>.c.....PLTE................................................................................................................................................................................................a.o.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.Y.. ..........}%.../].`<..y....V...m.....<....)..;Ki..'9...2.:.c...t..V..d.t;-y.Z.=K>B.."{Lj.~G..|..ENC.!Sw,....";.p..g....E.B..S.-...k..P."..E......l[./D.-.....Q+.G<>.+..b...#..y(...{a.M..J...<....v.W..F.qm.`.....(.mk.nX....l.Px8.0\Z....7G...$*.....&..Z.VJ.~......J.2|...2H..../...=.)q....ZT" .,%..h.p....Z$.!........r...Hh.f. ....P .d..1d....2.3h....;.A.... ....d..g4...A..^.....2.ew..."h...y/..j.h..B.......%.2.%..{r...+dG.=9h....P1...A...c...^h.]Q0.8x....q .!3....ZW"Z.!3...G.vC.GG..".&..X!3.|xB..V.P!.+zS..NX!3.....Nh.y(.Z.1.h..B...Z+....l8Xcu.B...K...@U..@Q...mB...x...&L C....mB.....@kC...Y.,.... ..e\F.B..........y..e\..:$(....Z.a...yn...f..z.~Q.{o...].ln.r....^.@.{..c.7..{...

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000039.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.328921489445907
                            Encrypted:false
                            SSDEEP:48:/ks3rQtmat0MrkUE+YlL6X/rA9S2orBrdQqrn1h1rsBXEo91mOZ:Ms4maaM5EpluX/k9S2MRQyxQn9
                            MD5:A608E73568FE4EEC5D0D365EFD27420B
                            SHA1:B6AC7E38D5EE7CBB9FEF5DEA61C61014AA2FDBE4
                            SHA-256:84F1F4E759A10C7F83CABE46328BB9DB58E13BEA53CA317F284B300CADEEC486
                            SHA-512:857EE4A1ED4ED825F424B9D9BC4EF3E820749F2CEE35396647976A8E41C7A724DBDF14D40F57FA036A6E67FBB661389E1851C49C665FF75CDB81A07BE4587471
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZX.v.....X.v..v.....-...X.v..v.....-...X.v..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............H.o..N.....v..a.....N...^....................59N.....3.........f........................................I.qk..B.....LZ............H.o..N.....v..a.........H.o..N.....v..a..........X.v.....X.v.....X.v.........................................X.vj....X.vT.]..X.v.....X.v..B..X.vH....X.v..B..X.v..>.)X.v..J...................;........4...4...4.."..............X.v.X.v.X.v..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........X.v.....X.v....#X.v............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003A.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):40035
                            Entropy (8bit):7.360144465307449
                            Encrypted:false
                            SSDEEP:768:MQhziQo1RKGlyyzYjlxuxwRUj/BN837xRmwH2uDTCn8qXFQziN:ThzrSzalg6O563l4uTC8q1Ig
                            MD5:B1DDD365D87605F96D72042CB56572F6
                            SHA1:ADF71DAD1A62B8A58A657C2EDBDD665A19EB846B
                            SHA-256:06E09DE80C3F32254DA4FE6B2CBAD7C05EF144DD54B8C65745E195BBF7317A2E
                            SHA-512:9C686092CC9524F34EA6CEC9AAE936A6225BCC54DE38DE1786EBA8F532959A80FF885E8664A09E4C318D7CA4B278E807D3D1F135BE55F30979B844FF5EC9699A
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!1....AQ.aq.....".3.5...2B#s.$%..Rr.CS4&6...bE'7.c.DTtU...d.eu...VFfv.Gw.....Wg......................!...1AQaq........"2..4..Rbr#3$...B.s5Cc.S%.D............?..^.f....R*.N{.{f.....O.r.V.;U..~...U.(..>M._.yI.{8,..^.t...s`...j.O..U5t.&&..h.G.6Da.;.....J.......E..QD...C...}..N...tR.....~..].J:.V$.*.r......]...W......4.[.)6..Y_.....4...........m._'HR.a......]U=.....n...0.W..]..K..){.+...w...f...<|..1/.|.....b..-..y....]U#Ctn.7m.._.|..2I;|....tM....q.q.}.N)....'...9&...nR...R..}.........m._.LZ}u.../K....9.~..?.{....V.#..dx.Zk.:=..:.j].....E#....E~w%....J..[S..[......gr...vb.r]..<..ut..i...[P.w....:..Gkn>......#..m...9km`......t).up.....w....VOR.{&.nQI..}...wD.7Ey#n....MO.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003B.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.6353619351564035
                            Encrypted:false
                            SSDEEP:96:5sul7Mg3uFDxTE3/J1Xgi9efoRQytSn77m4ecoB:5szg3u83/J1XN9efoRJI
                            MD5:1D9EB758F1D54C8077E011820450059B
                            SHA1:8BE400396628CC417197FFDAB7A69B2DD6E78498
                            SHA-256:68A4A3420E894C8BBEA80F4E051B8E4353DE56292E1767852560E68D866B83A8
                            SHA-512:B938E3D28DB0054D06DBC124646509D41559AF972B1F4AA28883613A2AC2C8106833AC32F53396B7ABB067D82C2182D9533C880930E085A607F23F3FDB721662
                            Malicious:false
                            Preview:2...>...........v...~...................................................................................................................................2...>...f.......v................................I.......I.qk..B.....LZ.t.......t..Y@...<.......t..Y@...<.......t...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............!.....5.A...e.....N...^................?J|..VF....\...........f...................................:....I.qk..B.....LZ..............!.....5.A...e...........!.....5.A...e...........t.......t.......t...........................................t.j.....t.T.]...t.......t...B...t.H.....t...B...t...>.).t...J...................;........4...4...4.."...............t...t...t...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........t.......t.....#.t.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003C.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:10:32], progressive, precision 8, 594x773, components 3
                            Category:dropped
                            Size (bytes):242903
                            Entropy (8bit):7.944495275553473
                            Encrypted:false
                            SSDEEP:6144:YVxOYlZX2kCWfYoFMXC/sBFC9r+4iEGM4rrcPoWmwkU6FJ:+OwZ2kbFMC/L99ifvokU6/
                            MD5:C594A4AA7234EF91E6C2714CFE1410F1
                            SHA1:C0F720D4CE3196852814D0B7347F0CAA0C6FD526
                            SHA-256:10C833E47BE1C8496F949A6B059C2D79212A4DD66BDE62116EA337FA4FE0B654
                            SHA-512:7313F6545A334F9E2DE5430B2DB5C419C4C8A40E075338DAFCD74970BCC6309786946E5DFB57531612BF4C6269495655706D920FD99922FDACFF9796710DA9C0
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:10:32.............................R.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...v&.F;-v;}FH..Z...N..)Y.......h;C....G.0W..ww...MI..Z+..\.........c..4.1.~.Yo.Y6.&. q...............l.A#.~s?yYg..7ky...r

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003D.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.352195327940627
                            Encrypted:false
                            SSDEEP:48:YuHcDsPY3qX1CI2xEdCNJGtm8EXMRLZX6xIC9Wio9rdQqrDmBXkOJWxIDN3DnrJY:YQWsM8CNJGREXMR1X6xIC9WisRQy6w
                            MD5:FC2AA099973351E4C8CA05E8D3309EEF
                            SHA1:95EAD8E42F395C34CA4FD89C0F366B0760C4AA92
                            SHA-256:B95A476E8A350E61B01805DA8353DAE94275E1F2F188D92DEC10728AD0759C9E
                            SHA-512:99D0799B7D2104AB53A41921E30BFC741E05A059B35B9FA8FEE28F47AD65C1908B7EEBCFB74BD036DB00F13D5CA5562A3E8FBCB3318372B975C193DFECB5F5DF
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.........................................I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'............./c..].N.5!.t ..5....N...^..................~..qC..l..H.S........f........................................I.qk..B.....LZ............/c..].N.5!.t ..5......../c..].N.5!.t ..5........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003E.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:12:29], progressive, precision 8, 598x766, components 3
                            Category:dropped
                            Size (bytes):70028
                            Entropy (8bit):7.742089280742944
                            Encrypted:false
                            SSDEEP:1536:ub4bgbB7g9cKCmSzaNF0jAdAzQKTEFBQqUp/i0yG1pidLHTVX:ub4bIB7Qg2OjbzjgWp/i0yGCZx
                            MD5:EC7811912ACA47F6AEB912469761D70D
                            SHA1:C759BC2D908705D599B03BDB366C951B11F99A4E
                            SHA-256:FBB4573E3BEE1B337077691BEBAE15D6FAC52432405D31396D526D7694A8283D
                            SHA-512:881828150993A8C56E36CDA2051D89C1F6E0322643902C9506392C163E8734A2933A46486F40E5BC8C8D0164E180605E52620EF22FE14540AEA787A38B22E98E
                            Malicious:false
                            Preview:......JFIF.....H.H.....7Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:12:29.............................V.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................}.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....H.yM..? .Z.. .^.x..p.8.A...K.... .\{..)..y....t..=.^y)..v.@.W>. .h.. ..p.:.\)(.$....$.I).....!....E..Z.....&.5.).

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003F.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.336402780247177
                            Encrypted:false
                            SSDEEP:96:PyspyW4oqXyqE5VfXwQT9m3wRQyUfyeig:aspyW4ouoXfXwQT9m3wRJUfyei
                            MD5:966872106F20B04EDA03A23715A52CEE
                            SHA1:F079893CD14047E71541A5A9B1AA81E8475D09F9
                            SHA-256:BFC1D80D4D749CF327F7C6D6C5956C4069EE77B88BB86632EF11A59376404588
                            SHA-512:707F2ED9E4D85D80705088E55AC78433B4B52DE7E507A0551CD955E8B9776876E1F1E572F014E4CABC96AB3AEF8131F904F3F5F644054659B89A3B0B4F30DB63
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.].......]...G..0...\$|..]...G..0...\$|..]...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................<..C....Hv.(.....N...^.................e...sH.3.=............f........................................I.qk..B.....LZ...............<..C....Hv.(............<..C....Hv.(...........].......].......]...........................................].j.....].T.]...].......]...B...].H.....]...B...]...>.).]...J...................;........4...4...4.."...............]...]...]...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........].......].....#.].............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003G.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                            Category:dropped
                            Size (bytes):24268
                            Entropy (8bit):6.946124661664625
                            Encrypted:false
                            SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                            MD5:3CD906D179F59DDFA112510C7E996351
                            SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                            SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                            SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003H.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.336374730862387
                            Encrypted:false
                            SSDEEP:48:asQG1NVxN6y+tWYj4Er0LmX/Km9jnqmo1rdQqrD7hG7BXoqGp0UB+zGbdN1:asX6LAEamX/Km9jnqmkRQyWM3
                            MD5:5E10FF08A7A056B1A2D4E35F2426C459
                            SHA1:C72B33B2EF94C1A03D0A530E115C1E7AED990BA0
                            SHA-256:EF1C8D4E716E9E65FD8CBB70B8CA953BB3A93503665C5174276CEE7A01655F79
                            SHA-512:C58CDAB0DD52AF3E87E173B1D74A171415D573277464A14F52E62594EA102F942644DC84B18E269BE0AEB95E3D867A08DBE2BDB41ACD0C7E00F076FA138E6A9E
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ................-....N..........-....N.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............e..Bz...<.]T.......N...^..................:|.G...J+.v.........f........................................I.qk..B.....LZ............e..Bz...<.]T...........e..Bz...<.]T...........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003I.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):47294
                            Entropy (8bit):7.497888607667405
                            Encrypted:false
                            SSDEEP:768:aQ10VrIBdBvDpQrQ7P9/FUOLG2vTSeG9lkCsMKzXeMBk3CBp:aC0JIBL+QsOLG2+ZAC1KqM2I
                            MD5:7A450E086AD14BA7D89BA5DB3D3AE6C7
                            SHA1:E7AEAFCFCE476390E18C19456BDF6529D863D518
                            SHA-256:BDD997068701ED3A00A224EB694B003C01AC69B857FE7B4147D6C34875B1632B
                            SHA-512:9B6D50A6CDB6081DA107A2CDDB1BD2811A5764994C8E3F67D56CA81084BE0D068C27435154E867199F38688EA65E8DE02A56DCAC47D0F5E55F0FBB6598814938
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..A..Qa"..q..2.......B#...R%.r...$&b...3Ss.4dU6F.cE..'GC..t..5eufW......................!.1..AQ.aq..".....2BR......r.#3.d...b..Ccs.t......$4T...SD%5Ue&Vf............?..M.7(..).:.a.q.......>..[:O...afQ.uCO..U.....go.l..p..YqVklQ.{i.w&.]Z.\+JQw._.n.'.h..,.bj..X.].k&.Q.>gU..f...1|....[...jQ.%Zb.......t..........*..V..j.6....Vj..i.....?...IY.P.....$.j........[l.....S.4.J9.U\.......7I..[..=*N5....xW..../...=?n....uG.D..S.>...8..3........n.S....]k.*...4.>.R.o..{..l.H.#.^....<amG.m&.......,....wDY.W.m.X....We.IR.Nu...y..Z.l.._S.mr.m...y.]m.R.MT...6.5.5}.K..#%..k].7.Y.q]...%.r.7.R^jR..z.K.T[t.a..d.)glW.r.v,.`....O..^..o:.Uc.\..D....f..D......yt.Q...Y.....

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003J.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.464705498625178
                            Encrypted:false
                            SSDEEP:48:AqCY2s4vw40jetuCBOXEwLqFLz1Xy19KooVrdQqrNhBkBX2+k9Jt:Aqr2sH40qeEweXS9KoMRQyNca
                            MD5:FFD48154EAE7962C9A4253991DCA6AA1
                            SHA1:A19C9D268F6622D858BD92D0746D49CB21D858C2
                            SHA-256:7B14B085E242E11E5EEDF9520E62CB6DDA55C1E6EDA5A7F63EB0AA1D12DF2618
                            SHA-512:9079120058AEE24C9CB1B28B64E17F0C34394CAB3A7B3EDF6FC1179E35E5EC16294CBC545A1B385F033D9181B44796FD2A65266B123C8461D9B2C51D6897A614
                            Malicious:false
                            Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZ=.s.....=.s &yQ.?8...q#=.s &yQ.?8...q#=.s..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............[>.MV..=..r[......N...^................DR../.M.Zl.4\..........f........................................I.qk..B.....LZ............[>.MV..=..r[..........[>.MV..=..r[...........=.s.....=.s.....=.s.........................................=.sj....=.sT.]..=.s.....=.s..B..=.sH....=.s..B..=.s..>.)=.s..J...................;........4...4...4.."..............=.s.=.s.=.s..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........=.s.....=.s....#=.s............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003K.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 60 x 336, 4-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):347
                            Entropy (8bit):6.85024426015615
                            Encrypted:false
                            SSDEEP:6:6v/lhPtnlx/QulkWNY2V18A6Akp7eee1VDjMHCyLezyKUX5Gp:6v/7RrIubiA6AkpNhiyKe+
                            MD5:78762C169F8B104CB57DFF5A1669D2DF
                            SHA1:9638B71B584CD636834016A635ABF8D9C0887711
                            SHA-256:E64FDCD0B108737D8B8F7B677029F924031D6BBAA50585D9C3DEF7C7E92ECAF2
                            SHA-512:5ED899AAF73B72DEC32E171FFA112382667D5BF3FBA98C92E313E66C0A6975EA97068F4CD32B62283F18DBD5345C11E3610F7EEAC2F2DE71FC44593180B9CEAC
                            Malicious:false
                            Preview:.PNG........IHDR...<...P.............PLTE......................=l......bKGD....H....cmPPJCmp0712....Om......IDATh......@..aI...B..C..l...^.%.`....>.]..|0.....a...hb...0......q.......p"....;...K..x=...p...y.yy~J....|...\.......y..X.......'...>1...Ky..f....&........N`..f0..b...3.......`Z.3..3.....o.......4.&........SV...4.....IEND.B`.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003L.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.350235821780943
                            Encrypted:false
                            SSDEEP:48:wBsAajw3Ey8Zt+uE6HcXmEc9KsoxrdQqr8iwBXmzpa9ccRh:wBsQd8ZrEPXg9KsgRQy8XkaR
                            MD5:8D390C78AD733409B297B32EB5E84E33
                            SHA1:86E0961DE3AF32F8CEE1AA519694838014725E91
                            SHA-256:7925052E0FAB2B95875B0C0A70324A288508B2F4FA54A6230E3465E33A1AB197
                            SHA-512:5F784B3E8F3B892B4CA4CEAA51067520541C50B76E8E042567A2EAF80168AB381CB912F646B8153FDBADBED46D11FAF086EB51C22A3AFA4E52C2EA853FC59037
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.q%......q%~TNA.>WI.pc.(.q%~TNA.>WI.pc.(.q%..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............o.Y.].....>.bYY<....N...^..................06.L.;'.............f........................................I.qk..B.....LZ............o.Y.].....>.bYY<........o.Y.].....>.bYY<..........q%......q%......q%..........................................q%j.....q%T.]...q%......q%..B...q%H.....q%..B...q%..>.).q%..J...................;........4...4...4.."...............q%..q%..q%..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........q%......q%....#.q%............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003M.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 40 x 617, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):827
                            Entropy (8bit):7.23139555596658
                            Encrypted:false
                            SSDEEP:12:6v/7Hs2NwBW1mtjeSfaTHHy05riYUtr8y8PQvPYzzg979Reip0QPqc:oOsotazy4rStr8y8PQIzWea0Qv
                            MD5:3E675D61F588462FB452342B14BCF9C0
                            SHA1:86B62019BC3C5BE48B654256B5D10293FC8C842A
                            SHA-256:639EADAD468B6B32B9124B1F4395A8DA3027FF7258D102173BA070AE2ED541AE
                            SHA-512:E6EA855B642ED36FA82F8E469A826DC57EB0C36E307045FF8D166F67AF9242C87840833BE31FBE4706DC54100E999D6A3D3A78D0633A3114735818874AD34758
                            Malicious:false
                            Preview:.PNG........IHDR...(...i..........`PLTE...................................................................................................bKGD....H....cmPPJCmp0712....H.s....qIDATx^...0.Cg.;......@j..2c.=~KP.[H~..@..8...?U.g.n.a=.=.).....3..u^(.....L....5..........8.}..T.f.n.a=.=.).....3..u^(.....L..r....s..8.....W]....,..9..G?.a..`c.z...E.p...)Y.P.....#....@9.7].....,..9..G?.a..`c.z...E.p...)Y.P...`b....0.b.+~{.Pu...1..<..0._.l.@O.y.(...V3%..J....s... .(g.+.qyWu...1..<..0._.l.@O.y.(...V3%...%R.L.Q..x..R.<t.o......7.............:/.E..j.da@i..`b..Z......u.>.?...7.............:/.E..j.da@.Dj..9.W....s. .....:.......L...">w..7... .....:..."...L..."..a....D..Ya.l....E.{.@&.|.._...7..D..Ya.l.....{.@&.|....0.J.."z.0s..s....=g ..>........"z.0s..s....=g ..>..l..1...y..g......IEND.B`.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003N.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.342398642863817
                            Encrypted:false
                            SSDEEP:48:Ks6JO436Nt2QDAEX24L1Xz9kqKmoFrdQqrsV0BX4NkpIp:Ksn436NoEXn5Xz9jKmERQysK5I
                            MD5:14A0A6FBF500E97C5FB5C9FF715771D0
                            SHA1:2B390508680343F98ACB87710A00DF0FDA49BDC1
                            SHA-256:296A92807F3D6A1E75F9CF2F6D37CEEC4739161FDCAADEFBCC5DBC1B90F47F0E
                            SHA-512:F524B2844CF2AFE00E0CCF84377FD9FDABF6C799A8A7C301F0FC05452920688B421F0996ABE51156022714D1A91FA68F7C6A7E29B8EFF27A5267AB55A5FAF58F
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.........f.......k.....f.......k.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................-..!....._.....N...^...................w.@.\:..:..........f........................................I.qk..B.....LZ.................-..!....._..............-..!....._.....................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003O.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 50 x 600, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):4410
                            Entropy (8bit):7.857636973514526
                            Encrypted:false
                            SSDEEP:96:E/pQuIhKZ7u06dICH3AroiTe8DGTl55poBUmLNjpH7MvDHjfm:MpdZtPbknnRPpkLNVMvu
                            MD5:2494381A1ACDC83843B912CFCDE5643B
                            SHA1:98F9D1CC140076D1AE5A9EA19F47658FD5DF0D66
                            SHA-256:5EEBE803E434A845D19BC600DF3C75E98BB69BD0DE473CEEC410D1B3A9154E28
                            SHA-512:0E64CC3723DC41D94910F7ADFB6A0DFB5049350FD15A873695614E4A89ABD78B166BA4E9C8CB95E275FB56981539DECD2A7F28FBC25E80DD5E2DEA8077CC9489
                            Malicious:false
                            Preview:.PNG........IHDR...2...X.......E.....PLTE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................B..(....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.].\TU.?3"...(..L........q.Q...H.*j......W..Xd.ie.f..%.XT...em..m.m.vkik...>.}..}|..{'.U..~......}....s.............,CVu.x.:C..5...;.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003P.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.338768270283132
                            Encrypted:false
                            SSDEEP:96:YZsGsGQlhllEZnf04XjwS96UsvRQycyQi8vA1J8voUz:asgQlaB04XjwS96UsvRJcL
                            MD5:487AD80E5EE44DB0FF518AEE7DF75DB6
                            SHA1:21458A6FB3E734C483BA306E35A84710DB532291
                            SHA-256:C427FDA09FB8E1D314CA65FB2474F2F9B8E6FFF37DC61E776C8F502F10DE7E90
                            SHA-512:67EC9AB3C0DFAEAE7DD75E61BED655578DBA0316B7298953010A81AFDD4ECF8F5C16F23A4BB285730FB89B6F00ED24694FFBA54403CDF4262B4FFDF5584AE3D6
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.rt......rt'.p..+..w.4^..rt'.p..+..w.4^..rt..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............$p..........H....N...^..................//.mF.....7.z........f........................................I.qk..B.....LZ............$p..........H........$p..........H..........rt......rt......rt..........................................rtj.....rtT.]...rt......rt..B...rtH.....rt..B...rt..>.).rt..J...................;........4...4...4.."...............rt..rt..rt..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........rt......rt....#.rt............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003Q.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):136726
                            Entropy (8bit):7.973487854173386
                            Encrypted:false
                            SSDEEP:3072:SIXmy5Tl704vW2ZKkvV8UU0ZWUF0BJwySIdgz816YzDc1+opecYPn:Sny5Tl704fZFV8UU6LGXwyS4xohpQPn
                            MD5:4A2472AC2A9434E35701362D1C56EDDF
                            SHA1:16FA2EA2D2808D75445896E03B67A93000EEDDD8
                            SHA-256:505F731CB7707EFAB2EB06685B392DC7E59265A40B55AAE43E5DC15C0A86CBA4
                            SHA-512:5E28D8FB2AC62ED270968072A30013334461F7CAE96058AF9EAA6E10912989DC47112D2133892BF61F7A516B77C6FF71BA2A000B750A9F95C787E538B09595C2
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQaq".....2B....R#..b3...r...C$...X.....Sc...9.%'.(Hs4Dgw..T..5GW.x.)......................!.1..AQa"2.q.......B..#c........b6.Rr.3s$.&..S...C4.%5............?.........(......(......(......(......(......(......(......(.G/.GE&...)..P.x..B.({i2Y;.z?G...Yfc.)H..^....#.....}3..Sc^.H..+...M.a.P.....GS.....H_.3..<....1f........1.<.\..nn-..s.s.\9Y....=.......S.0.......N..cA..Io..r.3..........ay.....K.....,.;9..Q......xO.Fa.2..>........{4k.....|....?U....3.8..._/3....#.. t.y......yY.......e.<........#.....B.....Z.%.Y..S.ye.W4...l.......X...%.@y}>....l.yi..D..W......L..._D.Q....)...E....n.%...*..K.4#.8`..I....h..h.o..I......-...hB...3..u.(5..........n...,.@....a.t.9.....@.s.>.&...@

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003R.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.348413067407403
                            Encrypted:false
                            SSDEEP:96:7WhsBRNsuvpAEKHPXMp69WgYRQy4c5jo+WyDoPZl:7WhsrNssdAPX269WgYRJ4c5jo+WyDohl
                            MD5:D6712CA5DEF610DBBC5164A46A60B845
                            SHA1:2CBE4C54A8EE25D37D88A69D96733A84C89A83F0
                            SHA-256:8F6A1E44E3BC41AEB823A872FD24E47FE0D6292A81CDC78C1B3D1C95DFB5F9EA
                            SHA-512:54B48C29E5D61A9641A09275B78934B9B7CA4AE17F0A467A19036B997563D0B79708C5096C598AA7CB79FCCD6CA531D230AF44443D43F606723321F14E131130
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZo.......o..b..........io..b..........io....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................c...+......G....N...^.................W%.6.N....ksgc........f........................................I.qk..B.....LZ...............c...+......G...........c...+......G.........o.......o.......o...........................................o..j....o..T.]..o.......o...B..o..H....o....B..o....>.)o....J...................;........4...4...4.."..............o...o...o....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........o.......o......#o..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003S.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 77 x 627, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):5136
                            Entropy (8bit):7.622045262603241
                            Encrypted:false
                            SSDEEP:96:djzuNKb3XHco17p2wolIxIx7lpskdsC/ddWNKeabJbMojpxLDTu1:VzuNKb397pwlIxKp7qs3bJb5FBTw
                            MD5:FA38AFA965141EA3F17863EE8DCCDE61
                            SHA1:2B4611E651AF7549C1AA73932B1136B561A7602F
                            SHA-256:E1CB1A0EC9BE62D5445C73AA84DF38234002A7E164EE830C9DF24997802CB5D2
                            SHA-512:A372674F5CA343321BA9C413D346070709F7685706C9C6C3DC7F61846B59253A5E6FE800DBA10AE870FD3887439B2AA106FBBB51751E92A163938A4393C43E28
                            Malicious:false
                            Preview:.PNG........IHDR...M...s.....}8nv....PLTE.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................z`.....tRNS...................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003T.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.415765426967799
                            Encrypted:false
                            SSDEEP:48:zWsLBso9Kzk0at9Sth4EBDXYHk+x9ykoCKrdQqrpDEDdV+rDBXOs2DJ+u/Z:vLBs5zk0an3ENXw9ykZKRQyg83g+e
                            MD5:00A0D0002678E2FEBCD8C43630FBDC66
                            SHA1:1939DD751C8CD304AA47B38569235FEA0C74DE74
                            SHA-256:1458AB8AD53103CBFAA167DD48BCDCABEBC9DE9914CD9D7689B5658B8447A725
                            SHA-512:65F4E8917C0F606D716AC1689FB4896B17962F536820C7B1F7DBE06D1858F55C1A31DE32792857775EB2253CE4BC45DFAEC75325E1724BEFE40E61E30434A874
                            Malicious:false
                            Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ.mE......mE7..*...K3.V...mE7..*...K3.V...mE..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............q...q..3...o(z.....N...^................\(..*.J.3.#?..........f........................................I.qk..B.....LZ.............q...q..3...o(z..........q...q..3...o(z...........mE......mE......mE..........................................mEj.....mET.]...mE......mE..B...mEH.....mE..B...mE..>.).mE..J...................;........4...4...4.."...............mE..mE..mE..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........mE......mE....#.mE............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003U.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):52945
                            Entropy (8bit):7.6490972666456765
                            Encrypted:false
                            SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                            MD5:AD003F032F32FAC4672D4CE237FA5C5B
                            SHA1:AE234931B452F0D649D91291763B919CF350EA49
                            SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                            SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000003V.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.389292139772903
                            Encrypted:false
                            SSDEEP:48:zW+spcybcVq816Otm3IEbLQXXkXMv49q93VrdqrbE33BXA+Z92Md2sZUhKA:Nspu1kONEbXXP9q9FRygHZu
                            MD5:B3D2AAD18EEC98E903C71D6FCA089B00
                            SHA1:325E9857D266615CA0FAD44F2A1913184A1D49D3
                            SHA-256:122C340D2F9DCE41B93A96643D03B78AC9430C43E2202473E3CDC89499263653
                            SHA-512:F7D2CE73B0124FB1F831DBE284159E476F124C543546F57F51542044E179C973B75B1FA65E2278F817FCE648EF4C71DEA7DD9D616796A5FA7DF1D0FDF99F14A7
                            Malicious:false
                            Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................(.......(.^..U."..>.....I.......I.qk..B.....LZ.(.^..U."..>.....(...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............>.I5....b.M:.=....N...^................0t/.2.E...i............f........................................I.qk..B.....LZ.............>.I5....b.M:.=.........>.I5....b.M:.=..........(.......(.......(...........................................(.j.....(.T.]...(.......(...B...(.H.....(...B...(...>.).(...J...................;........4...4...4.."...............(...(...(...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........(.......(.....#.(.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000040.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):79656
                            Entropy (8bit):7.966459570826366
                            Encrypted:false
                            SSDEEP:1536:2kuUliOeU4os8ii3nF3Hxro/qxXD9u/kjYgMZqoEs6ZUldm:3uUsOXYIAixR2k7WAZV
                            MD5:39FF3ACAE544EAC172B1269F825B9E9F
                            SHA1:2D40DE8D90BD21D56314D3F99CEF4FBAE3712C0F
                            SHA-256:70475431CCA3C91A4EFA3B8F04864371D2D3A45696674A1A0562FE9CD8DB287C
                            SHA-512:3B9F3B32696AB7779864E83DC0C45960114A130BEE0CF4D0643DE57FF952171E5D775AA49141EE31A28A9B5D052B26EB421F26EA736D7EF4B3A7EC812CA411CB
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1A.Qa"..q.....2#..BRb..r3$.Cc..Ss.4...D%5&..T...'7....................!1.A..Q.aq..."2.....B3.r.#..R...bc$4..D.s%............?..Y..T.o.\......=.a..j..'^..s..[../........Y.......<...(..4.....7y..Ln.[9.cK.ilN...u@$.V.9.V?3..s.KL.z..w.jW.C.............@.~+.o?o8...k....,.m..9.".....q.....d....z.W...q...~...'..e..>..f#...S.....F....pU.......7..N.vfK......S..G.#.....}.c.........RXt.bq1.`.....[+8\.*.N..:......}.....r..........')......Na...&...m......c...a4_%d.............co..0.n.L.Q..E.Lt..y.|..F..4.i(>.._..\.eNL8..?z9I:hLgC.@.p....g.t......'.I!d..?1f..R..........|..4.wJ*..%g..~0bt.....*...v.......O...:.~.>~..o.x...9.@>...s.&.E.0/G.c..t.<..F.t.A.z. ......;.........Gp.P

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000041.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.469149284792936
                            Encrypted:false
                            SSDEEP:96:5asGHNHPHlhoV+3ENXE93FJERy2/lvHPHqH1YHCHrUHu:0sGHNHPHlhoVxNXE93DERyolvHPHqH1Q
                            MD5:4612A2618EC4D9474A7F9C23DA52D3C1
                            SHA1:8915705CCD9989FAC63C4F44BFEE9094A39AA6F2
                            SHA-256:C1F549562B9F8A25527E294F130C19668EDFEC5057E3C8CC0C2A58C2D60521FE
                            SHA-512:0E3FA64E93A2C3CDC710D8D5D5209F16C8319CEDB589DA642267A4977AEFA0DB46DF208FBD29F45AB91A4565B3801469AA29E04F545C6EFAEF82EA738D22C2F5
                            Malicious:false
                            Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v................................I.......I.qk..B.....LZ.r.......r......$s*..r...r......$s*..r...r...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............k)..*...!}.........N...^................v....6O.{.n..P.........f................................... ....I.qk..B.....LZ............k)..*...!}.............k)..*...!}...............r.......r.......r...........................................r.j.....r.T.]...r.......r...B...r.H.....r...B...r...>.).r...J...................;........4...4...4.."...............r...r...r...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........r.......r.....#.r.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000042.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):40884
                            Entropy (8bit):7.545929039957292
                            Encrypted:false
                            SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                            MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                            SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                            SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                            SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000043.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.34006258912763
                            Encrypted:false
                            SSDEEP:48:YuwrDsnEd28xq7+t8ZtSxEf9+XX89v4DobZrdqr3sNRXB1t8HEf/RPR:YRsyq7+t8ZYE1+XX89v4DOZRy+L
                            MD5:ED566CF131958FB73F67D75BC25BBD6D
                            SHA1:F8531165125E9A549A2343DE6D95D145326C2B94
                            SHA-256:F7CA946FDABB5FF439399AF353BCF436C6684424F853A1F1BC58A1173C7E0A70
                            SHA-512:DBD0F5FDD04E7FA705D5796C9A94FD89912D9AA21FA6896C9E363791C1E5AD34CD8FDE4D24D9F5458D17D91347E5C1C5DCF1328420614790920EC23F84AFA5D3
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ................0.*w...........0.*w........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'........................,...v....N...^...............8B....H.j.............f........................................I.qk..B.....LZ.......................,...v...................,...v........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000044.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                            Category:dropped
                            Size (bytes):68633
                            Entropy (8bit):7.709776384921022
                            Encrypted:false
                            SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                            MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                            SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                            SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                            SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000045.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.436409310311845
                            Encrypted:false
                            SSDEEP:96:57asSsj73KEg3abmXxXs9lVAQRyw9fRlU:57asjjjng3abmXxXs9lVAQRyYfR
                            MD5:E0A5F5D3091D20E28CB67D6C0F87019D
                            SHA1:E71B4D00759ECA0E854DEACED08CD8B6CC44412A
                            SHA-256:FE49A9DFCAF7ACE6E4163B8A65EF25CBE97180D3BD1A1444F099D23CF3758F48
                            SHA-512:F6063F1EC1C1448F20813B872B5D9E00FD0B71B72DA989BC62FE31121021A2EACCD1B3909A8283AAE4ACF7472CF3F92A389FB22D84D78A68F5A0BB3F0903D280
                            Malicious:false
                            Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZ...........:.*i...7$\.....:.*i...7$\.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'........................J.......N...^...............ApQ..GBF..*..S.........f...................................$....I.qk..B.....LZ.......................J......................J...........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000046.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 176 x 513, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):11043
                            Entropy (8bit):7.96811228801767
                            Encrypted:false
                            SSDEEP:192:YyroOCsBI9pkCFsHHX2RE6VOlPuIqmBtJNBfAr+ADP1IATaNeTyZ4GF+WQQ6Qwq2:BUOCsB2kCGH32RiPDtDBfArPDP1I/eyM
                            MD5:8E9AB9C28B155A66BC5C0DA5E2A4EFB5
                            SHA1:972E61F162D48F1CEE21963ECBB2FE439105DB55
                            SHA-256:B243A24FA13BC8523450E22F408F9EFF15301C938F8CA52A57018B58CE6785DE
                            SHA-512:12062D69E676B3B34AFCEF25AC17B40294282D5BAB6C0110680293D7CC96EC17EBCFE104C284E64A30EE3C483E319E9C37C03F6EE82C79632180E45C7A684E8C
                            Malicious:false
                            Preview:.PNG........IHDR..............`....`PLTE............................................................................................... .......bKGD....H....cmPPJCmp0712....H.s...*YIDATx^.]...,.N.8.i......0..e..y.......8.6....Fo.........=...F..._..........O..{..............3.|.L.|.............>.....v..n.1J...k...."....7........J._.5LQ`..k...._Z.W.x:..k...g..._.....u<.Q{...1...q6.cs...l............30.g...< W...a.5..>O....9}..c..........s|I.).>.fo4.<q......>...c.:.u..co.#.7,.O..G./.K.|..q.p...(.(....iH.......m..+.7...../..{W.l....b....?.`^.q.9L&.>.hN2`1..m...]$.0J....rBy......{.._...G....;.r.Q..;..,...9..F...t;.+..2.Ub......V...8.k..5.........'[..s.H..).......%j._.&.....BN..V..q...T...#..........0.E&.o7....$..m..8g.f._$..k.8...5......HgQ...L..\.........)B.I.r.(..8.a..$N.9.=..o..Q..(.e.a..O.....c.= .......$0..X.S,..(p......$..l.c.I...=."......g....^..#~,&.a9iK..ZNE`...pFJ.@Wd?.<..Bt.E.......e...i.%d...}.!..B......9.........B}.....5...;..hL.D.....4z.....|.)

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000047.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.331555813985236
                            Encrypted:false
                            SSDEEP:48:UsuBeFGQ8tGWeEQLgXqxx9N12oZrdqrTzzGRX3ps9eC1Lp:UsvGQ8teEQ8Xqxx9N12QRy/zGra
                            MD5:AC81A6D754C0F6405FE5A69C1070C4E9
                            SHA1:FE2CB16CB3A56B3DF71C8BDBBC21D6851D8B2480
                            SHA-256:DB30B75B4E2AC30F376FAB7DF14F0D8A791A8A33F417527A02B11784BE444B3D
                            SHA-512:59573A0797F1B17CFA3E3D826BF1333E96D84AE8193D5A40F1D42732BDC6549A396B81030254439D9157751E05B50FC03F3D02C48573D067DAC5A4963EDEB537
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..............{.-~.x.zo.......{.-~.x.zo......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................l...vE.........N...^................t.GZ.5M.8.V............f........................................I.qk..B.....LZ.................l...vE..................l...vE.............................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000048.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 40 x 650, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):647
                            Entropy (8bit):6.854433034679255
                            Encrypted:false
                            SSDEEP:12:6v/71rwqZMXVs99W1YvpLp/Fvl+f43ocLtuplb+CrGotLRd:+wqWXVs99rpLpNvr3pIx3b
                            MD5:DD876AA103BEC3AC83C769D768AD39FB
                            SHA1:1833603AA9B6A7E53F9AD8A336F96CCE33088234
                            SHA-256:1262DD23AD54E935CFA10FEB1BE56648E43BEF1116696CA71D87E6E033B1CA7D
                            SHA-512:946DB2277213104A3B29EC4388578B05027B974A3093B4CCAD8847397AA51AE308BC6A199E5705E1F901D6E4B1BA34D8DECFD6E5B6685184A307D749D7CFAEDD
                            Malicious:false
                            Preview:.PNG........IHDR...(.........xk....`PLTE.........................................................................................>.S.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.)..1..7w....6.*.H`T6.ha.k.............b!....Ba..C..P.4K..@.....h.E..X....PX+.P.-.....@@"...o.O4....xZ<...B...B..,A..y.s<......b!....Ba..C..0_p. .......=..,...i. ...=.j..N...........{4+...xZ<...B....|.....$.K<.vyE..X....PX+.P.-.:... .'p......\,...i. ...=.j........K.....%J..S+.....q..k.H.@DD.s...:..J.K.DDL.\.@`,.DD.:.(]..N....KD....A M.....F..S+.....1.sq........\.t..;..../...~k...4.DD.:..]..N....KD........@DD.s...:..J.K..[...Q....V......IEND.B`.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000049.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.341974689184768
                            Encrypted:false
                            SSDEEP:96:JEsa3Eqxth9EjF0cX4c9rCgRyK+m87Yo:JEsodxmxRXN9rCgRyKr8
                            MD5:4B8F33A8D0906CAE880BF888A0D88140
                            SHA1:AD9B8FFC692CC830F9AA10CE5ABF2AE270BC863A
                            SHA-256:07585A5027237E8DC3E48A33E32D1E190BA217D3AAE627917A4DE05610018869
                            SHA-512:65BDB8403065208804489084F03F4CE5AE7B73F511355FB62B0AF5D1C36BDF1DBA90EC291A2472854C9AED7F4E3DBA4312E9FEA3398E79F5E17F54A30D9782FA
                            Malicious:false
                            Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ[.......[.......#V....[.......#V....[....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............y~.NC...<LF..L......N...^...................ZTiA................f........................................I.qk..B.....LZ............y~.NC...<LF..L..........y~.NC...<LF..L...........[.......[.......[...........................................[..j....[..T.]..[.......[....B..[..H....[....B..[....>.)[....J...................;........4...4...4.."..............[...[...[....z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........[.......[......#[..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004A.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:27:10], progressive, precision 8, 102x792, components 3
                            Category:dropped
                            Size (bytes):52912
                            Entropy (8bit):7.679147474806877
                            Encrypted:false
                            SSDEEP:1536:DB/nIviNJD9C8kfJj6TkVr4q24FsUpjPc021si:DdnIvi3D9C8Cl6Dq24ayPCz
                            MD5:1122BF4C2A42B4FA7F29D3C94954A7C9
                            SHA1:3750077A830FE21735A43ABD35C63BA9A4D4B0DE
                            SHA-256:423B0DD1A93B391D15B1DC8D8757C3BF5725FF2E7A59E6E3140033E2876B67F6
                            SHA-512:4626EFE2EDED2361D6296B57F994DC434CC9D02357A8A6A67D84A544FB8A1CFE0005EA98F846AB963BED7F2B6CE96BC9181182C9459843A52A98D3A731A4FE73
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:27:10............................f.........................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....]+\.9.9.P.d..Z.?~>.-...]6=....*.......S.9G...b<$..Z..........>.v.o:.o%.e...z.F`...[.wo..z.....k..E...5....G..7.......c2..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004B.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.32168008490134
                            Encrypted:false
                            SSDEEP:96:ms8ITx/ZZZEksXb9TKoRy9SOTAoY9oGl:ms5ZwksXb9TKoRy9SPD
                            MD5:F63E0385D5E8F09DE5124A9E9D832A17
                            SHA1:FF13E38B643E06099D1486293B0DF3A67EC941F7
                            SHA-256:087DC5904F2FB83F57C1E373D7C44A3EFE21C9CF50114612F1F72E149E88915A
                            SHA-512:4659571E950A3F2510956BB43C5829A3BBF1A2BF481DE506A70A331796D963DA571146746CF06A89CA9DE68C62507386F805EC8A92A0F200456F698035F062E1
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZs.......s...S-...U.>....s...S-...U.>....s....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............!xn|..b......J......N...^...............k.x.B:hK..p............f........................................I.qk..B.....LZ............!xn|..b......J..........!xn|..b......J...........s.......s.......s...........................................s..j....s..T.]..s.......s....B..s..H....s....B..s....>.)s....J...................;........4...4...4.."..............s...s...s....z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........s.......s......#s..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004C.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                            Category:dropped
                            Size (bytes):27862
                            Entropy (8bit):7.238903610770013
                            Encrypted:false
                            SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                            MD5:E62F2908FA5F7189ED8EEBD413928DEE
                            SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                            SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                            SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004D.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.48673221871746
                            Encrypted:false
                            SSDEEP:48:F0PsRdkZgX36MtfjlfE5zb6XXK9G9T4o9rdqrX4krRXjhpWNao2UpneSx:CsHX3fhVE5X6XXMG9T48RyDre
                            MD5:27D760F7D6D960E0A569477E2CC9DFDD
                            SHA1:4EF7E2B586AFC0A658AE6FDDC30D8C1BF3B7F816
                            SHA-256:54A2811D0AF222D9EE26D740CFA3993409F1D49DD709EB62B118F6FB29AC6487
                            SHA-512:5C8917ABE28841B4DD0526945D6FB37DDFE47B7AA960279F4EBF6F6D8BB05ACAB4F5279923C4C96A624377B9AF9BC34FF1D5DD220833BF1E18B323845CF0CFB4
                            Malicious:false
                            Preview:2...>.......r...v...f...................................................................................................................................2...>...N.......v................................I.......I.qk..B.....LZ9.......9......!..5l.-.9......!..5l.-.9....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............t.5...R...K.+....N...^..................&%JTH.DgY..ug........f..................................."....I.qk..B.....LZ..............t.5...R...K.+..........t.5...R...K.+.........9.......9.......9...........................................9..j....9..T.]..9.......9...B..9..H....9....B..9....>.)9....J...................;........4...4...4.."..............9...9...9....z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........9.......9......#9..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004E.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 50 x 556, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):977
                            Entropy (8bit):7.231269197132181
                            Encrypted:false
                            SSDEEP:12:6v/7QiFJaY/z+obuqFA4fypjQSbtBK+lcqNGSbb7XTJArRRzN5DjNRkPmu5cCbR2:x0QY7xbjy9pY0JPXLTWroeuCCbX0
                            MD5:B7F74C18002A81A578A4EE60C407A8D3
                            SHA1:70A7D4BB1B3ADF4397D168AD0D81B286F88EBDE0
                            SHA-256:95F59A0433050180D4C0E8858B83363D51BEA6752A8B7CA516A8677854D8F5B6
                            SHA-512:13186A7CDCE80BCA9D2238666D6D7A989FA1887EABFA5D8A9A63EEC304DFD4BE8EFF652205FA56E1D1CEE7D3680AF8C70A952AF73AB3C246400E8D4EBECBDBA9
                            Malicious:false
                            Preview:.PNG........IHDR...2...,........A....PLTE...................................................................................................................................................................................$.y.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^...0.D_.......cck.....%a...X.a0Y...-..!.G...[....(.r.H.$...1 .zq.4V.e|a.6.X..4..kl.%....=w....6..TN.....{.4..T/.z...../.....3..!~..t.#b..^.....E!.SFb ...-.....^...,..C.!.b...i._c...s.X.w.. lsQH..H.gKc@@...i. ....m...;Ci....@G.; V{..lO..\.R9e$..{.....P...E.+.2.0D.B,..P...56.?......K.6..TN....^z.4..T/.z...../.....3..!~..t.]b........E!.SFb ...-.....^...,..C.!.b...i._c..Y.O...?.9k2.M.?5 .n.P...,...d._..%M?....6....,.1..R.4.a.R.+..U.Q..P...vd..T........j .]@....."..lJ../.90.4...Y. ...9.%...{......Hc%.....i..%M?aG..H....o.q.......4.......X.d9.r..CI.O.5.Ri0?.s\b....w...>/k..4V.)Y....P...vd..T........j .]@....."..lJ../.90..2..MP..l..?....K.X.....IEND.B`.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004F.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.353645564873936
                            Encrypted:false
                            SSDEEP:48:3wXslVAsDtDoImuE3VpLX6XPHs9D7oQsrdqryJJRX8Rg9Ei9:As8sDtFE3TOXvs9D7jsRyKJu4
                            MD5:AE890B88664F272F3D5E8EE05E222565
                            SHA1:9737D9146C4C0333F6E6253ED25C8720001635DB
                            SHA-256:60874FC2D3A95C22E80DB8673EF036F83DBB47DB4C37445DF52301F93EF4A987
                            SHA-512:258B75C4F5D7EE70838BA9A8F86C87AD511B2FEA338C7D36CAC7304719C226E0DFA5ABBDB86F2DA62FDA23E3D49C68A82817C84255482A69249850FE21AF1A50
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.......#[.`....H..7..#[.`....H..7....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............?Qp..cH....B...B....N...^................0d3.$\@.H.............f........................................I.qk..B.....LZ............?Qp..cH....B...B........?Qp..cH....B...B................................................................j.....T.]...........B...H.......B.....>.)...J...................;........4...4...4..".....................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4....................#.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004G.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):34299
                            Entropy (8bit):7.247541176493898
                            Encrypted:false
                            SSDEEP:768:BrSX4V3P8AIc4KLkHeXRUer0zrhOmXfvG0yH82I:tSXuIc4K2eBtswKsHg
                            MD5:E9C52A7381075E4EBC59296F96C79399
                            SHA1:BE295AD24D46E2420D7163642B658BF3234A27EA
                            SHA-256:D56CEFE9EE2FAE72E31BDBA7DD2AA4426EA22E3CEB22EF68C8F63F9F24D5A8BC
                            SHA-512:95CC96DD4459EBAE623176033BA204CCDC50681A768F8CBAE94C16927D140224E49D5197CAE669C83C77010C5C04C1346CF126BEF49DB686F636C5480342A77F
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.......................................................................................!.1..A..Qaq......".#4.2r3.$.%...B.5U&6....Rb.Cs.7..cDTEFVf'...S..dtevw.u.........Gg.....................!1..AQ.aq.2....."#3.4....r..BRb$CS.D............?..5..............#....v.q.m.}\..{....;...r....h.....J..q|..'.;\..6..v......e...../.k..|.8..i..|..]..3e.m....n..Z.GS..n".y..w.-...[a...7A.....i.4.)9\..~C...=.........s..\V]c.D1<./.g.l.&v..~.h..]....zb>G..y:vNS.\......LU....t.{*..Z#.?..v-...wn.rR...P.....y\=.v....../..9_...m4...V.|.+.o.#.......xj....}..>.s.>C...m.[;.>.p...=^.i.X.(..1...{.F#N.W...xi.z...4..u[{...yO.....8..}\..2...KlX.nbya...2.&.F...R.b.k.7.GV.x.h.y\.Q..O<\>......-...=...r......\......Z.Z...Jf.'....z..Y.q>.p....o..K....h..R..c.lg?......A.Z...Y.q3.L|.'5...

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004H.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.330613975125796
                            Encrypted:false
                            SSDEEP:48:y/nsTsFWkGftS8tYA7EHSFLUXyJ29MgzMoBrdqrqGpRXzpml6V:y/nsSG88qyEyFwXy09bMYRyfpw6
                            MD5:440CF16C15053D8568695F0479BC7A72
                            SHA1:4905002CCEDAAF35D7F7F175BE75353AA0D94723
                            SHA-256:36F379B3F5BF36C4C11D0AC650BE03A20AD2B6AE7F88D85F5C2452D8E0FD4CAA
                            SHA-512:45D8D051237D1AD60C5A9C4A2BD49BA3F5C670A05693261F35712DD57C282189E43147D064B2DE11CD7A78682F425F1F723F368BDEC5B3534D59EB80AFE5ED9F
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ1]K.....1]K.?.....3,...1]K.?.....3,...1]K..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............j..lJ?.&...Z......N...^.....................4O..&..K5U........f........................................I.qk..B.....LZ.............j..lJ?.&...Z...........j..lJ?.&...Z...........1]K.....1]K.....1]K.........................................1]Kj....1]KT.]..1]K.....1]K..B..1]KH....1]K..B..1]K..>.)1]K..J...................;........4...4...4.."..............1]K.1]K.1]K..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........1]K.....1]K....#1]K............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004I.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 171 x 552, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):10056
                            Entropy (8bit):7.956064700093514
                            Encrypted:false
                            SSDEEP:192:edmu1fpj5DVHuooK4EpGLbAdT+dBXYBR8D1V2p6KwoPR6KUX9ojwRpgA:2Pp/B4LbAF+dBo/1E3S6JScpgA
                            MD5:E1B57A8851177DD25DC05B50B904656A
                            SHA1:96D2E31A325322F2720722973814D2CAED23D546
                            SHA-256:2035407A0540E1C4F7934DB08BA4ADD750FCB9A62863DDD9553E7871C81A99E3
                            SHA-512:BC7DC1201884E6DAFDC1F9D8E32656BFAEE0BB4905835E09B65299FE2D7C064B27EAA10B531F9BECF970C986E89A5FD8A0B83F508BBA34EB4E38B3F7F5FC623A
                            Malicious:false
                            Preview:.PNG........IHDR.......(.....!..t....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4.....bKGD....H....cmPPJCmp0712....H.s...#.IDATx^.w`......$..B....... ....fz5..6`l\.8...Nsz{.//y./....{.7}g.....e.....~.......s...f.....%c...6....O.PJ...Y.oi...9..'j.2..6.-

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004J.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.368193433762802
                            Encrypted:false
                            SSDEEP:48:BZOs+HNtYFOtR+EXh2aLUX/n9/D9xoeyrdqrQHBRXSF+pyF:BYsutYFOKEfIXv9L9xJyRyQhdy
                            MD5:578EE2D9EED147551284C01EEFA2436B
                            SHA1:DEC22516D592BB8ACE8375E6167D55F80A0F82A3
                            SHA-256:2A56DFBC77499EC0EC37638628236F2DFC08D45B8669982C38D0E28C8FB17135
                            SHA-512:33B29E584083E660AA7F48B4537AA7D22DFCAE077EFD6F252D344031A468CE622837E681E8484B3351D72A3978E538047F790CA6617F985232C81C84307C9FE5
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..............7.8.);n.y......7.8.);n.y.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................=q.'.9[.U..=S....N...^..................C.zB....m..........f........................................I.qk..B.....LZ...............=q.'.9[.U..=S...........=q.'.9[.U..=S........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004K.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:11:38], progressive, precision 8, 577x757, components 3
                            Category:dropped
                            Size (bytes):84097
                            Entropy (8bit):7.78862495530604
                            Encrypted:false
                            SSDEEP:1536:cgHTEuD99rHwA5MSadIV2MApVmfJkAKOQ/Z1I7ngpDDyHfKFVITrU:HHjXidIhApV88/jIEmrU
                            MD5:37EED97290E8ECB46A576C84F0810568
                            SHA1:18D9FACB4CFA3CBF63B882CABCF30B203EDF4126
                            SHA-256:140DD943D0F0CFE6AAA98470B7D1A7CB62CA02CB1D8F522DD2AC77433232EF41
                            SHA-512:E0F57314C136211B8253EB2AC0093DED82198E7170D4F97C40D82FD4EC4123D2AAFE3EB4EBC3E7523C4DF4D77619408773871BDE15B6DC6C4049C71D5B9D4222
                            Malicious:false
                            Preview:......JFIF.....H.H.....hExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:11:38.............................A.......................................................&.(.................................2.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....b.xH......T..I...S.q.~..../s.R.x.....8.a..vE.5...-.G.A.4...._......$K..d.@NC.q....J.....>e".I.%...I0).R.I$........M3.F .

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004L.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.324047080466499
                            Encrypted:false
                            SSDEEP:48:bsEWIlCt68ntpXl8EMx8XP/9zDohrdqr8exLfM6RXu78JHBJJ:bsSCt68nh8EXXX9zDYRy8X6x
                            MD5:14180808F08C6ACD40A08A36CE7607C1
                            SHA1:228262FAB0BCCE20296A84E1BC321C987FEA60DC
                            SHA-256:E87EC9A717BD72796D706CAC3C3EFABC57039D8936F4F2603703199078581093
                            SHA-512:F49D5F171F4F186490FED50F46F592E8E2B32364ECA33F80F35DE37F5409B589FBD43900F0550715EC5341672C0046F00808F9D60A7C4FB941B08D91265FE7D2
                            Malicious:false
                            Preview:2...>.......L...v...@...................................................................................................................................2...>...(.......v...t............................I.......I.qk..B.....LZ%.4.....%.4n#:.......J..%.4n#:.......J..%.4..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................njh.....".sk.....N...^................+...@.pD...T........f........................................I.qk..B.....LZ...............njh.....".sk............njh.....".sk..........%.4.....%.4.....%.4.........................................%.4j....%.4T.]..%.4.....%.4..B..%.4H....%.4..B..%.4..>.)%.4..J...................;........4...4...4.."..............%.4.%.4.%.4..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........%.4.....%.4....#%.4............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004M.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:26:15], progressive, precision 8, 216x792, components 3
                            Category:dropped
                            Size (bytes):64118
                            Entropy (8bit):7.742974333356952
                            Encrypted:false
                            SSDEEP:1536:ORG4azGOKXzkEmR4bdRSbxONOoz0khbSb4J/5GZK5SWUlRwUYdv1M:ZXzGXzJdhRmgHfIb4J/5GZK5SWUldYdq
                            MD5:864EEA0336F8628AE4A1ED46D4406807
                            SHA1:CFCD7A751DFDBE52A20C03EE0C60FDFFA7A45B93
                            SHA-256:7CE10D1EA660D2F9CF8B704F3FAB2966A4CE2627D9858D32C75D857095012098
                            SHA-512:0CAA0C54C14571C279A75F0D5922F78A17803CF6EE1724D66819F7F5944C0F5B25CB586BB686A52808CDF2F8FEB3E4864052A914884054EF7DE44124A8CA951E
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:26:15.....................................................................................(.....................&...........s.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................#.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....NC+n....<.=.7..&.8A56..@^.Q..\\...E.>..".&G.......J .'....$.I)........0.../..mv...D....<v0=..ugc+..l.o...=.c.......x.&D..{`8...v

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004N.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.345003505445993
                            Encrypted:false
                            SSDEEP:48:isyT3knT2TqHW7ttcEpiXQK9AG5oCardqrvC5DRXEnB2T2ThTDKTpT4mT76jl:isXHW7ME4XQK9T5BaRyvC0VO6j
                            MD5:3B7426500FC569CF31E32ED09994D49A
                            SHA1:E3EA23F290D2558665076860A4E967209A68D450
                            SHA-256:69048279FD629F6552B79A9E889F2CA746319059951FD12454FA703BEB3906C4
                            SHA-512:F8E3CF409EDD15955B3A85A7B17DD8BB7252ADA1943EDC355C7A82FDBE4467180B559FC92015DB8081C4105C49FF8E22D83BDAE0D0B9C2F3A13B76FAB54F64A0
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ...........0F<9....C./....0F<9....C./......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................i....+.;A..O6....N...^...............z. ....K..............f........................................I.qk..B.....LZ...............i....+.;A..O6...........i....+.;A..O6........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004O.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:09:29], progressive, precision 8, 609x675, components 3
                            Category:dropped
                            Size (bytes):65998
                            Entropy (8bit):7.671031449942883
                            Encrypted:false
                            SSDEEP:1536:klZtmExaFrtWgpc+Sg+DKeplHClpHfRtPMbe:VEWWl+SNDKqlH8p/vse
                            MD5:B4F0A040890EE6F61EF8D9E094893C9C
                            SHA1:303BCBA1D777B03BFD99CC01A48E0BB493C93E04
                            SHA-256:1F81DDE3B42F23F0666D92EBF14D62893B31B39D72C07AEE070EAE28C2E6980E
                            SHA-512:8F07E4D519F2FD001006BB34F7F8274B9AF9EC55367B88D41D24E5824FCE4354FD1290CE4735E43930829702ED53F41DF02C673904A7091E9354C28E029AD4EF
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:09:29.............................a.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..-O..s(...gO..@...[..+....+...H.'m........L.......@.......[k...S..O..p.'{X..3......]W..w.+.V....[.-.....2..i..i$.p.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004P.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):8192
                            Entropy (8bit):3.238519072068941
                            Encrypted:false
                            SSDEEP:96:esNz1WmdgTle2+WEcAqXXBsy9DZNqNPgR0Tqhe1EVMSi:esNz1zgTleTc9XBsy9DZMIR0Ce1EVMS
                            MD5:9DFC7517B3C5B507FE93136BEEB2F304
                            SHA1:3258AC78586AC0FE57B3212BED8C0600934DFD19
                            SHA-256:5FAAA4FAC6CA47BDC52D6F9957BE32AEF4AD4C6A94F8BD8CB6FE338CEC8490FE
                            SHA-512:4C46A7333E520966663631110043CE8F28E550630C81ACB312C2B28C1CDE195BD7967F01FA99F6DBBF6B5A2B08B521AA33A9054CF297457157E39FB98DB54AB5
                            Malicious:false
                            Preview:2...>...........v.......................................................................................................................................2...>...j.......v................................I.......I.qk..B.....LZ.z.......z..#.....D'....z..#.....D'....z...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............:../..|.E?..M....N...^...............q..^...L.3[~.V..........&...................................>....I.qk..B.....LZ..............:../..|.E?..M..........:../..|.E?..M..........z.......z.......z...........................................z.j.....z.T.a...z.......z...D...z.H.....z...N...z...?.#.z...9...................;........4...4...4.."...............z...z...z...z...y.. x.. ...........$........4...*..7*..7...........Op.b..F.$..i.................;........4...4...4..........z.......z.....#.z.............................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004Q.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                            Category:dropped
                            Size (bytes):32656
                            Entropy (8bit):3.9517299510231485
                            Encrypted:false
                            SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                            MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                            SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                            SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                            SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                            Malicious:false
                            Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004R.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                            Category:dropped
                            Size (bytes):12824
                            Entropy (8bit):7.974776104184905
                            Encrypted:false
                            SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                            MD5:2628353534C5AD86CBFE57B6616D46DD
                            SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                            SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                            SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                            Malicious:false
                            Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004S.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                            Category:dropped
                            Size (bytes):32656
                            Entropy (8bit):3.9517299510231485
                            Encrypted:false
                            SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                            MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                            SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                            SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                            SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                            Malicious:false
                            Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004T.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                            Category:dropped
                            Size (bytes):12824
                            Entropy (8bit):7.974776104184905
                            Encrypted:false
                            SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                            MD5:2628353534C5AD86CBFE57B6616D46DD
                            SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                            SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                            SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                            Malicious:false
                            Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004U.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                            Category:dropped
                            Size (bytes):32656
                            Entropy (8bit):3.9517299510231485
                            Encrypted:false
                            SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                            MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                            SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                            SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                            SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                            Malicious:false
                            Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000004V.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                            Category:dropped
                            Size (bytes):12824
                            Entropy (8bit):7.974776104184905
                            Encrypted:false
                            SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                            MD5:2628353534C5AD86CBFE57B6616D46DD
                            SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                            SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                            SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                            Malicious:false
                            Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000050.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.340878191924927
                            Encrypted:false
                            SSDEEP:48:YuasCgRvClg4ggrN0XCHuStNZWjtxEya7+KX/+K9FdljdcCrd3rNx7RX/Fsg4gl5:YlsJgr8CHfC/EyaSKXmK9TlOCRbbx
                            MD5:C7D759546E4F3D942D2159C79257C771
                            SHA1:CC2B29C2419B030E06984F5D256B9A33C07AF7E9
                            SHA-256:1401A500EA5704ED79026D75DD671EAC124EF1C59688DE9A516EE12C53882C05
                            SHA-512:11D103D0BA195F96BDD3C40DCE7600FB95AE31259FA2BD02BF1A1BDD36F3650AED0F7EF51CF4F63453A8D912B284A879D0ACA6C900D8CF57BA42748BAD50BD97
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZWn......Wn.p\!_....|I,H1Wn.p\!_....|I,H1Wn...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...................m...<."\......N...^...............p6...]L...z.^w.........f........................................I.qk..B.....LZ..................m...<."\................m...<."\...........Wn......Wn......Wn..........................................Wn.j....Wn.T.]..Wn......Wn...B..Wn.H....Wn...B..Wn...>.)Wn...J...................;........4...4...4.."..............Wn..Wn..Wn...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........Wn......Wn.....#Wn.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000051.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):39010
                            Entropy (8bit):7.362726513389497
                            Encrypted:false
                            SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                            MD5:9700DE02720CDB5A45EDE51F1A4647EC
                            SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                            SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                            SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000052.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.416818788341292
                            Encrypted:false
                            SSDEEP:96:NsZCr7q7BcuXE+pXk9WzKRuRbp6GsGZAG7GRGsGAwGfG:NsZCPAqHUXk9WzKARbp6GsGZAG7GRGsm
                            MD5:628A7F7BABB691704AD9DA10A850CACF
                            SHA1:60D5081F41BE0F2C7E91215E79D8DAA3A44DDE06
                            SHA-256:B2B357EDC4003663A495F1329D2D3B261D465871100B8D12560C9F7F7EBDEAA3
                            SHA-512:FADC4A5259B2AB7FD0801171C132B6E33EA0D624D37B5021EDC4605D414495F5EBC3B51708D033EF41D2116F1CD3270190FD212DECD281FD265B2E3DFB15AF76
                            Malicious:false
                            Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ..O.......O.).~...)U..."..O.).~...)U..."..O..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.....................:.ZQ..NC....N...^.................?3H..G.d$E.`.........f........................................I.qk..B.....LZ....................:.ZQ..NC................:.ZQ..NC...........O.......O.......O...........................................Oj......OT.]....O.......O..B....OH......O..B....O..>.)..O..J...................;........4...4...4.."................O...O...O..z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4...........O.......O....#..O............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000053.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):25622
                            Entropy (8bit):7.058784902089801
                            Encrypted:false
                            SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                            MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                            SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                            SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                            SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000054.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.324619518184479
                            Encrypted:false
                            SSDEEP:48:Yu+NsztS7ABBZZ6PnjMtB0m8EHGK2XTT89shj4Nrd3rUgxREyBdXaC+vReZBH0C5:YVsrnQjMaEmNXTA9shARbthkxu
                            MD5:71B7CF95248F08A3531BCE87FC5BB892
                            SHA1:BA038881AB94FCAB08EB855751B4203427B4FCA6
                            SHA-256:8A3F3733528F0AFA1C9ED2F0B4F03BB6FA16859819A3645E411BADD563A39DA0
                            SHA-512:C3872E445DC5EAFEA80D4204115FEF715A9318AEC17EF555FE26E591496B43B816ED6680BBE2DA5EE6930B9E08B81E72A1E9723421552090669199BD0D996F16
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.s.......s.2-7....4.1./H.s.2-7....4.1./H.s...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.......................LU.......N...^.....................@.F.U.Cu.........f........................................I.qk..B.....LZ......................LU.....................LU.............s.......s.......s...........................................s.j.....s.T.]...s.......s...B...s.H.....s...B...s...>.).s...J...................;........4...4...4.."...............s...s...s...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........s.......s.....#.s.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000055.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 50 x 500, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):2033
                            Entropy (8bit):6.8741208714657
                            Encrypted:false
                            SSDEEP:48:P37XYSDTz+UUl7DHt7Ah8l1+4ZfFclFUXwobKXlZr:v7j3z+UoDN0h8ugf2AwobMN
                            MD5:CA7D2BECCBC3741D73453DCF21D846E0
                            SHA1:E34B7788498E33FFF0CFB00125E6BA9E090F6CED
                            SHA-256:E9EAD0BFC09D32CB366010CDFEDE1C432A2D1D550CB7332BADAC1BEE9482BC86
                            SHA-512:7FE2C3654262B1EEBED4F6D83DA7D3450E1BE52500A3964185FC0092041506A237A2728E5D7EEA0A3814E413E822B803B789C49CF744D51816A2E4EDE5B4247B
                            Malicious:false
                            Preview:.PNG........IHDR...2.........H'......PLTE........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.\.W.G...=a.ewA..a.!r( ...%Dc..x.x....N.OO...3=...S...........~.z.D.0...g.2P.7.*M.#'....z.......3TPj.Z.[5....V..z'L3...a.j9..C>..9.z

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000056.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.353104818544262
                            Encrypted:false
                            SSDEEP:96:nVgBscw6X815E8/X/1Zv9EEoRbmhyf4dKbuRVsbOhG:nuscw6N8/X/9EEoRbEkhbuRVsbeG
                            MD5:F369E415FC44C16D565588E1AE99E6CF
                            SHA1:8FBD4F83D60ED5D71669D95F0B6A09F41D2D9D80
                            SHA-256:BA21BD822D595D3A345BCD21C66AF3E098105DD302BF3C8D5850B48B869ACC5B
                            SHA-512:A49A662D308E2A25DB967ABA6E439999D2ABFEAA3B8756A196F98C3C5C825A193D7C63D550608CEDCCE85EDE5EA254E9589B9AECB953BEED23AE992A2CE4DB44
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v...............................................-...I.......I.qk..B.....LZ............-.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................<.K.....A.....N...^................x....@..s.............f........................................I.qk..B.....LZ...............<.K.....A............<.K.....A.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000057.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):55804
                            Entropy (8bit):7.433623355028275
                            Encrypted:false
                            SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                            MD5:4126992F65FE53D3E3E78F6B27FD49DC
                            SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                            SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                            SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000058.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.4499305600001735
                            Encrypted:false
                            SSDEEP:96:8s+OClzch9H9EsXdHB9sYD4RMEFClrNlDWot:8sAc3asXlB9sYD4RMEd
                            MD5:1E8D8E6F3DF0E56108C2C29F1FEAF1FC
                            SHA1:7A96D9B5DF6CD2B0970A3F17854CD57E3D16768F
                            SHA-256:25B5F706DF67ED627EE5A360D95EBF8D06209E7C6F10B4EEB182C8CFC4977907
                            SHA-512:55663B854EEC82F1CEAD3FC27D3C4C0E47930B8EF8983337FAEF02F5600B835BBE9E81BA40E01B225B969D48F42EE91C9AF4C36D018CAA36C871F309BD229C2D
                            Malicious:false
                            Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZR.......R..w..y..j./..ZR..w..y..j./..ZR....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............,..HV1.<k..w..y....N...^...............T..:/.{E.-.....U........f........................................I.qk..B.....LZ.............,..HV1.<k..w..y.........,..HV1.<k..w..y.........R.......R.......R...........................................R..j....R..T.]..R.......R....B..R..H....R....B..R....>.)R....J...................;........4...4...4.."..............R...R...R....z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........R.......R......#R..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000059.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                            Category:dropped
                            Size (bytes):59832
                            Entropy (8bit):7.308211468398169
                            Encrypted:false
                            SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                            MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                            SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                            SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                            SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                            Malicious:false
                            Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005A.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.36775548994395
                            Encrypted:false
                            SSDEEP:48:WFqstxlA4PJxJ7zaGtUEQ2IXp9PUtpj4JrdMrSAdX82JzQbElZT+og:vslVhzJWEGXp98tpMRMbC2t8o
                            MD5:72714B8634DC13ACF38FA49364B7A006
                            SHA1:3FCA34E05AFF3D689DFE5B7EA41ED53C5E216DFB
                            SHA-256:F505641EA8807C051E5C19FA184D81A872EC097D56B2DEC383286E91BF678A20
                            SHA-512:3AE8B166068E15343A6D885855EE69BC5A7A09DFD0A2D834D08FF7FD1FB43E2425C4E981FD4E0A46CF6DA43E94061B648194929B111F337BE5369A5CFFBE0473
                            Malicious:false
                            Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ.........y.._....r.r....y.._....r.r......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................4.B.|:.....N...^................Ff.x.;C....=.j.........H........................................I.qk..B.....LZ.................4.B.|:..............4.B.|:.....................................................................j......T.^............B......C......>......|.... .3...................;........4...4...4.."........................z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4......................#..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005B.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                            Category:dropped
                            Size (bytes):33032
                            Entropy (8bit):2.941351060644542
                            Encrypted:false
                            SSDEEP:384:ofmqvnCfmqsp1Ue5xzMq+Qh0dffUmS0w5xzMq+Qh0di:AGAp1rmSl
                            MD5:ACF4A9F470281F475EA45E113E9FB009
                            SHA1:B20698DDA5E5AFDD86BB359A6578C9860D5DF71F
                            SHA-256:5DC2367A80588A7518DB5014122510BF0FD784711015EF83A8718336584F82D0
                            SHA-512:998B7DB9DB08FD15A293267E2371052E436E024AF8D34F96D3C8FF04B1316678DFC1674C921CB404121FF381A4FC39DC759E6698F19D42A6261CBD39469B0A08
                            Malicious:false
                            Preview:....l...........................Ac...... EMF........$...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC........................F...(.......GDIC............^...........F...........EMF+*@..$..........?...........?.........@..X...L........................."B...B...B...................?...........??.....n............;...<..@<...<...<...<...<...=...=.. =..0=..@=..P=..`=..p=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...>...>...>...>...>...>...>...>.. >..$>..(>..,>..0>..4>..8>..<>..@>..D>..H>..L>..P>..T>..X>..\>..`>..d>..h>..l>..p>..t>..x>..|>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...?...?...?...?...?...?

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005C.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 3005 x 184, 8-bit/color RGBA, non-interlaced
                            Category:dropped
                            Size (bytes):12180
                            Entropy (8bit):5.318266117301791
                            Encrypted:false
                            SSDEEP:96:k1bHyG/fKOOOOQJUg+g2S+kEm6alfsfsfn32:+bSG/yOOOOQ+g+gOab32
                            MD5:5C859FF69B3A271A9AAB08DFA21E8894
                            SHA1:3156302A7450ADFF4D1B6EC893E955D3764D4DD4
                            SHA-256:B4A8E9A67EE0B897615AC4CCE388FFC175AB92D9E192E6875C79A4E7C1B5BB6E
                            SHA-512:4CF518136EEBCA4F400A115D9B7BB0CAC9FA650BF910B99E15F04A259B7D3EFCFFD6796886FE09DB08C37C332B14BC8500845C09C8EAE1F2306F90E98D3C99E0
                            Malicious:false
                            Preview:.PNG........IHDR..............;j.....sRGB.........pHYs..........+..../9IDATx^...dW...S=.dL$.............-.`...'...x.7.D...(...$.?cO....9S]=.v...Z.......{..wNuf.&.....a.k5~...._..\.yk..v.....}{._.Q...5...._9o.n.....}7.].1v..t......q....3.<..0<.p.......0....s...... @....... @....... @....... @....... @...X.'..U-..... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%@....... @....... @....... @....... @....... @....../)m.. @....... @....... @....... @....... @....... @ ....`.)....... @....... @....... @....... @....... @....K.0.....J....... @....... @....... @....... @....... @...`.....\.... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005D.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.336226858589528
                            Encrypted:false
                            SSDEEP:48:AbsGQJgVrUbULltngD7EPEczowLl7Xvg98svp5BrdMrYjx4YWQXHb09YmB:Abs6VrUbULlCEsAowpXo98GRRMpGe
                            MD5:22D87E9F0F0C27AD7C9D801DCD0E04FD
                            SHA1:56B38EA56F86B66097DC0621E3B43D367C49226A
                            SHA-256:763DA843FBB1BAA9E5093DDF93827DBE7254FC31993CDE6FC06D123316D13C77
                            SHA-512:6EBED150DD9544F13A8007665F62C6AA652C606931733602786A5FE98D12A8A73E2B204C13F7C5C0A22D0DA0B2ABF43475063C78F65DF8DAB416B6DCA447ABF2
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z...........................s.......s...Nu...[.....Y.I.......I.qk..B.....LZs...Nu...[.....Ys....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............m*...w.2.s..z......N...^................j....A.6.............f........................................I.qk..B.....LZ.............m*...w.2.s..z...........m*...w.2.s..z...........s.......s.......s...........................................s..j....s..T.]..s.......s....B..s..H....s....B..s....>.)s....J...................;........4...4...4.."..............s...s...s....z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........s.......s......#s..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005E.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 39 x 600, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):2104
                            Entropy (8bit):7.252780160030615
                            Encrypted:false
                            SSDEEP:48:2PPEOtz2P/LJtVRaqBG8qFOPvHlcEXgkuwf+j:2PZFSjJDjqFOPPlXgG+j
                            MD5:F6C596F505504044DF1E36BA5DA3F09B
                            SHA1:BCF17EC408899B822492B47E307DE638CC792447
                            SHA-256:EDBB86F160050FBF1F9860276802BAE292DBFD0BC98E3EA90D43D981E9F0C54A
                            SHA-512:E8D067A1932CED8746FE7D665EEC34EA92A98AFF3DF26FFA9DD02742DDEA3C5654124A88A649FA33DB596F96A5FC9CB2C693D03132F1C8B254ACB56DB4763BD8
                            Malicious:false
                            Preview:.PNG........IHDR...'...X.......:....PLTE.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................{.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^..c.%i.F...m.m.f.m.m.m{&....X...9.....M.WUW.d.N.O...E$...$...)H....n....N.k..v.....v1L[w)w.}..!...Y.X.V.D.......[....;..[..;....

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005F.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.352575558177629
                            Encrypted:false
                            SSDEEP:96:XKsFxZxoxbEm0FJfE2oXrQdI99ksRMci30cxoxpxOxBx3x3I:6sTPSbF0F+pXcI99ksRMci30eSfsnB
                            MD5:AE8DDF3A41F2A1088E581F365A76AA39
                            SHA1:2FB9A0999A130C5A52A8EAC483A87CADBF7B219C
                            SHA-256:3209300FE29E5448DA317A0CBAA47AF961064542E4209EE0055DED8E954727DF
                            SHA-512:26A9BE4AD4C2BE7D82DE953DB6ABDDE0C5EE2494F3F2C16A522B78A72BC1279189422992BAABDE58DA560CE30571DCF708247C3D22D90D7874503E8BE9198476
                            Malicious:false
                            Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................D.......D.1.....{.!P.\..I.......I.qk..B.....LZ.D.1.....{.!P.\..D...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................MU=........t....N...^................Q....hF..k-............f........................................I.qk..B.....LZ................MU=........t............MU=........t..........D.......D.......D...........................................D.j.....D.T.]...D.......D...B...D.H.....D...B...D...>.).D...J...................;........4...4...4.."...............D...D...D...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........D.......D.....#.D.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005G.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):14177
                            Entropy (8bit):5.705782002886174
                            Encrypted:false
                            SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                            MD5:7CDCE7EEBF795998DA6CAC11D363291C
                            SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                            SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                            SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005H.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.307960130472198
                            Encrypted:false
                            SSDEEP:48:+VxsF3AaQc2Uq/teNEYXL7XxGX49hshpyxrdMrxR2FX1T8agRm69Z32B/lagRmx1:4xsgh/cEQ/sX49hYERM2XxDkZ
                            MD5:F3FC3893DF4ED722F98D774C26468680
                            SHA1:C375887FE54FA6F63A5BA2CF48F51C54DB6FC4D9
                            SHA-256:8B4622211E47627932D7298969141CBA066C1E6C2CEE98157A619ED50C855BED
                            SHA-512:74B1F280BEF4941662F8D758E4A905898954609E75EBCDE570CD366D165EDBBD12B3A9E895EAFF32FB269FB46B4D096F5949FD12B82C8B14907902A053D9874D
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ...........GL3 .$[.8...9...GL3 .$[.8...9.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............@....G..avM ......N...^.................4`.@@J...r..60........f........................................I.qk..B.....LZ.............@....G..avM ...........@....G..avM ..........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005I.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:44:07], progressive, precision 8, 611x163, components 3
                            Category:dropped
                            Size (bytes):36740
                            Entropy (8bit):7.48266872907324
                            Encrypted:false
                            SSDEEP:768:3nwDxjTvoE0Rjwit4rjucDILWg7/Da0JgGQ8e1S8SA/Khos0:SxjTmZw7nucDILj77a0JgGQvScb
                            MD5:9C205C8D770516C5AA70D31B2CA00AF3
                            SHA1:9A1002F0CF7F92F1BE2BB25BAD61CEBFAC282482
                            SHA-256:E111F96490755C7D71E87C88ACAEA38AFE55BB865B1A14A83C5BD239648D5E2C
                            SHA-512:A3E105208B32831265428572B0937DD3C17B793D8611B2DA8D4939F1BEC6050999D375E3F6B87D53AD49DFA0EAE737B0141D37597AA42116C310761973D4A134
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:44:07............................c.........................................................(.....................&...........n.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d................................................................................................................................................."...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..o...4.gP.~.c...K{...V.=...].<.........vS.........s....(.t......X......kk7....~-...yF}^c.Z.\.G./.?t...>....:.>......./.ib..).

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005J.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.429740491841111
                            Encrypted:false
                            SSDEEP:48:5sZLzpC6XMtCWDVfELLTJXcfDbq9NsJpy5rdMrrrv2QEFXZ5kV4OYg:5s1pC6c0WZfELBXcfDW9Nc0RMrD2QTY
                            MD5:B7E418AD0D2D6539102CC72055D582BC
                            SHA1:D687137DE714DAFDCE7C5A5B50A57676D2E236B7
                            SHA-256:38348C2BC0CDBA7675F45B7001844EB0840DE215CC1A3BAA4216CCEDE65C72A4
                            SHA-512:49637660257ADBADF35B544BA59CD6196A1FA8AE35A85B61A5D3F78C258D759C507C81E7E73A1A58F88BF8D09ED79111C67330870C1AF98A61147B9899601520
                            Malicious:false
                            Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ.8.......8......!....}j6.8......!....}j6.8...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................]..)...}r........N...^.................4..9.E...>D,_.........f........................................I.qk..B.....LZ...............]..)...}r...............]..)...}r..............8.......8.......8...........................................8.j.....8.T.]...8.......8...B...8.H.....8...B...8...>.).8...J...................;........4...4...4.."...............8...8...8...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........8.......8.....#.8.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005K.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):53259
                            Entropy (8bit):7.651662052139301
                            Encrypted:false
                            SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                            MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                            SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                            SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                            SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005L.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.348989849777921
                            Encrypted:false
                            SSDEEP:96:ArsxxPsx6lEXZXF9xa2q7RMRPocOcboPB9:asLsRXZXF9xNq7RMRS
                            MD5:813260E9DA339C29CDA6D4EDDF8FA6F3
                            SHA1:4348C7CF64BD14829B804A7F4105015E6FE05FF7
                            SHA-256:BF2E710116214CE492532122DA21F7A7DCB4C7A37D7E0B92B6F38ED19378EDA4
                            SHA-512:2DA0EC2924007096BF2572D1A5559D8F4FF101F64223C04F0A713FBA8999DA0435B0019BB02058CEB17827DA8F6A7E1D7A8969953B4B8B31DEEFDAF1D5937F0A
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ................>.A...v.........>.A...v......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............4..NK...$~..~.....N...^..................x..J..]u...k........f........................................I.qk..B.....LZ............4..NK...$~..~.........4..NK...$~..~.........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005M.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):60924
                            Entropy (8bit):7.758472758205366
                            Encrypted:false
                            SSDEEP:1536:kU7O7+CFqO6DkxTgPzo2wqggrrX8QvN1I/ZLBttB9+dPFXbc:hVuqJDaTqo2wq1L84N1I/Z1tT9X
                            MD5:D58C51D2CF586A5E14A9EC8529C3B0A8
                            SHA1:F4811A353797C29B1E3F5A61B125C46E1534D587
                            SHA-256:F927C7825851974A2149868146970706523A49165133CEE6027A43E8C9ABDF27
                            SHA-512:34B963173AFBDF07432F4B983D29F10376E4771FE666E9D50B1A81DA0B9F6001FD86B4A08B9711386DE153BF6E03C8E932E2D181C8EAF94EFF34D20FCA7570E0
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d................................................................................................!1AQ.aq....".....2B...Rbr#.s.4...3$.5u.6v..CSc...DT..f..t..&F........................!1..A.Qaq....."2....B.s....Rbr..#4...35...CSc.$...DTdt..%..............?....O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.........................................................yK..xd...6..|%....\j..e.=...Y..f..I.|-....e...$R.j.......~.W#....{.....V.k.|F..z^..:.~..f......"x.....L..K..r../.;..[..l...;.U...W...X.........8.....y?..B...m.......j..Q.g3..G.K....GL.o..n7a..Y..[.'.........x........\......~...f...0\Wc.n?k.|.....1.ww;..2..?...r4uF.MXdB6..W..mG2NJ.E........u...2.q...Z..=(l)jU.X...U.\X.......O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.......................................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005N.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.329991732047708
                            Encrypted:false
                            SSDEEP:48:g5+es6jRvWBsDtCuEJtJUXcX/Z9UqswpyFrdMrvvjxFXio9msZp1:g5DsQUsDzESXcX/Z9Uq1YRMluy
                            MD5:F32CF870CEED6CA7D0B12124158085C8
                            SHA1:57D476E66EEADAC3A6DD047C1E492DB5C56AAD78
                            SHA-256:789B96A49BC56DDC1B3C5367584D3C051E5CA2A7A3C8AD2ECDCBB32375D816FE
                            SHA-512:E7370A0F64BCA1DB109CA97A2D1B011FC0EDB3D582A840C1D574DA71047AE8531E6A0A200675A041AD67BB7CF25429929E47C2924D973B3E0DC622F8E6F93332
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ................+.U.}..8........+.U.}..8.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............T..'d.<l....u....N...^..................w..?M..+..J.........f........................................I.qk..B.....LZ..............T..'d.<l....u..........T..'d.<l....u........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005O.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 39 x 579, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):515
                            Entropy (8bit):6.740133870626016
                            Encrypted:false
                            SSDEEP:12:6v/7su2/c30mqkg9VgFHe7Ll8UmJX/N+1Zmkk8f3lbtI4:4mc38gFHe18lkk8f3lbth
                            MD5:E96BE30D892A5412CF262FEE652921CA
                            SHA1:8190A0BFE21D04BC6F3A406E91B87CA69C03A2DE
                            SHA-256:0E31DA4DFCFF4A36C64C1CE940362D2309769F36369E4C43C317D5F2FA15658E
                            SHA-512:D647F51ABBD013226A6ADD0D551D058C633F867F9AF5A9E099B85D6E291D220F7B85958B07381CD4C7C4F72356DBAFE2A86932AE398E28C56CDDF0744E92EE24
                            Malicious:false
                            Preview:.PNG........IHDR...'...C........b...`PLTE..................................................................................................bKGD....H....cmPPJCmp0712....H.s....9IDATx^..I..@.C..<..?mo.#C((.J}...~..B...b.I.i.\<.e.....(p.I.EO...q.x.......dRz....K..b0.:.<c.o..0.x\:...F....I&..ap....."P@....DO...q)p*..@Y.CL2)=......1.........4....._.G..^`..lDO...q...X....SL..z....K..#.L#..I6..ap.Ls.,....7&..ap.p..lI...,GO...q.....k.n1..4......3=.f.x.$..4.....o....x.$+..0.x\.,&6...............IEND.B`.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005P.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.363079025676992
                            Encrypted:false
                            SSDEEP:48:usM+Bz5FspV4MtbqEPA8pMlLX6sL9xsMpy1rdMrZVfBFX29KJuFqzl05kuIL/Ko5:us4pV4MUEPV0X6g9x5wRMPBVHI
                            MD5:F0521AD28C0C129020BAAE18080EB9A2
                            SHA1:4E3BD3F020762DB6C641679A16435D5C9EBCD135
                            SHA-256:C41AD1A355B04305C7559A728FA61133450F4D4064B411F44D7897521FCB75A0
                            SHA-512:F088A54687FF3504D3AE52C44CA29FC2BC0007FA0748CE6387C5AAB3BF412184B180EDB0FA7B4289B37A552B8D1E5A7C28D6506FD5533EB90EC3D7F686DBA7E9
                            Malicious:false
                            Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZh.L.....h.L....4CX...%oh.L....4CX...%oh.L..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'............."H..2=B.#.[.#.?....N...^....................+tM.G$.*...........f........................................I.qk..B.....LZ............"H..2=B.#.[.#.?........"H..2=B.#.[.#.?.........h.L.....h.L.....h.L.........................................h.Lj....h.LT.]..h.L.....h.L..B..h.LH....h.L..B..h.L..>.)h.L..J...................;........4...4...4.."..............h.L.h.L.h.L..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........h.L.....h.L....#h.L............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005Q.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 30 x 700, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):1547
                            Entropy (8bit):6.4194805172468286
                            Encrypted:false
                            SSDEEP:24:dZeDNYbS+238CTUFPA6SXG5qSacX9q73eXu0vC3dU+OB2gbwHRuZ:dykp9FzBBacXQ3uNC3n7xuZ
                            MD5:0BA36A74DFBF411FAB348404CCEC3348
                            SHA1:4C619790E517416E178161028987DF1CD3B871CC
                            SHA-256:2E7AAF26BEC32148B96442E8FFF1BD2CEF2D72630969F23B9A2ABEDB6CFEC93B
                            SHA-512:90AF53DB7C413E2ADB970AC345F73E4ED8AF626E179C929E6560118F7A9E98DC7C5FF02B2B3F6C98D397E0FE2D85F3427C6928C328872149E176FA8A99E91F54
                            Malicious:false
                            Preview:.PNG........IHDR...............\....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................D......bKGD....H....cmPPJCmp0712....H.s.....IDATx^.WSTA........b.0gPPP0..E.9b@L(.c.N.U>..@......;...}..B.(....$......5..XS...I....).!....D^.uE...\..5........F."o..-...m.n. .^.....q= .

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005R.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.350518914000616
                            Encrypted:false
                            SSDEEP:48:UzsMf34iR3tdeATJE05gjRcX2lQepc9pUTpyVrdMrzbeFFXdTfpf7/92hTM9pfxV:6ssR3uUJEDcXCNpc96TYRMGF92i5
                            MD5:1E7AD91954F3EBB04F465B65CCDB5359
                            SHA1:BD309C87E5250E8E9EC338D4A987E59E6559D23D
                            SHA-256:2E2009403BEC7ABA1959353171B32A43E88B128D04527F7B11EF6E190DBBC96F
                            SHA-512:8F9CF9FB9835E835C04B75CC78A655E4A0FAA94C376C4D42F7D122FCFCB7F28D2972A1346E8766D4704EEA6ED03353AC139041ACFE14A284476ABA20A767FCDD
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.1.......1...5..... m.p..1...5..... m.p..1...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............[.s.,..:l..o......N...^...................WjE...%.u..........f........................................I.qk..B.....LZ..............[.s.,..:l..o............[.s.,..:l..o............1.......1.......1...........................................1.j.....1.T.]...1.......1...B...1.H.....1...B...1...>.).1...J...................;........4...4...4.."...............1...1...1...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........1.......1.....#.1.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005S.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):95763
                            Entropy (8bit):7.931689087616878
                            Encrypted:false
                            SSDEEP:1536:EoES7mhTyzabUaE77xAOmq0zVruQlttNxlipxVWssMU2YhRy2v6pKKYhQzwMc2:zz7mhTyzabUa4b4xuQlttnlGx8x9h02M
                            MD5:177DD42CA99CAA2CCBF2974221680334
                            SHA1:35FD86B3DD082A6D4930C67BC0E05D3B5817465A
                            SHA-256:525A857D0EDA855A64D3619DF58B1C2D013A73E60FA0D49B155ECFCB2C134C7C
                            SHA-512:6FB6D9A6C97B1115C3246690A2F339CD612899AC25ACBA00296EAEAA0A1D094E7339D670969764FE23EB7C08FCDD01C6F78FBC0735D504D5E02AD342901719B3
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!..1AQa...q......."...2..B#Rb3..r$...6..C4....Ss%5...tu.c..Dd.EU7....................!.1.AQ..aq......"r..2...4Rb#3$B.Ss............?..H..dV....U..-..0]Cp.%O.Z.Y.e.=/.q.....j76.w@s...5.&&&5...n..w..>.1....;.vR..[.......=.......KtY]u3.g18...).r....&.IZ'.....g..4kY..X..b.......y<...r1........e.._...X...w....op.m%Jr31...S.Vo.._....OI\]....F..V-....\...2j..X.....y.p.$4.....&#..]..n.V..x..P...F..C.f....])..~..Z\.....,..#..v..v...2V.k.SuaydO../[.*c._..oTV<Z.s.[...o.x..>....-....v...#....-.X..L.Z./#.XG.-.0......%w..H.@aZ....C.}...N~.;..R......5.D......I.... .R........s.>..ks....(...S...9....2=. :^.. p.+?(....$..Q..I.........=|..`2. v..t......U*.8.u.. ...'...*...2;u....& 3..$.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005T.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.260623058690876
                            Encrypted:false
                            SSDEEP:96:usoonDWxilYEy0vXH9qYYRMCBDX5SSDaJA:usZnDWxijycXH9fYRMCBDX5SSDgA
                            MD5:222767A75C372BCC92689F11E916E5F9
                            SHA1:5BAA1ED0DD77512CA76E97E34A40AD9758993718
                            SHA-256:CED0FEECA7315FF8D43FA5D7992FFCB3876F684592F8C052F13CC8E5DC15CB2D
                            SHA-512:81FF82602F8C72E963875ABB36F9F903ACA64F5D0A938B4A1B95A9B0948A832F0DF5FB19B1420AE1BAFB57067CC7672EA7AD16D0B971E3C1FAC1CD7CA845EEFC
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.....................'.q.............'.q.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............z......$P.s.g......N...^...............n.dq4m0M....'%.\........f........................................I.qk..B.....LZ.............z......$P.s.g...........z......$P.s.g..........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005U.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):67991
                            Entropy (8bit):7.870481231782746
                            Encrypted:false
                            SSDEEP:1536:3PC0XJjsmsKuZRG1pXuZ6z3wARnV9AEnieCc7cllJcHJ:qyMBzkUZ0gq25c7Z
                            MD5:1271B1905D18A40D79A5B9DB27EE97EA
                            SHA1:9618608FBD7342DE6C71220A36C3F4995BA9C13E
                            SHA-256:5B321A4D81BD499B289B1755F6450A42047C494DFBC112DBD56DA4CED2C15C1A
                            SHA-512:C32DD26047F6B8AA061085B38AC2B8335868E1BFD8731DB65544309223A955FA4BF45B06AC8D244408658F51A1775B6F19FF0FFC804989DE706DE8EB36F1436F
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1..AQa..q..".........2...BR#b.r.3...$.'...)..C%7gw..(.S.W89.......................!1.A.Qa.q".....2...#....B.t......rc.$%67Rb3s&'CUu.v....S.d5.V4T.e.............?...?..Wj.e.e.......w/..E..eOw_.....6......u..C6h.,..;.g.D8Z..-)O..jy..e;.u.g..w..[.L""k'w.......'1'.[......=..P...S.9a.V./O....q=8xk]...........9......F...e9'....9.O.... .&.....p......c.4...mr...?.......L..'.....0....+..|_...POM=7.?.2.a....};.Z..y./....>./.C.<...;.....|.1>...........S.8.o.O...+..n2...k../.X..9...Y...:.....\...Dk......q.K..\.Wuh.!Z?.mu...R.5.A.S.h.0..[..v..+M.....aUi*.k..?#..._...X..R.&]..[..;../]L..f..V......*.e...ut&.#.J.5....c%..o.$..v.<K.6..T.IP.....6X.*.uf..t0^..-.)m$.!.q(.j.f;..WB6.b.B..R.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000005V.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.2786919004354385
                            Encrypted:false
                            SSDEEP:48:gsDRL1xk4qQtCBEvlLhjXP5S9QEULpyi8rdMr7k/hehFXBI9948d:gs1JK4qQAEd1XPs9QTLr8RM7EaUd
                            MD5:9E5FF92D852D14050D66A87F48FB87CF
                            SHA1:DD1E0EEE3F7797E7736F7C9270F1C1160E1E6A23
                            SHA-256:0334C46428B723B87DD728E7A7B965AA198FBF88A75ED50002DF9FCE3CE2B8C9
                            SHA-512:58A031540BB12D6183B841CFBC1769594C994E351F705582C3618C78043C887A143F7267BED328C554974EF72B75CC4CBBADDDF0AA5B7E11DF99A14A016DABAC
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.............A*..)..X.......A*..)..X.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............P..\.4....##[w......N...^.................x\Uv]O..oW.].S........f........................................I.qk..B.....LZ............P..\.4....##[w..........P..\.4....##[w..........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000060.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                            Category:dropped
                            Size (bytes):22203
                            Entropy (8bit):6.977175130747846
                            Encrypted:false
                            SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                            MD5:2D3128554F6286809B2C8E99DE5FD3F6
                            SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                            SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                            SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                            Malicious:false
                            Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000061.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.422280048532179
                            Encrypted:false
                            SSDEEP:48:9saDzJKZSi0cEsMtGkYUXE15LvRXDbD9hUBpy5rdMruUCwFXfJkkK/CvVu4g:9secEsMUkfEDNXDP9iB8RM704
                            MD5:2E2E827755892A67B5AF22A74C88E517
                            SHA1:E9C6D31F101D7E96095C8CAF13CAE0D2F3A6F855
                            SHA-256:211C8D597215B73810544753318DF19281B04DFCB3DF3C7ABBF2162271A96BE8
                            SHA-512:3BB1A2E8E1EB75170F79722524A6F90FE76E89850472F34424D99C2DF3A02E2AD387158255A6651F9BE3A18B228C340189A19AB1F3E3457198887AC9C730C3B9
                            Malicious:false
                            Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ}q......}q..g......!...H}q..g......!...H}q...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.......................X.]!....N...^....................6dH.{.#............f........................................I.qk..B.....LZ......................X.]!..................X.]!.........}q......}q......}q..........................................}q.j....}q.T.]..}q......}q...B..}q.H....}q...B..}q...>.)}q...J...................;........4...4...4.."..............}q..}q..}q...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........}q......}q.....#}q.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000062.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):15740
                            Entropy (8bit):6.0674556182683945
                            Encrypted:false
                            SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                            MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                            SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                            SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                            SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000063.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.344071036848104
                            Encrypted:false
                            SSDEEP:48:5rMspnQeaJtqoEEAkL6EjbXgQF9lUwpylrdMrEkXmNFXUB35ys1:5rMsqeaJ4ZEjXbXgQF92wARMEkGiys
                            MD5:A4634B1A3A313CC6D2FB78E7A971F442
                            SHA1:09E437890A811CE5465A1A5B52109677BE52416C
                            SHA-256:CEAE2EE64C3716DC26F51DDFE39B8F9E733397ADFA47BA0D242A8C7B61004D42
                            SHA-512:48E79FC15A4F6B8D84C8E168FDBEF5EF089ADD759C7DEB00C77F6CC151235B1EC35AA7DA5832E9711A81668BCE29B07137B071F0275447735E7E87B02C0D6879
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ............P...4..k.C......P...4..k.C.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............'gP[d....)...t....N...^..................|..}G.....P..........f........................................I.qk..B.....LZ..............'gP[d....)...t..........'gP[d....)...t........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000064.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):86187
                            Entropy (8bit):7.951356272886186
                            Encrypted:false
                            SSDEEP:1536:AbmHwD7za0syWMetp3TdPFzoJamVdAQZCiUit9qbYN6LerhWMzIWgN1EeaYhJM:1QnzsyTeP3TPAdAQZCi5qbYEKrhWWMNO
                            MD5:FEE4785DF76E93A9DC2F4501CBAEAE12
                            SHA1:8FB4527BDE05EF208FCDB168098A07707C27501F
                            SHA-256:F091DED5E283AF6848670A3172E7C43C6099875D39B3FC69C2BDBA914F609602
                            SHA-512:7E99D33151A0D3873D6A819C98EA8E62D928C087B7BA2080F11C7BCF746AD60A44D4FF6EE3D2D2E8DFA4BF1FC6285ED56BB83F91C2FC6FC4FDFF2000105F10B1
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................1.!Aq...Qa."...2..BR#...br......6v.7..3.CSc...$4.s..&dt%u.f.......................!1.AQ..aq........"2.B#....Rb3..t.5u.67.8.r..$....C4.cs.Sd%.DEUe&.............?............w.....c.....i.A.....3...7.......7..P......%.........?Th..l./?.;.....$}..=5Oa...F.c.A/...D.D..]..y..3e.5\%.fo2.X.*]q.5Ee.}..i..md.T....#...-...Mu...9...-+..~w5O.);..G..'.;..).....A_...M.vV..y.q......,<.3.(...._K:..XM.......w.......9..T.......?b..a-%.c;.}..>....|.,lZKCEB.t...fw|.Sw^..Y..:.J.................t._P..v..j.1.R8.R....G..W*H<(Xi........i..xcu...WM.dqM>'W..g....M.q.....+.....b'..~....>..T.~Jc....fj.X.x..9...N.w.6:..>.......&.(h..u...t._...)_k#7Za...cZ....P...Y..;.V.,..xo.....f........Y...\6...M'L._

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000065.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.656380429528036
                            Encrypted:false
                            SSDEEP:48:eGy5R5JsMBDpDjB8BJHTM0yKtypEdzbULmBhr5X0R95UQpyl7rdMrWRGF0FXgJ8/:wfJs1M0yKwEtUgJ5XM9KQ4RMXF0SdKJ
                            MD5:E90584951D1A4C7C25542C6C1D979927
                            SHA1:595F1206460916420114FBF025C455798574B753
                            SHA-256:4731835334EAED8D0C5D25570DB0851B62ECAADD95EDB99673FA472EFB45156F
                            SHA-512:897ED3B817374D8CB8F59E321AA93390C59CD3181B3AA52D6C3AC58A9CE929CFD864AD4383A703E2C1822F9A153D09FA2DEE6E2C1867619E7DF3CB79CC8ABEB2
                            Malicious:false
                            Preview:2...>...........v.......................................................................................................................................2...>...t.......v................................I.......I.qk..B.....LZ].......]...a%..'}\..G..]...a%..'}\..G..]....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............oO\.s.*.H.9..F....N...^.................R.}.M...d.q..........f...................................H....I.qk..B.....LZ..............oO\.s.*.H.9..F..........oO\.s.*.H.9..F.........].......].......]...........................................]..j....]..T.]..].......]....B..]..H....]....B..]....>.)]....J...................;........4...4...4.."..............]...]...]....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........].......]......#]..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000066.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 85 x 470, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):11197
                            Entropy (8bit):7.975073010774664
                            Encrypted:false
                            SSDEEP:192:p9wNdtRKcVHso6zsqm06xaqZdingVzLZ7/PGSIz/yycRTbChh/JzhbEx15RGb:mdtMcVHqgAqTinMzLZ7/uSIz/yTR/mhF
                            MD5:DDC3CC30794277500EFE4BC6667EC123
                            SHA1:EFC9642C1F95B5FC38764476AE481649C016FA0C
                            SHA-256:7F5B660A1A0BF46C75AAF19B4F77A0E086DE003EC03AFC1F58D871D55AA5BA9E
                            SHA-512:25232A84604C3959634D33090238FEC8D51E40AD84EB3A08BB8522A81BE1E83378649C014E98E1DFCDF46B7BFAC92D8D2429211CD11D7EE0334C9C3DF7C1B6A6
                            Malicious:false
                            Preview:.PNG........IHDR...U.........1x5.....PLTE....................................e........................................................s...............x..........................o..............................................................................................................................................................~.............................m...............................................j...............................................p.......z......................................................x..............|........................................v.......................y..........................................................h...........................................................................P..{....bKGD....H....cmPPJCmp0712....H.s...(SIDATx^.}i@S..N....h...!..)....AI%..p.L."a..)..`U..,h..:O.b.:.j+.Z).b..zN.s..{O...&|..N}...${....~.....k}.[k}{.o^.D_..W:35ly..7rL....6n0.A...b

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000067.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.352757653942755
                            Encrypted:false
                            SSDEEP:48:p0stWSMjnGhtPBPoElL0VWXaLW9UyUIpycSrdMrfchjd7FXI4am1bi5:p0sEbGh1CEl9X39UFIIRMfcRd7dlbi
                            MD5:AF190914DA3565539A0A6FE2306E2B2A
                            SHA1:1C91B7741E3648A367D605A3C695EA94B97B55FE
                            SHA-256:5E1888003053F3168737670F75A17528533C5967006BE99708DD4E37FA7795C9
                            SHA-512:3490CC73DE3E462BC4DFCE1C07B8DD2CB5F71402EDA617293654BA1BFF63C8BD2A841CE3DCA8D1035A1F1392313F1E33E04DB645A64CA4614AC191AAA84622E4
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZo.......o..4g{..&..~.Q.o..4g{..&..~.Q.o....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................:.&G...`{.....N...^....................A.it....w........f........................................I.qk..B.....LZ.................:.&G...`{..............:.&G...`{..........o.......o.......o...........................................o..j....o..T.]..o.......o....B..o..H....o....B..o....>.)o....J...................;........4...4...4.."..............o...o...o....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........o.......o......#o..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000068.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 88 x 574, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):19920
                            Entropy (8bit):7.987696084459766
                            Encrypted:false
                            SSDEEP:384:DRSgtAxJx7bzvAsVSqQElOT4uHmpmvNYT9aPU+QtsC2LgfIqJZnbeyRB:DsgaN7bzvAsVdK4uGQFUZ6bU/p3
                            MD5:1BDAD9B3B6DE549162F9567697389E1C
                            SHA1:5D9C09159F07A3A9BDCC6C4B9BD9CB72D0184E6F
                            SHA-256:0908A4CFA23F93011176D47F45843E9CA2973030421996E8E27484781F54B0EC
                            SHA-512:475040779AC247BB5C3E11862FB55FBDDFA12D759EE86A33E11BC1F3B656D6CD0F9B25146C0113E43E1D8001D8867D3BC3BF7E6FE21F3A0016CB1F8B70B7A15A
                            Malicious:false
                            Preview:.PNG........IHDR...X...>......y=h....PLTE..................................t........iw..............................................._n|...Tds...ky......................................................p~.....................................................dr.................v.............................................n{.......ap}..........x.....z...................u......................|..Vfu............r.....w........................................~...................Zjx...................................Yiw............w..|....................Xgv{.....y...........................jx..............\lz.........}..z.....t..[ky........u..y.....gu................................{..........}.....u....................~...........y....r.....bKGD....H....cmPPJCmp0712....H.s...JfIDATx^...\.W./.}....Sy...(..4....D.-.....H...% .$"D.Qr.......`..;...6...N......s...^...L.....Y{.GQU`..~...j....{...-Ax.K..&.....F..I\i..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\00000069.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):8192
                            Entropy (8bit):2.9037911743744673
                            Encrypted:false
                            SSDEEP:96:Js67jinE1dN0fEXrA9JGMRMHoSnKl3Jn3KoOp:JsKjV1dN08X89JGMRMIS
                            MD5:7FE7E023F5304B23C2A71A72B9F56B9A
                            SHA1:CB4461E0B38AC5B6D345361F6AFB99DFA4E1B5F2
                            SHA-256:7C7FB4D10E28F4581DC4F54EF10108931ED0A520D406E3D539BCA9179F0CD6FF
                            SHA-512:22741BE32BA2402B2DBF7D01AF04C96C17BA1313423DA162A5A36F1E2551C5AF9D1E44ED901D50CF7E517A8B353D4E70F77544EA1F253BF7D73A529D3EE54526
                            Malicious:false
                            Preview:2...>...........v.......................................................................................................................................2...>.......H...v................................I.......I.qk..B.....LZ.............Q.#..0...&.....Q.#..0...&.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................e1y+...@b(......N...^...................[Z2H..%.............f........................................I.qk..B.....LZ...............e1y+...@b(.............e1y+...@b(..........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006A.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):179460
                            Entropy (8bit):7.979020171518325
                            Encrypted:false
                            SSDEEP:3072:oiKXvL7lv0am/R1vrdH+9dK6zPQ6bbnGDpcGGDNMIOIMAT8q9Vc02Q57S4A+vMFz:+vlvC/HvgA6fGqGGJlO1qZ71W6CzDn
                            MD5:4E131DBFEC5C2462273CA7B35675B9D9
                            SHA1:CA037F444D819A118AC37D7AA3782B9BF94C1616
                            SHA-256:2A4A3530D652E227DDD5ADC096A95F6034718F7C380B07DB622022D768815059
                            SHA-512:C333ECEB1439D0238BF44FB7896E62DBA4C645B70413AA0F99C1F10E8DCD20C2EEE5C83F2E9DDE9A2494C85A6D8D13CFFFC4160E2F598E17867015F5244D656A
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1AQ.aq...".....2Rr..Bb..#34.....CSs.$5c.t....%.Dd.6.T..u.U....E.7w........................!.1A.Qaq......2."r.3....BRb.#4......CsSc...$.5..%.DT.t67d..Uu...'............?..c.......p..z..i.....z......kj........F>f......3N...M....RM.&..-.~.Q..'.....q.a..w...-~......g.{..&.......V.n.D....>FS!n.....@..)...W..q..Wr{..J.gf.{.M$.P@m.,..9..&m.D...w.._...-.O........s.....h.k~......(.K...V..l.-...+.9.k......*......#.p#.O..9M..mF...C.......7+.AI....4vw.;..H......e..Q.u[.eUK.....z.....[.Kt...s..Lf.4..l{.....sh.............=..;..iqkj.m.a...NH......v..H..$..q.y......c...U[Mcf.......+...S-...^....4..T..YtL.x.v.;.....<...Ik|B.$.s8......3.+.8.l.. h.:....%B..W..I.QRS..,*x.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006B.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.311477552289423
                            Encrypted:false
                            SSDEEP:48:usYuJFQ6MSc8fKtv9e7SW5E4wF8XY7j89psQpyVrdMr74Jd7Kt1FXyVG+DYgg:ustQ6I8fKA5Ed8Xi89pFoRMc6t1dg
                            MD5:6B5BC1E644BD1DF3E71B98E1F4672FE6
                            SHA1:7FB83E482D79953257F86F0CC71440FF44F253C5
                            SHA-256:EC368F34E481E8A8AA7B20739C32545B9CAA38809AFF2F35C89ECF3F17732638
                            SHA-512:101CD3B2432F8EE3A61C66FBF96E3E3C297891E9EE38F411396E091A36FD6B52E6500201341AAD985A685FEB6A9AFBFD2AF8BE249F7F68B99FEFACAFE64E6072
                            Malicious:false
                            Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ..u.......u.By...o.y..f;..u.By...o.y..f;..u..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............h.^F.....Z.........N...^....................$F..<W..........f........................................I.qk..B.....LZ.............h.^F.....Z..............h.^F.....Z................u.......u.......u...........................................uj......uT.]....u.......u..B....uH......u..B....u..>.)..u..J...................;........4...4...4.."................u...u...u..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........u.......u....#..u............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006C.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):109698
                            Entropy (8bit):7.954100577911302
                            Encrypted:false
                            SSDEEP:3072:rDlmvIWr0aRtNCfShCWBxyCHMlcVG0Ezy4FR:rDliIfot8ahCWBcCHDVwR
                            MD5:8D804A60E86627383BED6280ED62F1CF
                            SHA1:E23FF14B10AD0762DD67FBA3CD6EFC85647C0384
                            SHA-256:494547E566FB7A63DD429EB0699FE41AA8998F8EA2F758D813FE3D56C3075719
                            SHA-512:0FB19F3D00159F2748C3A54E952E551B9FEA6910D67A54DECA8D099992E50383EADB92768FF1F75CFFAE82A7A157B1E0F77A2F0BE7EC64FD2324304FDCA46577
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...............................................................................................!"#.123..AQB$..aq.RCS...b..c4%..rs..D&....5E6'..TdUte...u.....FV...7.......................!"..1A2B..QaqR.#.br3.........C%...$5.....c4U..Eeu&SsD.6T..................?.....O.C.....^..R<A.g...[....3.....r.0.....nX.S....}...[.?Z.....A.?..~~I..rY|N.o...9......!...o7r../-.y...'5.3.U.s".-.0.1......SS...&.Q.j.*.$m.e..:x....`}...EP.?.7..~G(so.......O.....z.N..<....~^a.e...........p9.?<._..|......~.<@.D.9..G..?.?z.y?z.C.U.w..[.,..A.+........s......g...G.^....pz.xY.....d8.y.X...P..O(A.O..~:._.......<...o..4s..^.^b..x......_a.....|{c...:..X.....}.._...[?..NK.c...}.<......H.G....+x.Z..|....n...o....`.nk.#.%x......-|...|7......N!=././..w.8x.".8....'x........w...,>....j[w8a..}..lS..?.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006D.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.302372697273945
                            Encrypted:false
                            SSDEEP:48:ysPw+6sgtgYh2E3yTYIXK7H5I9JsApy1rdMrV+4FXSNaFBYF:ysj6sg2YAEFIXKz5I9JdgRMo4JBY
                            MD5:BAFBCCD2B4717E0BF0D8C235FDDB0BFC
                            SHA1:EBCC2FF0768CBF391E2B017918212BA6E1EED827
                            SHA-256:0DF0971CE87CE3A48258EB1DC0D7B2D806A967D1BBC6194AC56A6215FDAC3C87
                            SHA-512:49A833ED51B22F24E56774B718BEB179DC36BB860ACFC49C6C42B05C7579E1D78B6484D9F74E08984BA71F5FFB2AD84696DCB421CCC2F897184A7005270269D2
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..&.......&.6F5....e...I..&.6F5....e...I..&..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............T./$.;...H..*.......N...^...............y....cPL......-G........f........................................I.qk..B.....LZ............T./$.;...H..*...........T./$.;...H..*..............&.......&.......&...........................................&j......&T.]....&.......&..B....&H......&..B....&..>.)..&..J...................;........4...4...4.."................&...&...&..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........&.......&....#..&............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006E.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):41893
                            Entropy (8bit):7.52654558351485
                            Encrypted:false
                            SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                            MD5:F25427EFECFEE786D5A9F630726DD140
                            SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                            SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                            SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006F.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):2.482825840986115
                            Encrypted:false
                            SSDEEP:24:dHkTF24meG2ae2oFAvedCDJyUlADq9lU8UllSIp7eaGUlgRxgUliY6I7UlitwJ:5kp24xfvdCtlADq9lUNllFlMl4litwJ
                            MD5:1D09621A64BE7DC6E9A0130E7895BD48
                            SHA1:5463D8510C05439C3D329E6485494D9B0CCDECE3
                            SHA-256:716AE05EA14390E8EB1D567FA1A9A6B13E39DC2A5EFE5408676C3B93213ECBFC
                            SHA-512:528DC3B2C5706A7BE235A75C68A01CF531037D298146B74C2A8432F635AC30D9726A23435DAC6D50BDD68A3BAAE7F625C4C6932027B28C5B784655B14C01DB92
                            Malicious:false
                            Preview:.........................................................................................................................................................................................................{.......{..n..4....I..S=0.....S=0.....0....@&...cB4.`.....m.H...c..c....@.&..}m....c..S=0.....0....@&.S=0...........|.......|..................................................w.e..8..w.e..Q..w.e..[..w.e..b..w.e..o...|...k...|.`......................4..~...1...(...(.......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.T.e.m.p.l.a.t.e.s.\.1.0.3.3.\.O.N.E.N.O.T.E.\.1.6.\.S.t.a.t.i.o.n.e.r.y.......S.t.a.t.i.o.n.e.r.y.........1.......S.t.a.t.i.o.n.e.r.y............w.e..1... ..$....S.t.a.t.i.o.n.e.r.y.........c.......cB4.`.....m.H.w.e.....w.eR..K.U.sS..X2...............................S=0.w.e..c...............................S=0..c..,.......................S=0..c..,0............A...XB.)..P.................w.e.w.e..1... ..$....S.t.a.t.i.o.n.e.r.y...

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006G.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):3.288790330336319
                            Encrypted:false
                            SSDEEP:24:S5S2Maow7qlmq2X8/GwUFOKtrZCrBJmQEtaDsNKUJ2+pXEZVbsPJmQEtaDssDEZS:S5SSn7qlODu8jxZEDbPUErl7jT/dMDB
                            MD5:79DBA647ED4050FC86C523CFB42B247B
                            SHA1:38BACD20E6D11B5EC469DB7F3F0B339E7B77AEEE
                            SHA-256:A83C5D1CA6D8A3321FB8DBC48FE82847EB2159A4825D50B0AF67E4281FBE1972
                            SHA-512:65ABFD51082B0AE71B666A21CF4E692F0FF7F5A99499C30A028B2FEC8AB0FBF41695B948BC06503A49AB678547A05C25E5EC6DA97DC1E571936725D9127D5B63
                            Malicious:false
                            Preview:........$...........t......................................?....................................................................................................\.........................................?.......?..GAM.....zj.n.x.....n.xX1...+ '|%..n.xX1...+ '|%..n.x....<Y.......x..-...._..z1.'A.4....>_..........................................................................?T&h.......{.....X.........4...............$.._..T.9...J.T(T................4..(.....x.(.......}.......}..9S.-.4...!............<Y.......x..-2...v.......4...................n.x................................._.......n.x..c..,0...e...B4.$........[.-...I.......9........................}..9S.-.4...!..}.....q....~.(^_,..._..z1.'A.4....>_.......>.......@..........<Y.......x..-_..z1.'A.4....>...........................q....~.(^_,_......._..z1.'A.4............?.........c..,0...e...B4.$..............E........................................0...........e....4..................T.o. .D.o. .L.i.s.t........s.)..O@

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006H.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):3.924544270799941
                            Encrypted:false
                            SSDEEP:192:ls8wUhCvGQwr2X/IsTcFERzSLWgrw4g1StKTV9iUFrr:auu99LRzCcf
                            MD5:DB5AD761F6CFF3FC2E655DF5C567397F
                            SHA1:621ECB68B7CFE6C97D8EF635248E1DE4CBD7839F
                            SHA-256:4304CE0CC4A11B1F6BF545BDFC3B366F9015E6A5B21C769D3E34AF318A824F5B
                            SHA-512:C892398184D9AA6A9A98C824479B6F401AADFC0FB12537EF8C7FCDBA5B25EBEC75F74AA2763FF66B2DBFACB5B5AFF975B71446651F44C7D4E7BBA4F2549BD0FA
                            Malicious:false
                            Preview:2...>...........v.......X .. "..2...>...d...<...v.......@....!...........................................................................................................................................I.......I.qk..B.....LZ..^.;.....^...-.._.K.t....^...-.._.K.t....^..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............PMx6.......I..1.....N...^...............8.!lr..A..-F..}K........h...L...............................D....I.qk..B.....LZ............PMx6.......I..1....................................^.......^.......^...........................................^j......^T&n....^.......^.......^H......^..K....^.......^$..........^-..^J..^..z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.5............(..^#..^8..^..z...,4. .......$>........4...4.@..7.....................D..n4..o4..p4...4. .F

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006I.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                            Category:dropped
                            Size (bytes):68633
                            Entropy (8bit):7.709776384921022
                            Encrypted:false
                            SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                            MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                            SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                            SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                            SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006J.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):20480
                            Entropy (8bit):4.077339518380277
                            Encrypted:false
                            SSDEEP:192:1bCaDfkamAlXrPnxwhgBvPSpHdPF/1fQryOs1+u/9enU7KXOClu4crRJdXfqc7Gv:xCawKGPF/l6skU7EaRJbGLR9Lk9
                            MD5:1C310E6F2B069EFCA79788E8F3C4A63A
                            SHA1:F0EEA387D0BD37A50925993C5021CBACB7D04B19
                            SHA-256:643183B279D806A21532B884A78C109E2A0F38189E735189EEA22ECF181AEF13
                            SHA-512:DBB1BEE085D8A10CDC60B03C1340316EC3DDC55174EA86F017AD16CDAAEC41624C8C967D5EC1CFCE0ED809EA4B57CF55E79726DB92A2D7F2F30864B2F4131B57
                            Malicious:false
                            Preview:N...>.......L...d... .... ...9..N...>...........d...h...@...@;...........................................................................................................................................I.......I.qk..B.....LZ............l....F..M%&......._%.I.M%&......l....F.>....I.qk..B.....LZ.I...........M%&.....M%&.....M%&.........................................M%&j....M%&T.7..M%&..~..M%&.....M%&H....M%&.....M%&....&M%&........'M%&2M%&..z...,4. ...."......$>........4..`..7......L.o.w. .P.r.i.o.r.i.t.y......................M%&:M%&.M%&..z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.2.3...............z... ..$........................................2..7.........1.h...?.......?...?....rA\.-?>...o.u.t.l.i.n.e.L.o.c.I.D...o.u.t.l.i.n.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.4........?ff.A......'M%&%M%&.M%&..z...,4. .......$>........4.@.4..`..7.....................D..n4..o4..p4...4. ..1.......M%&*....M%&....%M%&#...'M%&&...9M%&....

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006K.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                            Category:dropped
                            Size (bytes):59832
                            Entropy (8bit):7.308211468398169
                            Encrypted:false
                            SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                            MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                            SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                            SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                            SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                            Malicious:false
                            Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006L.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):20480
                            Entropy (8bit):3.215646308914028
                            Encrypted:false
                            SSDEEP:384:X//xFLigvdq/BUvqYEz7bRJGH3+vxEEN:X//xFLiglq/BUvqRfbRgH3+vxEE
                            MD5:C676991B095C0CAC39F43CF510814CD9
                            SHA1:E5D6AA0C16511E28A3BB51D07BE99CD1B4A5E7C6
                            SHA-256:6AE05BD0704D3F3F7BB7E840CBD7D1C6FC4FBAD7D32C1E4EB121BD7CB8CE926E
                            SHA-512:4F904B6C875DFBDDE0E77CB3306560B39DF49D4E4480A3D3895F0072C39C0D30FD0CEA3787BB3D361DF130D4046885104809E01FAC51AE8183F427067407B581
                            Malicious:false
                            Preview:2...>...........v........ ...-..2...>...B.......v.......@....,...........................................................................................................................................I.......I.qk..B.....LZ7L@.P...7L@9y.T.$$.6CV.7L@9y.T.$$.6CV.7L@..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................}aV..1..Ek......N...^................l...B.J....%..............................l...B.J....%..........l...B.J....%............}aV..1..Ek...................................7L@.....7L@.....7L@.........................................7L@j.^..7L@T'...7L@.....7L@.....7L@..-..7L@.....7L@.....7L@ .L......7L@37L@I7L@..z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.6.............7L@37L@97L@..z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\0000006M.bin (copy)

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):53259
                            Entropy (8bit):7.651662052139301
                            Encrypted:false
                            SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                            MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                            SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                            SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                            SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\header

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:Matlab v4 mat-file (little endian) 0, rows 975182774, columns 0
                            Category:dropped
                            Size (bytes):72
                            Entropy (8bit):2.296631615393777
                            Encrypted:false
                            SSDEEP:3:bD/9aaHtYl/Z1RRtl:bD/XHt2X
                            MD5:4992313902E9E528526D035C933DC797
                            SHA1:5D3FE9577844D5A10B95178EDBEEE53D8DB60923
                            SHA-256:52D6F022C514F50E0234C60D89387527D0DC2482DD98942F5E74BE649B297522
                            SHA-512:6186D4D83718D1CCA1D0B780E05EC9E318209D3E268FD3E91433E384DCD918298AD9CC42BEDA21B6625AB75F67C6D9F6A285ACE7020B9110D641A203C59D76F8
                            Malicious:false
                            Preview:...... :............0..........................@....4...................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000001.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):0.04401584019170665
                            Encrypted:false
                            SSDEEP:3:RRk//:Lk
                            MD5:CD74ABACE8A00B17BD8107BC5982C21E
                            SHA1:D53193CF8A43D766FBFA52976192F44D6B0F79B2
                            SHA-256:B670BC07C9CB554511180DCF3F6A2C7818E8CE6E67B84784F0EA4D35EC61D516
                            SHA-512:1B48A37FCF0F9FB9ED9B31A8F3E36596689BF1EEC6F41F5EFA3C728121944919CE7A81F0379A108D80AA051CFEF07DC296F9C0691FC8855983B2F29EC15C7FEF
                            Malicious:false
                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000002.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):0.4858496758263854
                            Encrypted:false
                            SSDEEP:6:NTc/q+OubxfbxXztltjbGwJVK1zLXl0ww1EVZzOXl0M:Vc/q+/bRbJtXjaqgL10wQEzzO10M
                            MD5:911968468B51DF985DA921F6F7468FCB
                            SHA1:34568F4A745019A220889FA0D118C2A0F2C81B89
                            SHA-256:DB771F69F1A227F917C34FB90EF1BC20B0A1B5DAA3741073ABDA4982E3840D1A
                            SHA-512:D9829D271C0D638D3C7D6674B67C707AFF98B0E2EF7F66D8806445E6AFBBB697281022B175DC00D01C533C21AA028EEF7FF2801FFB5D5DA1D254C185FD5AAB66
                            Malicious:false
                            Preview:2...>...........~.......................................................................................................................................................................................[+......[+.....H.~.....`........................[+.....H.~.....`[+...................................................[+..........................................................[+.P..............................................................................5........m;.H....7.5N.........?.P.............(.,D...H........N...^...............................................................................................................(.,D...H................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000003.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.668608064289114
                            Encrypted:false
                            SSDEEP:96:8pYWr4VDxjueExyL5gLYO5C47yEwbgZrG/:8pYpVNje8L5gLX5CCfwbgZrG/
                            MD5:C8E981AE640086AE3B979F827B96C6C0
                            SHA1:835E6F33EB2B6EDA9F9FF95C19279226529FE317
                            SHA-256:5F5EB8EB5C17AB8E451D8707FA7B1E33DB20526BE4800FB29A3E0EB1E21D2124
                            SHA-512:B216A49FB1C9CB0F06EF6403A103E8B734C558872804CB3CFAD9830C5E477405257BF54710134A89D580DAC03E0D42BA4B00D0EB1E3A8CD217AB1186AB3C7C00
                            Malicious:false
                            Preview:j.......T.......@.............................................................?.........................................................................j...............@.................................2.......2k....$...Dt...99......99q.I@../[.s.V..I.+>.J..[.!.....I....2k....$...Dt....2..99q.I@../[.s.V..99...........99......99.................................................W;......W;...(..f....g.L.V.....L.VGO......k..s.2...^............................99.L.V..l....I................99..|...99X.....99..2...99......99.."...T$....O.T.R..}i.T%j.......l......I...c..,0...e...B4.$..........C@RQ.H..B......Y...........................#...I.r.B).Rr.I.......I.+>.J..[.!....L.VGO......k..s.L.V..W;...(..f....g..W;..l.>.F.O......l.....>...........:.....2k....$...Dt...99q.I@../[.s.V..l.>.F.O..........}i......L.V..c..,0...e...B4.$...........I...M.....0...............................0...........e....4..................T.i.t.l.e.......|{....B.l...R......(....Y......(...D...L.e.c.t.u.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000004.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):8192
                            Entropy (8bit):4.75655317617278
                            Encrypted:false
                            SSDEEP:192:jsy2qBl/f+eXbRoGPXiPwyRi+BSyJUNgLthg9k/kYRbB/+U6:YAOGf7yRiF0tKk/k
                            MD5:9568685BF9F8D89EA816A94F684ABE5F
                            SHA1:9D64E7FE1E12304B4FFB9D890C468DC8F562A38C
                            SHA-256:4786F46A355CCEE7D8FF7D603C11463DF92C0686900A4126F4AAEC3DA16A3B53
                            SHA-512:D68B1BD8BA1534530A49BDA01AC1EAA5A38288FDC821F736E2A654718A9238E0D0315296061CD43FB894A70084127ED6B1568527313E187BFBB0C351098381EF
                            Malicious:false
                            Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZa..4...a.o.]. .b...".a.o.]. .b...".a...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............|.3^E.....anQ....N...^................h.....D..;.-..............>...............................$....I.qk..B.....LZ..............|.3^E.....anQ..........|.3^E.....anQ.........a......a......a..........................................a.j....a.T%;..a......a...W..a.H....a...+..a...S..a...........Z4...........................................4../4......p...............C.a.l.i.b.r.i..................a.:a.ka...z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000005.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):40884
                            Entropy (8bit):7.545929039957292
                            Encrypted:false
                            SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                            MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                            SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                            SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                            SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000006.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):4.402177214754616
                            Encrypted:false
                            SSDEEP:192:zsxKXZ7mJZMojjZ8LucOTS18wZ9faRJtPowXaRRkDU2kez6N+ej9r8VoY:oAx3oZ4ucO+PZ90JtPnaRRkDuez67xZ
                            MD5:2E6FAB4C2BC9F53F1C4A896F2432C0FC
                            SHA1:F0AAC31828AA9A7D0C95F4BABE7708D29279E0FB
                            SHA-256:D199DA6CF5313D208A3C267890D9549AAF88D4BFF4A7A51507A4E9CA66C17653
                            SHA-512:7D6235D891CD2777D9135CDB7DF39402E27B4ED98C8F6B8BC3CEE9C4D9DCD64210F629B0F0C1E9F0166902DCA0AABE8A6B43F413F815EAE00347C184600540B4
                            Malicious:false
                            Preview:2...>...........v........ ...)..2...>...B.......v.......@....(...........................................................................................................................................I.......I.qk..B.....LZ....H......&-.5..i....0....&-.5..i....0......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............y..3.d..'.8P.%6....N...^...................cA.J..\..5.............................................."....I.qk..B.....LZ............y..3.d..'.8P.%6................................................................................................j.".....T.................T............. .A............. ...........3...:...8.....z...y.. x.. ........ ..$...$........D..........7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.5........................Z4...........................................4../4......p.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000007.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                            Category:dropped
                            Size (bytes):24268
                            Entropy (8bit):6.946124661664625
                            Encrypted:false
                            SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                            MD5:3CD906D179F59DDFA112510C7E996351
                            SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                            SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                            SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000008.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):4.57196636031755
                            Encrypted:false
                            SSDEEP:192:fsA5ksI9lgaEo/uCWNhjnmkAUoDDyT+LpSXH7bRpjiyhppKnx2DEd9boRsRIdxdq:UIelga2B3jmkgDDjNsH7bRpxp0x2DEfd
                            MD5:54B34D4A25C90AB8C50E9CE67FCC4D7B
                            SHA1:2523CD98619509BFECDDB0209BFE0683433DEBEB
                            SHA-256:17479D5A6C2A3A320C140117C75BEBB62F10E5AF2C397C2BB56903F3631326CC
                            SHA-512:EFF05591700851E86F72146909A17F3CC2E2F6D4EB1ABA106764CA41584F9F8A38934BE0B22D6BF2CDC752902634EBABA457444BBAE614E3D8BAA3CB996B92F9
                            Malicious:false
                            Preview:2...>...6...z...v...N.... ..X,..2...>...........v.......@...H+...........................................................................................................................................I.......I.qk..B.....LZ.$..N....$....%....b|$.A.$....%....b|$.A.$...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............W..tZu..*..;......N...^................$.Y..-F.5..>gn............P....................................I.qk..B.....LZ............W..tZu..*..;....................................$.......$.......$...........................................$.j.9...$.T.....$.......$...s...$.H.....$...0...$...`.&.$...........$.3.$.:.$.A.$.8.$...z...y.. x.. ........ ..$...$...............7...7.........*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.1.1................Z4...........................................4../4......p.........

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000009.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):39010
                            Entropy (8bit):7.362726513389497
                            Encrypted:false
                            SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                            MD5:9700DE02720CDB5A45EDE51F1A4647EC
                            SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                            SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                            SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000A.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):3.95043314949611
                            Encrypted:false
                            SSDEEP:192:QksEPw9jOk1WjerdxL0UReyAFlKG1LUBjd83wqE8B4Y0/5dNUXOqmndkqVduqOW:+EPsjL1PxB0URePJUBZWwqE24H/IGkq7
                            MD5:9D0644366D7213D41BB2E0BE871EC646
                            SHA1:C19FF8070940E755C4DCD5276D35A6AD595E86FC
                            SHA-256:44D5673262C44A3BF403168FB4908FD6D46D966A799B4B23F489F2EE2E817CBF
                            SHA-512:6958527585278C9E2ED2B9C763078D95372D4F23D1B230B40993D18CAC8DADBDBAA1E0E52E5AC72DC63BE47209C0FC7978CDDF5F6FD6A0773123385BE6EE95A9
                            Malicious:false
                            Preview:....>.......B...v.......0 ..x#......>...........v...^...@...h"...........................................................................................................................................I.......I.qk..B.....LZ..z.......z...M.3e%...T...z...M.3e%...T...z..4..M|.....m%...4...I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'.................,...$./G.z.{....N...^.................o..3;H..0.............b...8....................................I.qk..B.....LZ................,...$./G.z.{...................................z.......z.......z..........................................z.......z...M.3e%...T..4..8....4..M|.....m%..2................................I.................................zj.#....zT.G....z.......z..Q...4.H.....4.......4.$.7...4..........4.!.4...z...,4. ............................"......$...7...............T.u.e.s.d.a.y.,. .J.u.l.y. .2.8.,.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000B.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):59707
                            Entropy (8bit):7.858445368171059
                            Encrypted:false
                            SSDEEP:1536:k76rvGc8WKC2/UX1uEgVRY/jvv9CblyL/T:k77Z5C2/Ow1e9CblCT
                            MD5:47ADB0DF6FDA756920225A099B722322
                            SHA1:851946B8C2BD0BB351BAEECA9E5BB6648A87D7CA
                            SHA-256:EC8CD7250F3D82E900E99114869777EE859EC73EFFABED108815F65742078C3A
                            SHA-512:85A9920E1CE4A2FCCEBAFA425C925DF33580FA3C3C00178F058539B2FBC0163866DB8A41B320E2EF2CD217F00FFA06A1A831C728D3F9F910C9EAC58B5DA76E2D
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..A..Qaq"....2........B#..R.b3$..8xrC4&'W.%e.(.c.d.5E6Ff..h..SsTt..u...Gg..H.....................!.1..AQ.aq.".......2..st.BR..56.r#3.b.S.4c%...$d.CT............?....3.7...G:../P....z..K.:6..w......6....... .z7...~.....{gdF60...9....{...'[N....m.........z...g{.......7...4..1..=.z...._..p...m..Icd.~.v..9.P..0Z(.<j.......R6zm.....v.z...>x..)=g........zo{..w..f..y.t.....%.D..#.}.I.>).H.QM..cLD..x.../.^y.{.............y.=^.......I.T.......U..0_?...u..og..3.ky..K....6w...Dc......~........ik.z....N...en......_.....x....._u...4.{..P...>.....}.......>.R.....m.....[mt.....}.........|.....m......~....B.F.]C.36..q....yg...{]...+.DZv.9<.o..;..N.n&im.,....w.3...V.s...Y..e#$.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000C.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):3.8708725786827576
                            Encrypted:false
                            SSDEEP:192:ssYLW05rr+SO8daX/FthzRl+6THZCwJPQS9dUH2krI:x+39O8d0/hzRlTFCZadX
                            MD5:BB970B22014782EEFD7301AF666E1399
                            SHA1:ED4AE5679819BA7DE2DC3331CF7FB91932629AE8
                            SHA-256:8BA7EEDAE0DFA3C3B3E07274848CBBD5478F99B7F6397B0CE67024B18E0A8704
                            SHA-512:BE1D9E626543B29E5AA208688D02A869E10774F3BE6762D8CF2E99AC7989ABF180C7BA08CF01862BFCE12F15AB6813B650A218F4BDAD0CBB7977684FD70C0B22
                            Malicious:false
                            Preview:2...>...........v........ .. "..2...>...d...<...v.......@....!...........................................................................................................................................I.......I.qk..B.....LZ.+/.<....+/`1.x.+...(.*..+/`1.x.+...(.*..+/..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............F.CNJ...........N...^................../GclJ.!.................................................D....I.qk..B.....LZ..............F.CNJ.........................................+/......+/......+/..........................................+/j.....+/T.T...+/......+/..|...+/..;...+/..h...+/......+/ .W.....'.+/2.+/..z...,4. ...."......$>........4..p..7......S.u.m.m.a.r.y.........................+/3.+/8.+/..z...y.. x.. ...........$...........7...7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.9..............+/

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000D.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                            Category:dropped
                            Size (bytes):27862
                            Entropy (8bit):7.238903610770013
                            Encrypted:false
                            SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                            MD5:E62F2908FA5F7189ED8EEBD413928DEE
                            SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                            SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                            SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000E.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:big endian ispell hash file (?),
                            Category:dropped
                            Size (bytes):20480
                            Entropy (8bit):5.3125765134550385
                            Encrypted:false
                            SSDEEP:384:i1cENC5WagB4COUx+Z1krmQPmwbJ3AGtY4CplApiyDhKd28ybDYzgXXg:Uz4mekCAk0b9Aw
                            MD5:32BDB495E7AB5D1746DA61C2672AD1D4
                            SHA1:59DFB1DF7A1B68C74718759E6B1566D1130702CA
                            SHA-256:A7D07DCD4A5BCE4AF8CA7A48E67F5C98B9A8DAB6ED0AEDE3B9D31CCCDC281604
                            SHA-512:E9706C7E2A5514E509767A707DAF1CE09536A5CE0C4671046B0A0B5997FDE53E89BC3B9A9B9FFBD2896AED70C75D8364492DFDCB3C8391E4695576FD90D85DE1
                            Malicious:false
                            Preview:...@....8...........P...(@..( ..`L.........@................l....J..( .. K.................................................................................@.....................K..( ...K..............+.......+...;.H.12.....Bt.......t...=;..(.i.tbl.J...5.r.!b.Q.}H.J..../.....(....=%./...MzJ%..A.z.3..W..Mz.........../......./...................................................).T....{7.T.Q.....T......'T......)T......,T!d..{.wT%A...MzT.Q...........0...........e....4.........................A..:4E.2..p1......(...`.i.....(...(...B.a.c.k.g.r.o.u.n.d. .-. .Y.e.l.l.o.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.1.9...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e...{7......{7..5'.C.v...Y}E..,.......,Ou!.I.k....~.2...........\...............D...t....)..{7............'...,...............0...........e....4........................yf.....F.Q.........(...pO;.....(.......S.t.a.t.e.m.e.n.t...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000F.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.100434952455907
                            Encrypted:false
                            SSDEEP:96:EDsOJx7JzJ33yFSOGrqIEauyXe9CrBVTCRLDxJzJmfJiJgJh:UsixVdHP7rq1auyXe9CrDORLDLdmxuc
                            MD5:36E32F4108F344ED96B06FCA89AC955A
                            SHA1:67E5BC3916FB3EB4A8A31431AEBBCC55D5956F2B
                            SHA-256:1BB8A7E931CF54484F8804B4BBBA85D6D68CEE270C0BDCE282445C88F1CFC9DD
                            SHA-512:BFB07CD14D09EDACB8FC410E76DEB0807F5555B17034991DFEC99C6D460F278020E2C6BA01463DC567527269D5E394DBFF91E7C70CEB5979726D17B56B755B7D
                            Malicious:false
                            Preview:2...>....... ...v....................................................?....?.............................................................................2...>.......|...v...H............................I.......I.qk..B.....LZ)]+.....)]+...:.UK....)]+...:.UK....)]+..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................x.-..0J.$."V.....N...^...............a...>).A.....>.........f........................................I.qk..B.....LZ...............x.-..0J.$."V............x.-..0J.$."V..........)]+.....)]+.....)]+.........................................)]+j....)]+T.]..)]+.....)]+..B..)]+H....)]+..B..)]+..>.))]+..J...................;........4...4...4.."..............)]+.)]+.)]+..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........)]+.....)]+....#)]+............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000G.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.080350788654962
                            Encrypted:false
                            SSDEEP:96:r5js7YqxszAXsMEAXs9khdCT8RyODKqaao9tbBc:Ns/sUspAXs9khdCQRyOKjG
                            MD5:F15E3E05A7A8C857E1F778FBC7776B20
                            SHA1:319C761A1379347976ACA9CEB452EFE528FF6371
                            SHA-256:8073AA80805C1FA57BFE0AFADB1C89DC3CDA03B7D01A0B78453CD0EC9ED65D42
                            SHA-512:B93D1C6B6FFA6E36007D004C06E7ABD0AC67517BE51B2F47CAC5EC0FC858912FB6D5C5C972BB8376CE698741BED8133146F2C1ABB782F4DB646B0CE5D1A82DD1
                            Malicious:false
                            Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ.H.......H......9.......H......9.......H...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............A~.....2>Qs.b.6....N...^.................Y7t.g@..Z..{w........f........................................I.qk..B.....LZ.............A~.....2>Qs.b.6.........A~.....2>Qs.b.6..........H.......H.......H...........................................H.j.....H.T.]...H.......H...B...H.H.....H...B...H...>.).H...J...................;........4...4...4.."...............H...H...H...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........H.......H.....#.H.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000H.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.020882078195494
                            Encrypted:false
                            SSDEEP:48:BstHPKM6IW7MbtEPEE3pPWXtW9TYSTo5rd6rLIedXiz3RrAg:BssRIW7MbDE3QXA9TYSTARiNwA
                            MD5:FAC81FC29DC9F10EF12FB5A81963F5C8
                            SHA1:FA91C0D576EBE246BB462ED0493396A0DA6758C3
                            SHA-256:90A6C7425294CE998CEA7482FBF8B5951FDE4AAC8F94467FB50547F48AC72080
                            SHA-512:FE54BBEABAB22D5CB82460B59495B883C33C600793955E341F7F286A8FCB6F909C65A1D753A96FC68F9B26409252F1322907E13307C1DF51ADEB2089EEFBAE64
                            Malicious:false
                            Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ...........l......NR.......l......NR.........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............m.^?).&...r.......N...^...............$7L.'.:N....d..p........f........................................I.qk..B.....LZ..............m.^?).&...r.............m.^?).&...r...........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000I.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.051925810045155
                            Encrypted:false
                            SSDEEP:48:Jfswij4Xvoebt0FSEl5XE9KXWacToDrdnrhSIodXYHYU6vK2rIechZ/Y+Whxg:Jfs1eb+SETXE91acT+Rrh8SX8
                            MD5:8B86658147A379F2A7C8222DFCAB1339
                            SHA1:B7C015D8ECF452B06DA48A21E94653316BBCFB5E
                            SHA-256:BA6C5AE090931DF298E5F19313501C651F59CA3F51AE19198D897BE4055B12C2
                            SHA-512:8375A2E26EE20277A794F15AE010985C2032DEB3670A1F371C1A92A9B53CE6734578EF165E0230B466179401AFF1F77E6F15F58BE1162EAE428831BD65ACA091
                            Malicious:false
                            Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ..g.......g...x.......K...g...x.......K...g..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............|T..g.=.6Bic...Z....N...^...............at:...E.3..."........f........................................I.qk..B.....LZ............|T..g.=.6Bic...Z........|T..g.=.6Bic...Z...........g.......g.......g...........................................gj......gT.]....g.......g..B....gH......g..B....g..>.)..g..J...................;........4...4...4.."................g...g...g..z...y.. x.. ...........$........4......7...7........................;........4...4...4...........g.......g....#..g............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000J.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.080773139346554
                            Encrypted:false
                            SSDEEP:96:T20sbYAX2GZ5EHhMX7M9lutT1RyExwpkrwOGNh:60sb9X2qmHhMX7M94tRRyExwpkrwlN
                            MD5:10502BCF6CC8CDE6638C246BC9EB5B7B
                            SHA1:8CF2012BBAF8538DEB85EC68C1C2AFBDB6F5D06E
                            SHA-256:658C05983E7138EBD677ED0219764FFA60212CA4473AE223B43D35AE33D7B023
                            SHA-512:46BA7B03314C3E8F9335A686F92757FF204BCE3E79E9C3647549A5BAB63F864784F08027F60E3B6747D50E288A8FBB90EA05318EFBCEE82C8F540F9DC13AFE3C
                            Malicious:false
                            Preview:2...>.......$...v.......................................................................................................................................2...>...........v...L............................I.......I.qk..B.....LZ...........f....Q....)S...f....Q....)S.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............V..s,...r.. .iY....N...^...............(...MH3B....._.........f........................................I.qk..B.....LZ............V..s,...r.. .iY........V..s,...r.. .iY........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000K.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.072731558711374
                            Encrypted:false
                            SSDEEP:48:YxsoQKNsQKAxUyTSV+t32iEEjXk9FaEPToqrdDrqIrdX9dRosQkn4wM2zJ:qso9LHUNknEiXk9gEPT7RPXQLklM2z
                            MD5:63782E9FFB863E8FAF3168E95417ED8C
                            SHA1:C8A7242AAE36783B15DFC9DED6607774490C0078
                            SHA-256:228EC7930CFA806D889B37EB4F0A1B4A3BF143E2EBD16E12F9DD64CA87AFCB62
                            SHA-512:4F9FF78E53E6A872A4FDB64269E9C988B39C8BBF7FE41A7DE7B70BC25A535C4B7015C0E8BF43C490BAB162263917C466C030A1659160F9B7E831169E8AC7F920
                            Malicious:false
                            Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ...........{.O.,wm1..*{...{.O.,wm1..*{.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............g..Y......S.(.O?....N...^...............s.TJ.Y.G..ve.h.i........f........................................I.qk..B.....LZ............g..Y......S.(.O?........g..Y......S.(.O?........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000L.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.086350101975093
                            Encrypted:false
                            SSDEEP:48:YTe2sMOehFidytTeeEYwmXM9+QmTow0rdmrfIidXSlRPtJJ:H2sWh0yRhEYbXM95mT30R2R4/
                            MD5:6199E897C6326784AF70A786949A9BF9
                            SHA1:F9D843DB51FD78B1D091AF5F754E4D37340A57A5
                            SHA-256:BAE9652744A37888E7E347C6FA5709559D3FFCB4846311AA375CF32149B5B9F0
                            SHA-512:0876798022DC671F1C81D5FAE6BB28E2301F1CA8B3C86C03718FCEB4D9A75639EF6CBDAF55DF35D9C1B7564EF4B4268EE8153D33F569DBC89D04E70489719F43
                            Malicious:false
                            Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J...........................A.......A...E~"..6.~.7...I.......I.qk..B.....LZA...E~"..6.~.7..A....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............0.+B.$.P]........N...^..................E.|.F.& <.4.3........f........................................I.qk..B.....LZ..............0.+B.$.P]..............0.+B.$.P].............A.......A.......A...........................................A..j....A..T.]..A.......A....B..A..H....A....B..A....>.)A....J...................;........4...4...4.."..............A...A...A....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........A.......A......#A..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000M.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.064182572196546
                            Encrypted:false
                            SSDEEP:48:YNM6zs8VgqK/bkgkV0tW12En6rpXg9DtLeuToSrdvlxrsITdX5JK0RPXhb/KA2hg:6s//bCV0YAEsXg9ZLXTjRHVf
                            MD5:F9E6DAC9172248443A4FE3224F2FFBB9
                            SHA1:6787B9DF82D9A32CB534BF56D8A831BB06BDA46E
                            SHA-256:78EE1E670ABD482E13EDA8E238705AE1A435C2F870DE2B66BF2049111AE25D94
                            SHA-512:BB85D6245884906F20A07B3F52B5A6908C2580F46DF020F464AB4A7F5930D6C158C1DD86891A3EA315899A6E2C683AEBBBFA045541A74AC4861429B0177ECD32
                            Malicious:false
                            Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J...........................u0......u0.W.....&...DS..I.......I.qk..B.....LZu0.W.....&...DS.u0...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............HqUJ..............N...^...............F.x9..L.....0.P........f........................................I.qk..B.....LZ..............HqUJ....................HqUJ...................u0......u0......u0..........................................u0.j....u0.T.]..u0......u0...B..u0.H....u0...B..u0...>.)u0...J...................;........4...4...4.."..............u0..u0..u0...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........u0......u0.....#u0.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000N.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.0877180116116065
                            Encrypted:false
                            SSDEEP:96:9ks9a/Ja/Ma/QZDZYwEXg+XY9s0YmTXRjOpa/Ma/M/1a/Ba/9xa/y:9ks9a/Ja/Ma/QZDGXg+XY9RYmDRjOpaZ
                            MD5:560523F1B9A5ED2D1DDF8D13CC79454E
                            SHA1:3CCC35C619C3F212922AF2BFB77B037BEB659A6D
                            SHA-256:C450A51B159784C6D54BA5F251651591908AB3E6446F67DADFEEF285BE5670EC
                            SHA-512:14E3688C900F450C790B8B5FEC11C1F0D0D0CB0A875A55CECF6FF55E515F110BF24FA7AFB8A9077BC881C0C850B56775A452681EE7DFB86723CF574EEB7EB851
                            Malicious:false
                            Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J.......................................B...+..@!....I.......I.qk..B.....LZ....B...+..@!........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............N.S_.....[.b.:.....N...^...............F.?.Y|.G...1.e..........f........................................I.qk..B.....LZ.............N.S_.....[.b.:..........N.S_.....[.b.:.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000O.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.080532173786952
                            Encrypted:false
                            SSDEEP:96:6i2sVC4nblbEXXc9eqtTJRIhZCXCmCRCMCXCnCCuC:esVC4bOXXc95t9RIhZCXCmCRCMCXCCCL
                            MD5:844D818DB207107866CEB9548390BB37
                            SHA1:A85BA8FC607E0B397373A7EA0157D41AFF791B58
                            SHA-256:3CE6F984D6549B552D0DDAB65120968295D412F08FCC2E0F5AFBAADEA845CAF8
                            SHA-512:A795499C2DBC20E73B5122B9675FBEF3C8C240E27F193DD831C90A5A64C401C1C912CC9F0739BA1AAFE858E84BA1DFCFAEEAE96DBD1FBA9D98BDBBB29FFC465F
                            Malicious:false
                            Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZyQ......yQ.x.......im.yQ.x.......im.yQ...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............2."....r.m.#......N...^................J9.UsH.{ v;R..........f........................................I.qk..B.....LZ.............2."....r.m.#...........2."....r.m.#...........yQ......yQ......yQ..........................................yQ.j....yQ.T.]..yQ......yQ...B..yQ.H....yQ...B..yQ...>.)yQ...J...................;........4...4...4.."..............yQ..yQ..yQ...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........yQ......yQ.....#yQ.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000P.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.047935897007364
                            Encrypted:false
                            SSDEEP:96:esJIXs+rEftXQ9h9TdRf7kqUpxxqrjDy:esiX+FXQ9h95Rf7k
                            MD5:ABC5C53D7C4748D27090E1EC83382C32
                            SHA1:C713C5E5469C6306736ABCA2405CC6BE88B03394
                            SHA-256:68E4CCB5E8A9CDA1EAB8EC0E13AA3BEC5B54148A66795A8AE28FBDE83E0F3F64
                            SHA-512:8E0C9128942DB163A3EE103B4BB8B5FBE7126D525849140CC739E076F6CD33F7B390EF27B7381E01D382301FF3E48663E650D39F69DD05093DEC5683BB3A3C91
                            Malicious:false
                            Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZ.............|...zt...~.....|...zt...~.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'......................U..?.'....N...^................Si...sC.Px.3..........f........................................I.qk..B.....LZ.....................U..?.'.................U..?.'........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000Q.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.064448243190853
                            Encrypted:false
                            SSDEEP:48:YpsSLSM+ccQO/Ut+WEFnMXU9d7ToKrd2trIIndXBVR5Ji7YPF:yspact/U7EFMXU9d7T/RehX
                            MD5:4589A797A804FBF10DAA6574E55137F5
                            SHA1:AD9CA2B3750CFB8C5ABBA2EDBE64749164686F67
                            SHA-256:2955B28732125668DD85ACCE32098E95B1765B7E91CF72E8326FA6E544FD38AD
                            SHA-512:B51AC56473BA33B86F875A2F77E0D532CDAB2CB089E38C6CF41507276BC463CB4BCBB5868FAA6846222F00F6C67D29C0FCD52C96780DAFFA0DFCCF9CF3B29E89
                            Malicious:false
                            Preview:2...>......."...v.......................................................................................................................................2...>.......~...v...J............................I.......I.qk..B.....LZTal.....Tal...,Y......Tal...,Y......Tal..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............N..%..........V....N...^...............n.....D..g./.g.........f........................................I.qk..B.....LZ............N..%..........V........N..%..........V.........Tal.....Tal.....Tal.........................................Talj....TalT.]..Tal.....Tal..B..TalH....Tal..B..Tal..>.)Tal..J...................;........4...4...4.."..............Tal.Tal.Tal..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........Tal.....Tal....#Tal............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000R.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.102631306945948
                            Encrypted:false
                            SSDEEP:48:xsUhrRYqb4t/htH8EtSOXpO9i5TosrdfokrrlIVdXTukms8a:xsGeqb4ZbH8EHXU9i5TNRfHr0Y+8
                            MD5:9B6C3B3449F305241B6A0A167E2532A5
                            SHA1:B21139DDE7B0928989F32DADC52CBA023AE1D3C8
                            SHA-256:DB785B738520CDA7C1F6208245BAF42698B90387BA8D9FDE18EFF1BFD6585696
                            SHA-512:12BB67209EF7B711869DB7A1CA1FEA21370F1E4EDB13FEFA45B55056DAADFF1BA3E04A5B44F5529AB5FFC48D7D72C07C2A2C6E9660901888523FC3D564C23281
                            Malicious:false
                            Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ..Y.......Y.31..,%c,!...Y.31..,%c,!...Y..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............^Et$o..3-,.=n.@....N...^................p.Qe4.J.l.............f........................................I.qk..B.....LZ.............^Et$o..3-,.=n.@.........^Et$o..3-,.=n.@...........Y.......Y.......Y...........................................Yj......YT.]....Y.......Y..B....YH......Y..B....Y..>.)..Y..J...................;........4...4...4.."................Y...Y...Y..z...y.. x.. ...........$........4......7...7........................;........4...4...4...........Y.......Y....#..Y............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000S.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.033755994798817
                            Encrypted:false
                            SSDEEP:48:hsPm9noEhKJtRtkEno3ZcXfc9jCirJTorrdlruIodXcwvkrEd5XZHQoa:hsE5KJ5kExX09jC8TKRpIpOo
                            MD5:FC0BAAC32006F482ED6A3E19B1A0AA85
                            SHA1:0955840BB761741880556FA9F95D4FBDC7D4F829
                            SHA-256:DAF9740BBD9AA0C0208E3BD0E2768FB977DB7D74DB03227F2C420E58CF2641BB
                            SHA-512:91E39C44D32CABE34F07E000E774C89F7CF3928289F0E00B7667D3ADF92F170A1D0A0016F4BAC4986F0D8658C193EBE60F64446C1A5FF925C4E940390A46B2EA
                            Malicious:false
                            Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZ..............g.-.*.X........g.-.*.X.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............,.f.U... `..+$[....N...^................-.....I..&...........f........................................I.qk..B.....LZ.............,.f.U... `..+$[.........,.f.U... `..+$[........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000T.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.097020699052482
                            Encrypted:false
                            SSDEEP:96:1sSwtp9GEFmLy+8E1bXMb963TjRRcuvtunUmEQI:1sSwtp9GEP+Z1bXMb963HRRcOtunUmEl
                            MD5:5EB803360C3632627F6BB04B0198C233
                            SHA1:DCA7C18AE93DA0A505B9C08D856907D65BDE8E12
                            SHA-256:DC94CE817B8EFF89FB73B4E839660BF2B9E1EBE23F5E97A2A8C9417CD5AB341D
                            SHA-512:99A3E712987DAB4512C3C6996E35DA651ED6FBD06291DF5E476C640D1AC56961B6993D91D1C86D5F7FF45EE21D53ADBC6E5C7ED01563DA9B554EDCA5C47189ED
                            Malicious:false
                            Preview:2...>.......&...v.......................................................................................................................................2...>...........v...N............................I.......I.qk..B.....LZv.......v..V.p....`*...v..V.p....`*...v....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...................E........#....N...^...................O+.C.. j...X........f........................................I.qk..B.....LZ..................E........#..............E........#.........v.......v.......v...........................................v..j....v..T.]..v.......v....B..v..H....v....B..v....>.)v....J...................;........4...4...4.."..............v...v...v....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........v.......v......#v..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000U.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.128950107024672
                            Encrypted:false
                            SSDEEP:48:c3dsYJqgOv0tOwYEtAXk9ZvpBMToHrdjreIodX4jRy5upig:+sTgOv02E6Xk9ZhBMTCRv4CyY
                            MD5:8633A74C1A960267D04933A555C114E4
                            SHA1:4FADBE6B8CA682A1F57043E8C1E4C8DE89C18E87
                            SHA-256:11BC56EC6B637D5336725FC372EFA49E7A03B0B94DD7C17D9FCECDBAA1B32453
                            SHA-512:C666FD49A51956E845C0D3B6760B02E41E3DDA974F5E5B7BB92ABF6B0711E97A8C79EA6670D2FD72F56884CA8C3F5E47508C1D8B2F3D26F2E1DE3617C60BBC0E
                            Malicious:false
                            Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................I.......I.qk..B.....LZ?......?..L....0!.=.c.?..L....0!.=.c.?...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................4)M...z..K.IW....N...^...............z.#|.B.I...)5Fx|........f........................................I.qk..B.....LZ...............4)M...z..K.IW...........4)M...z..K.IW.........?......?......?..........................................?.j....?.T.]..?......?..B..?.H....?...B..?...>.)?...J...................;........4...4...4.."..............?..?..?...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........?......?.....#?.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000000V.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.174273325378395
                            Encrypted:false
                            SSDEEP:48:RMs7Fzyz6FbFmAUoP2Ett5t8EPlOiKXxK9Wyj0ToordQrSAEIX2dXiDi3i/JFbFZ:KsIS+Etx8EP0Xs9WY0TBRIIKd
                            MD5:C869BFCB8A19816DCD875C3540917548
                            SHA1:118897B37E0DF204691C4C319EBB5A4ED903098D
                            SHA-256:277F700B8BC96AE12B3BA92617423525C8D78D2DDFC80D33A9F07A615AA21C28
                            SHA-512:456AAD2552A75A8671734C56A720FACEA83083CB65CC7411EAE2910227B12E2F6B2EC38B9A76640E5CD5AD9D40C148BB3F38C264EB3A94F916AA3CB0E44D1D45
                            Malicious:false
                            Preview:2...>.......0...v...$.................................................?....?............................................................................2...>...........v...X............................I.......I.qk..B.....LZ............p..,*kf.&^.....p..,*kf.&^......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............jO..`....ML5`......N...^....................B....*..Q........f........................................I.qk..B.....LZ............jO..`....ML5`..........jO..`....ML5`..........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000010.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.136929260143504
                            Encrypted:false
                            SSDEEP:48:FspVsnIDo9LktJWR+EBAC+rtrcXbrc9JRrpToardSrAIPdXvxmtnTp5:FsoNkjWUEBA7tcXHc9JDTXRKRdC
                            MD5:4B4A83CBB220FBC1ACB7D8D5D8184F5C
                            SHA1:D1929394E3F27B74185AFECF7B0640DB2D32DD3D
                            SHA-256:CE3040086197C59F61927AE4F32ABE5825C6CC673A4E074818A128C331A59DBB
                            SHA-512:C4B2989DCC4FB56CD76EF566E8CEE5C8F1DA7CC0755D4A767B992AADFEEB137A4858F59FF8DF59B344D4EF8067A9B20F82A6E235A725D14AB5196496D2DA019E
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZM%......M%......5`U".s.M%......5`U".s.M%...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............G.>..2.../2.b..F....N...^.................lb...K..|..%B.........f........................................I.qk..B.....LZ............G.>..2.../2.b..F........G.>..2.../2.b..F.........M%......M%......M%..........................................M%.j....M%.T.]..M%......M%..B..M%.H....M%...B..M%...>.)M%...J...................;........4...4...4.."..............M%..M%..M%...z...y.. x.. ...........$........4......7...7........................;........4...4...4.........M%......M%.....#M%.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000011.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.102866857942101
                            Encrypted:false
                            SSDEEP:48:dscZZHWXjaCB65t+HeE7CW+kXfk9n7HsTo5rdSrmIydXh0AxEW/IEbVrt:dsFno5RE7okXfk97MTQRKqHh
                            MD5:50EBF2814EC4A9629421AF86F3136E06
                            SHA1:A50A2F6B83600002ED5434FCAC22F4A468EDC6FE
                            SHA-256:5BE6B8442CB649A5586ABABFCECD92671FFE6938AC1B8411E58DCEE8D8908455
                            SHA-512:2CF191B2A350DAEFE91F8BD8D5B9662047B1AEB12346CBA50FB0B5688A452DEBA6F4BCB124DB84596284410C03C757AD5FE2F4743D49A82E6337E2E14FFD07A8
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ..............>.9......e......>.9......e.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................f.pA.:.....L.....N...^...............?.+...AJ.lA............f........................................I.qk..B.....LZ...............f.pA.:.....L............f.pA.:.....L.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000012.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.1306711166735965
                            Encrypted:false
                            SSDEEP:48:psbYK0XAKHvtw+EEC/pXEt97WTojrdSr3IAdXUamQV:psl0XAivtEE8XEt9CTSRKDX
                            MD5:6200CB109F620184D67FA91A617632EF
                            SHA1:4B5C2777B12D7B3AD78AF58AB94BB3E00E1A47D0
                            SHA-256:FD2E91ED440A7F80506060DDBE6762D4EC3BDA139DAF914706DF41BC9766E1C9
                            SHA-512:B2721A5BED9E0D027A52B81728E5F87BC090244D40181A7B876FA18261CF909EF6BF8DF4D8F7953F294629A7BE5DAABC8B94FC89FE36631CCA932163D72324C4
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.x.......x..rc....g9....x..rc....g9....x...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............e!.l....&..~.@.....N...^...............@..Je:.G.0.$&D.........f........................................I.qk..B.....LZ.............e!.l....&..~.@..........e!.l....&..~.@...........x.......x.......x...........................................x.j.....x.T.]...x.......x...B...x.H.....x...B...x...>.).x...J...................;........4...4...4.."...............x...x...x...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........x.......x.....#.x.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000013.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.117354994420598
                            Encrypted:false
                            SSDEEP:96:97svlR6XQaLiwE25XM9/KTaRKgXRWJqcA:97svlR6XQaeNeXM9/K2RKgXRWJqc
                            MD5:9FE1018E65231F2D39A5FCF9D0158B45
                            SHA1:72AF01BCDD3CD5AB759A4C693C2D0246F33CAF11
                            SHA-256:D789E3372B776F5921B2F9B16FB5D20CB2EE1289B3918CF1B1E7AAD6887806BC
                            SHA-512:EA1989419D6C68219C8E442D5048F788C8F508E700D80EA7C202008A3BAC7A3908B6EC87C7A25A92BEECF5107CEE68ADC68C275A4A5F3E45A5EB141CBD152A2F
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZI6y.....I6y....$.,...0I6y....$.,...0I6y..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................(...4J..a.D.....N...^...............Q.2..16E..W...*........f........................................I.qk..B.....LZ................(...4J..a.D.............(...4J..a.D..........I6y.....I6y.....I6y.........................................I6yj....I6yT.]..I6y.....I6y..B..I6yH....I6y..B..I6y..>.)I6y..J...................;........4...4...4.."..............I6y.I6y.I6y..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........I6y.....I6y....#I6y............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000014.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.151101875948801
                            Encrypted:false
                            SSDEEP:48:1vsbDGYLAgAQtfm2UqY8EG9CCZXX89oEkToY6rdSrlICdXm6zLCtzqwAB:psCgAQs2m8EiHX89oRTQRKD9
                            MD5:0D6988DDDB103795CB2D8E9105FE209C
                            SHA1:C9797E162B6D24E91117F574D0D0A91E061032E6
                            SHA-256:D3AA72E85116A6344B15D4BDDAA041CB4E04EB5248D9EB53100CBAEB72BFFA3F
                            SHA-512:5D58AA0CAEA7810C27793001E33C1FF2C02ABA2260A935045351B515922ACF4C5393D8998829F8130FCB691981768DF57CAF2FFF5B874E0456302B84D6CE7048
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZy.......y....`..-.:}&a.6y....`..-.:}&a.6y....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............@.I=.D.=A._#.......N...^.................d.iY.N.w...p6........f........................................I.qk..B.....LZ.............@.I=.D.=A._#............@.I=.D.=A._#............y.......y.......y...........................................y..j....y..T.]..y.......y...B..y..H....y....B..y....>.)y....J...................;........4...4...4.."..............y...y...y....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........y.......y......#y..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000015.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.133911225776184
                            Encrypted:false
                            SSDEEP:48:kmPsPGLAN3jP5tUmEnpDCZPmXO/9BF/ToIrdSrtIFdXbCYopGRsgnrYBPd3:1sNRjP5BE1NXO/9PT5RKwxsgk
                            MD5:1BAAF256047F69B2D912A8B638EE4BE9
                            SHA1:822B2260C16B924C7F9CB46EA1D0C8C09E6D3CD7
                            SHA-256:63C448A108E3AE7A35D9D38FCF6C555D1EF2C058C6E4F6CAEA090F564BC0FE63
                            SHA-512:FC248C0A6096F063F3279F6F7FFF4EDD022F4EF4CEC4EB13BE844EC32443C247018EBE598D1B9F0F05B4DD3BEBA3E2A7250AE3EC6C22B7DFE4B4EB0B8BAE832D
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.l.......l....$.6"..*z.j.l....$.6"..*z.j.l...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............%.L >..!.....u2....N...^.................U...G...H%...........f........................................I.qk..B.....LZ.............%.L >..!.....u2.........%.L >..!.....u2..........l.......l.......l...........................................l.j.....l.T.]...l.......l...B...l.H.....l...B...l...>.).l...J...................;........4...4...4.."...............l...l...l...z...y.. x.. ...........$........4......7...7........................;........4...4...4..........l.......l.....#.l.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000016.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.121582735666145
                            Encrypted:false
                            SSDEEP:96:y0sRlo9Q6g3bChEmnX895JT9RKreoZ5II7G:BsP6gr/YX89zBRKr
                            MD5:3B68E67568F8C0439CEBDAE544DB1D4C
                            SHA1:68E23EE1EF53612F3E8C2C20B15B735DC5289F57
                            SHA-256:468DFCE8F1051441FA72A3C348DBA24EE0E1B80EB193B5A2D4D2F24B08A984F8
                            SHA-512:921141B287FD8E4CD22302528E975F8BEBA7DC52D68027DB75F8620DC1368ACA9D07EC39BDE5C6A128EB63CEEB1E01F2E8C07131D6C8ED0103FDD9D5099DD99A
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.Wi......Wi....%9]a.q)v.Wi....%9]a.q)v.Wi..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'......................w..Y.(.....N...^...............&.a.n#.@.B...l..........f........................................I.qk..B.....LZ.....................w..Y.(..................w..Y.(...........Wi......Wi......Wi..........................................Wij.....WiT.]...Wi......Wi..B...WiH.....Wi..B...Wi..>.).Wi..J...................;........4...4...4.."...............Wi..Wi..Wi..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........Wi......Wi....#.Wi............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000017.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.112712423064446
                            Encrypted:false
                            SSDEEP:48:K0sYWRJWintG3PgElCC58XPw9EJCwL5u5TofrdSrGIUdXggib0Q5aStFit1HH:K0sBJWinooElC3XPw9PwLI5TSRKc1
                            MD5:4AEA43EE35F5C0EBBB171EB2BC25154E
                            SHA1:CAE9A1E51FA45121367129CB9B03E75F93184CE3
                            SHA-256:B5532F7C774935B51D3B2E39518D986DA8C62D60B1EBBDB40A822AF45955C480
                            SHA-512:47BBBF940FD159F8724EEA715238394EF7B845D836C557921BA4E1D68E8C395724394CC06D93C7B2578DA9465D00177067B8B91ED69B08D38D3CFE74CEB717B5
                            Malicious:false
                            Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZe.p.....e.pS.)..&Q]{qu0;e.pS.)..&Q]{qu0;e.p..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............=..#!.(J.z.}......N...^..................g.K{K. ...W0j........f........................................I.qk..B.....LZ.............=..#!.(J.z.}...........=..#!.(J.z.}...........e.p.....e.p.....e.p.........................................e.pj....e.pT.]..e.p.....e.p..B..e.pH....e.p..B..e.p..>.)e.p..J...................;........4...4...4.."..............e.p.e.p.e.p..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........e.p.....e.p....#e.p............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000018.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):3.9830304620256785
                            Encrypted:false
                            SSDEEP:48:KssVVPIEO78kS7ZCw8tZY8E6tiC+GTXg9+nTo8trdSrbIYkdXDh6y0QQavDmnJ6W:Kssz9O78r789E6c7MXg9ATZRKGCci
                            MD5:FAF0DE05BE8B93670C8B640D7985E841
                            SHA1:7F1E72ECE41EE2BFD711A9169A1BD36AC3AA8554
                            SHA-256:7F1B5A5FACFF2B3C5A62CDC2FD8E5170A1159BBD4C49858F8598C0D7204142A1
                            SHA-512:A4331A697E7034C6496C295F75E0800E05AFC0A602AF2355198F9B5812D0174AA20FB96446F94D0CF10DC2539D536DDA038A9F4459DAEDD72D6961BC9515EA36
                            Malicious:false
                            Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZ.............r...S.7i.a......r...S.7i.a......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............#..t...9h.]~......N...^.............../F..>..A.t.J..M.........f........................................I.qk..B.....LZ.............#..t...9h.]~...........#..t...9h.]~..........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000019.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.113704362088093
                            Encrypted:false
                            SSDEEP:48:QTsNpf/UolitAaiEIWCCYyXw9Hgj8ToRrdSruEEI2dXCX7NJvl:QTsD/UoliihEPJXw9HgQToRKubsnv
                            MD5:3CC2AA3D4D8072F2832777932385631D
                            SHA1:927DA5B8ED2AA37CD514BCCA3C8765B59C58DE5A
                            SHA-256:A3ED2489393F306C4A5DF67953C6DCC601DE6F60E953082BD03FA3F092793C83
                            SHA-512:E8396C19700EC62E36AE960ADB736AC77A35D013690F31A0250CF4D879B748CDB1535521AADC100D33E788D9E99C7B83F4F0C37ABBAE34C5398F621CBD977C46
                            Malicious:false
                            Preview:2...>...........v..."...................................................................................................................................2...>...........v...V............................I.......I.qk..B.....LZv.......v..Wpb..8.K.."yv..Wpb..8.K.."yv....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............^ai........"f|......N...^...............I..bJ..C...,l(..........f........................................I.qk..B.....LZ............^ai........"f|..........^ai........"f|...........v.......v.......v...........................................v..j....v..T.]..v.......v....B..v..H....v....B..v....>.)v....J...................;........4...4...4.."..............v...v...v....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........v.......v......#v..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001A.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.068046132870941
                            Encrypted:false
                            SSDEEP:48:82stYI5itYDOEVC/OoXno9vxTomrdSr+ITdXhaT0tQF:Fs/5i8OEVLoXno9pT7RKjo/
                            MD5:DEBB0C0C2747C68610F419353335E06E
                            SHA1:E7768FDFF89F2449D696AEB925DB3EA3E4CD47EF
                            SHA-256:B125D91251898B819441CCCEDEDD5CD705A33D3651A8818C45C7EF2646612724
                            SHA-512:BE5E48CC5B6043CEB965BE8CADB0A8683E469BE78C1785DA8CB5BB2C231F12FF966DCF98F5AD0382FD816C330FC9F4B4B903494D90205233210147C7C69D6502
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ?.6.....?.6......G.....G?.6......G.....G?.6..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............^.Q.y$..#zo5R:gI....N...^................I..B.I..qW............f........................................I.qk..B.....LZ............^.Q.y$..#zo5R:gI........^.Q.y$..#zo5R:gI.........?.6.....?.6.....?.6.........................................?.6j....?.6T.]..?.6.....?.6..B..?.6H....?.6..B..?.6..>.)?.6..J...................;........4...4...4.."..............?.6.?.6.?.6..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........?.6.....?.6....#?.6............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001B.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.136838558611529
                            Encrypted:false
                            SSDEEP:96:81osrzbOWkEsWM7KX9K9H2zWTZRKABKwuE7wRfx:81osrzb5x87KX9K9H2zW9RKABKwuE7w/
                            MD5:531C3961903B6C868FA851E003DCF613
                            SHA1:579AFBC4FA307159C22B7C528FDF49C7905D1D80
                            SHA-256:5B395F551AF9C46C200C2E584BE0123CEFF2A15F98B342EBA73F33F779B74EF5
                            SHA-512:0264C7B087B84D95660AB5903B3CAF64CF68124ACAEA8199BD219B1F9F6ABE36A8D444D58EFDE5A3BE8462B7572CF5833441AA792964AE8C975E8C4397F58679
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ...........U..>./...#V....U..>./...#V......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................+....<Z.e.o},....N...^...............'...<./G.....~.........f........................................I.qk..B.....LZ...............+....<Z.e.o},...........+....<Z.e.o},........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001C.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.1033366560725275
                            Encrypted:false
                            SSDEEP:96:O0sqVst6tUPiiER3ciXw9YTgRKTmot2G+IW:O0sqqt6tU6PxTXw9YcRK6ot2G+I
                            MD5:D9A1A06F1BAC70F9D438EAC640CB4DC1
                            SHA1:D4748C83B6EECD07C08E2FDAE8051E669F5B3230
                            SHA-256:DF30E015B09041B18A2808562BD7D695F54B3315C69993D00256791E8871E4B9
                            SHA-512:277810C3773C5DEAFB5EF746B50A377DC22D97536C26049C29C78BD6FFD185F26DE1606C4B8F28A9913D40E810D9E7D9E187F2091156683B6E37F43674CEC1CC
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ.oW......oW.....+.Y......oW.....+.Y......oW..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............T.$...x..ur.nEE.....N...^...............u..... N..N.............f........................................I.qk..B.....LZ............T.$...x..ur.nEE.........T.$...x..ur.nEE...........oW......oW......oW..........................................oWj.....oWT.]...oW......oW..B...oWH.....oW..B...oW..>.).oW..J...................;........4...4...4.."...............oW..oW..oW..z...y.. x.. ...........$........4......7...7........................;........4...4...4..........oW......oW....#.oW............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001D.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.12469372014053
                            Encrypted:false
                            SSDEEP:48:gashTIAh1LrSh0tADYTKeENAIWCp2hlXs9PnLl0TobrdSrssI4dXQm5hK35SoW9:ls3uyCD4ENA1s2bXs9PLl0TmRKsSn
                            MD5:B9B2760B32E884ABE890048E07391F75
                            SHA1:1921084A1630EB97ACFFE9F2BFA6A4F20117E4E0
                            SHA-256:7C8D0114F994532EEC8EEAD39316F18182485BE2AE4DE0D106BD5CB57412141D
                            SHA-512:51649487C33D9EEB662EE9F90FA21063A3CABD554664ACB4A06A5879193218E86924E5B810DA07BC02CE0FDF0BF0196A6610E3D0D0D92119B943DC88F434F2AC
                            Malicious:false
                            Preview:2...>.......*...v.......................................................................................................................................2...>...........v...R............................I.......I.qk..B.....LZ<n|.....<n|..G.....g..H)<n|..G.....g..H)<n|..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............zC.O...0>.E.L.j....N...^.................v.5.zH....~..*........f........................................I.qk..B.....LZ.............zC.O...0>.E.L.j.........zC.O...0>.E.L.j.........<n|.....<n|.....<n|.........................................<n|j....<n|T.]..<n|.....<n|..B..<n|H....<n|..B..<n|..>.)<n|..J...................;........4...4...4.."..............<n|.<n|.<n|..z...y.. x.. ...........$........4......7...7........................;........4...4...4.........<n|.....<n|....#<n|............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001E.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.036312874882139
                            Encrypted:false
                            SSDEEP:96:KMs8G21XXak2swEyr6Xo9PTARKTGHXat2EZI:7s851XKk/yOXo9PkRKTGHXat2ES
                            MD5:CB5751608546B85F83746AC2C2B3F9AE
                            SHA1:0AF8EC9B5C14A699C6685268C9D42E373D597B5D
                            SHA-256:1188F215DAA171F0D1AE8D00F9CB04A965F997B6C130946EB365F98ED0946EFA
                            SHA-512:CCE6B31A893F7AE37898C9EFA7ACCA8753913E0BBCBDFE55828A78336C50E599A69DE915A8CE36D4E8A7092CE331D21C675F47393F195A09D8E05ADE78894996
                            Malicious:false
                            Preview:2...>.......,...v... ...................................................................................................................................2...>...........v...T............................I.......I.qk..B.....LZk.......k..3..P.'.....k..3..P.'.....k....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............e...ze .....:..+....N...^.................I.ne.E.n .[..5........f........................................I.qk..B.....LZ............e...ze .....:..+........e...ze .....:..+.........k.......k.......k...........................................k..j....k..T.]..k.......k....B..k..H....k....B..k....>.)k....J...................;........4...4...4.."..............k...k...k....z...y.. x.. ...........$........4......7...7........................;........4...4...4.........k.......k......#k..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001F.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.118506339984326
                            Encrypted:false
                            SSDEEP:48:FZMssHRog2TG42wbt3sEJlCDcXHEmk9HR/G5mTodrdSrdIv2dX2GISmVAZTTFI5R:FZMssxpw2wbGEX1Xm9BmmTgRKDvjBUh
                            MD5:B1D77D3674CE9B573DC5CD41AAA27A36
                            SHA1:8D5A3EA8BD8AA262E9A456760212396F77F9FCF1
                            SHA-256:B37E0C2555E8D2F76A1E7F27DB960849846E339393CC03510CAEE5AE782C5A9E
                            SHA-512:D2E8914E8144BBBAF34D0846FABDA6DB332618ED31BACEC86F55DD4606F1A3CCD3369D3FBF3CED3A2F89991EA35A55BDAFF4F6B33CFB967E0D1D20DC1F42C11A
                            Malicious:false
                            Preview:2...>.......(...v.......................................................................................................................................2...>...........v...P............................I.......I.qk..B.....LZ............ .#.6.?/.j#.... .#.6.?/.j#.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Ma|M_.....a....l....N...^...............C...v..B...D.dB.........f........................................I.qk..B.....LZ............Ma|M_.....a....l........Ma|M_.....a....l........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4......7...7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001G.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):8192
                            Entropy (8bit):3.598326095112602
                            Encrypted:false
                            SSDEEP:96:ZDMGVKQLC0kEqArjkE8EG4ImEVjc4IrH4IAXqxNbNs+kj:uwKQnq8tZODVjUrXtxNbNs+kj
                            MD5:F08419C341F3608BA1F1420FE280F321
                            SHA1:A6570101904EF747D4CD1DA8BE88731258855169
                            SHA-256:324716FC20FBC632D3A998FD02AC7A1E864AD55DBDC5B4C50A50F811D26B9D90
                            SHA-512:66CE88FD45AB1598597429D76A36CC407C64B8D4B4038FA1A91ED082A1CE4B1BB2015ACDE1B984618C7CC52DF3D8EA18F75E2E9EA676E07B62FE22D06756D109
                            Malicious:false
                            Preview:\...8...................................................................................................................................................\...8...............0...........................z9......z9..!.".!.|...q.N.......N....ZA...lW.X}....D./.-.,B........c~..l.'...V!...ac~...:.M.p..9.....W..:............:.......:.................................................7VB.....7VB..EPJ..w.`.).:.......:.M.p..9.....W.2...........^...............\...N.....(.R.<.7VB.....c~...:.......N..T.v....(T)...R.<T....7VBT.2..c..T)S...:...J...:..."...:...j......R.<.....c~...c..,0...e...B4.$...........GP..A..}.....J......................W.......W!h~7....k.!.............D./.-.,B.......s....a..D......z9..!.".!.|...q.z9..c...XSW@....@..'c.......>.......l.......c~..l.'...V!...a.......&.N...m.N....ZA...lW.X...........0...........e....4.............."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w.......B.^....F...r.QH.....(...........(..."...P.r.o.j.e.c.t. .O.v.e.r.v.i.e.w...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001H.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):20480
                            Entropy (8bit):4.613151176441738
                            Encrypted:false
                            SSDEEP:384:t5HRovUvugf3uQuivau4uRtMDfBIYuuZe7CVraRMo7EzDZbqNp72TgSIDfY6e:t5H+vUvugf3uQuMa3uRWDfiYugeWVrm6
                            MD5:28B8A679B4AB5B99F89685DEB82D5955
                            SHA1:2B5797553961177485135F4F0F8A6AFD17DDA816
                            SHA-256:7FC7EA9E0F30D4E1E5741D3CFED69D075F194C26856211A58269BD19B4A6B2B5
                            SHA-512:2099A697553D29799037B1D63FCF551E7AF1CD9C51245B4CA52AC8BAA83410E82AB28BFDB1BCF1336EC29BB0BC9E07778356D8F7E2CEF8541480DA326CEBE171
                            Malicious:false
                            Preview:....>...........v........@..( ..`J..........>...t...8...v........H..( ..PI..................................................................................>...........v........I..( ...I...............I.......I.qk..B.....LZF.......F...9=..9.1....D/f(@.g.!b.a....D/f.F...9=..9.1....F....I.qk..B.....LZ.I............I.......I...................................................I.t.....I................................................................4..'...'................=......}.i.N.....N...^...............g.n...NI....hj..............J...............................4....I.qk..B.....LZ...............=......}.i.N..................................F.......F.......F...........................................D/f(.6..D/f(.z..D/f ....D/f$....D/f ....D/f(.5..D/f ....D/f$........F..3F..8F....z...y.. x.. ...........$........!..7!..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.3..............Z4...........................................4../4......p...............C.a.l.i.b.r.i.....

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001I.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                            Category:dropped
                            Size (bytes):22203
                            Entropy (8bit):6.977175130747846
                            Encrypted:false
                            SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                            MD5:2D3128554F6286809B2C8E99DE5FD3F6
                            SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                            SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                            SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                            Malicious:false
                            Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001J.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):8192
                            Entropy (8bit):3.9685355362940453
                            Encrypted:false
                            SSDEEP:192:jsCAEoZ7coP20XhSXTR/MxkOOpsrB9kHnKGXq:Y7rNcoP22hSDR/eOpsrrkHKG
                            MD5:5525343432AD411AEEDFDD733A981BFA
                            SHA1:5FEB54DAFBF55953DA3173D5416C01D44F267012
                            SHA-256:28288E656B6B1A94C4DFB6AF0ED786C0A69ADAE00778ED162A348660C3C2802F
                            SHA-512:F24ACD64722D8A5B362E02F79CFA1CE9A107427EA1E5C0B6B575053427B451B6D9A4C9C1232BB25EBDA166C2173DC265FD938D6E98859CC198FB70B1E29E0465
                            Malicious:false
                            Preview:2...>...........v.......................................................................................................................................2...>.......Z...v...&............................I.......I.qk..B.....LZA.<.)...A.<.h[....q.9...A.<.h[....q.9...A.<..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............\..$.5.%.W......N...^................T..c.I.5.t.D.5.................................................I.qk..B.....LZ..............\..$.5.%.W............\..$.5.%.W...........A.<.....A.<.....A.<.........................................A.<j.h..A.<T)...A.<.....A.<..L..A.<H.]..A.<.....A.<..H..A.<..}.......Z4...........................................4../4......p...............C.a.l.i.b.r.i..................A.<.A.<.A.<..z...y.. x.. ...........$........4...!..7!..7...............A.<:A.<FA.<GA.<..z...y.. x.. ...........$..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001K.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):52945
                            Entropy (8bit):7.6490972666456765
                            Encrypted:false
                            SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                            MD5:AD003F032F32FAC4672D4CE237FA5C5B
                            SHA1:AE234931B452F0D649D91291763B919CF350EA49
                            SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                            SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001L.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):3.542671804323532
                            Encrypted:false
                            SSDEEP:192:Cs5tj431n5NTjD19X1VkUOuRtIuTnnGcmHh01np4hU9c1j5MNmYwEm:P4FzTjD1lbkjuRtFn8K1np4h4c1j6L
                            MD5:A1BE90F04EB800E7B5B832AF05E197ED
                            SHA1:26EBB1C9E44138A89B505AAF2D6AEA91DABE3FED
                            SHA-256:B5B2742C3F837EC63BE02710EAB14C0F41230C18551D9307E2E10BCC4D1DEF67
                            SHA-512:696990D0776864AF5E45ACC7DC58CC080A2F8C6F9C705752706DF41C48DAAE0C02BC3E83531FF6426200FC5168BC3A3625B0BFCE90153E3386DDEDEA9929EC04
                            Malicious:false
                            Preview:2...>...........v.......................................................................................................................................2...>.......@...v................................I.......I.qk..B.....LZ].B.9...].B...e...`.,^..].B...e...`.,^..].B..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............cX....5D...H.....N...^.................Z...bL....-s..............................................r....I.qk..B.....LZ............cX....5D...H.........cX....5D...H..........].B.....].B.....].B.........................................].Bj....].BT.H..].B.....].B..\..].BH....].B..3..].B..O..].B..........Z4...........................................4../4......p...............C.a.l.i.b.r.i..................].B.].B.].B..z...y.. x.. ...........$........4...!..7!..7...............].B:].BF].B..z...y.. x.. ...........$......

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001M.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):25622
                            Entropy (8bit):7.058784902089801
                            Encrypted:false
                            SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                            MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                            SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                            SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                            SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001N.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):20480
                            Entropy (8bit):3.20069934160581
                            Encrypted:false
                            SSDEEP:384:i0SsxWYNIeOagIu9rSEGKFRSO1aualK4A2y6XnAMvbMR5:iRsxrNIMgIu9rbGKFRj4ualHA2y6Xn
                            MD5:7A9F8F816B379E93409A36A8A281DCF3
                            SHA1:6FBEAADA06AA6C3D2F502D544B2C586D9062C245
                            SHA-256:09656975C7CE1788A332DA8F4B7FED8B163530C0045C3427AD9042A81E1DEBB5
                            SHA-512:C634842C6646CA2EE3942F65B0B743C946117A9789146F2CF8D5AC3857418620E8304B6535A3FB3E8E2D13122D7E21684DC4FB7E4901FB60BD4612E0C72C7E5E
                            Malicious:false
                            Preview:2...>...........v.......0 .../......Z......,7.>?9m.........Z......,7.>?9m......I.qk..B.....LZ................................2...>.......B...v........-..............v........-..8....................I.......I.qk..B.....LZW...T...W....q..<....'..W....q..<....'..W....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............Z......,7.>?9m.....N...^...............Z_...,H..[q...........................Z......,7.>?9m.........Z_...,H..[q...............Z......,7.>?9m..................................W.......W.......W...........................................W..j.e..W..T....W.......W.....W....a..W.......W.......W.. .H.......z.......R...................!..7......}.....W.i.n.g.d.i.n.g.s. .3.......................Z4...........................................4../4......p...............C.a.l.i.b.r.i..................W....z... ..$..............

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001O.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):15740
                            Entropy (8bit):6.0674556182683945
                            Encrypted:false
                            SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                            MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                            SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                            SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                            SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001P.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):3.770362095517941
                            Encrypted:false
                            SSDEEP:192:FseYmVqr0rWPBWR9qXIsTbzRtEdHyfeXxealC4XtVN9JpEWMeDFm6EFxK:6eY+s0rW0AIibzRtIHyGXnTXtVPJpE8/
                            MD5:3DE98E165475D2689FD2B8B6AED00510
                            SHA1:1DE5871489F0857506DB943664F0CF946DF4EDEA
                            SHA-256:A6F15B0E0B44FC3BDFEE2B3CFB12C44026E8FC7FF03EEFAA2186715394008F1F
                            SHA-512:C84D8381AE4D471BE8503C460B06D0DF8DE72F13A347051368DF7EAB449F56D60B58EE8D21B81410EAEEBDC3FC811E1E577EF7B749394FBA38ED32003EB4573D
                            Malicious:false
                            Preview:2...>...x.......v........ ..`!..2...>...........v.......@................................................................................................................................................I.......I.qk..B.....LZ....9...........+..k..........+..k.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............T{6..).3...U.......N...^.................x..M..A.....................................................I.qk..B.....LZ.............T{6..).3...U...................................................................................................j.......T.Q...............n.....H.........9.......V...............Z4...........................................4../4......p...............C.a.l.i.b.r.i...............................z...y.. x.. ...........$........4...!..7!..7..............'...%.........z...,4. ...........$>........4

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001Q.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):55804
                            Entropy (8bit):7.433623355028275
                            Encrypted:false
                            SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                            MD5:4126992F65FE53D3E3E78F6B27FD49DC
                            SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                            SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                            SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001R.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):4.6362755485038285
                            Encrypted:false
                            SSDEEP:192:tgsQgVZTGpJG9xIAJwKujsqoCUvK2Fs/Hcw58mX/nNmyhIRtYQAed5GyC7gg9Koo:/Q0ZTGpJGnIAfuoqoCPosvcw240RtFAf
                            MD5:6E0E948A0DB93D9B743C97238AE904A0
                            SHA1:D61EE811E0DEB674116737B81A4B6187CF591699
                            SHA-256:A7D2ACF6C3C817FE433CB13F37FB96D4247B55D6E6EAA92BEC96777C1CAC8581
                            SHA-512:65704B877D360395A092B6B11F110AA6C1AC03986209B37D6BCB797CB57373D91ED24C5CBE305973D33A89458531CC6532F0F8BA13BFA3E86D693FF2FCBA9226
                            Malicious:false
                            Preview:....>.......>...v.......0 ..h+......>...........v...Z...@...X*...........................................................................................................................................I.......I.qk..B.....LZ.".......".7z...>>7Y.=u..".7z...>>7Y.=u'."...I.qk..B.....LZ.I..7+....M..a.(~..7+............I.......I...................................................I.t.....I................................................................4..'...'.............^ca.C..@.jW..ad.....N...^................V0C.|.O.d@>. xA.................................................I.qk..B.....LZ............^ca.C..@.jW..ad..................................."......."......."..........................................7+...|..7+.(....7+.(.z...".j.N...".T)...."......."...b...". .......'.".8."...z...,4. ...."......$>........4.."..7......A.g.e.n.d.a.:.........................Z4...........................................4../4......p...............C.a.l.i.b.r.i..................."..."..."...z...y.. x.. ..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001S.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):41893
                            Entropy (8bit):7.52654558351485
                            Encrypted:false
                            SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                            MD5:F25427EFECFEE786D5A9F630726DD140
                            SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                            SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                            SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001T.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):4.578266489601026
                            Encrypted:false
                            SSDEEP:192:nsumH2sXBF9f4/+Yd0xwdUJYTwGUCDehGHhQoXjoG/U6RtkGSx/B5nWRUkY99hax:sCsXBHA/+YdZUJsLFDehmhH7vRtAx//u
                            MD5:A2B69833CBEFE33A9CA755A9234E7458
                            SHA1:0E9A68388C8ADB612188C7EEC6E80A288F0D049D
                            SHA-256:DDA4477CE020C309CA88AC202E8DFD6FAE89EF567381512ECF6FA46B5EED952E
                            SHA-512:A49179F72E062B44876D73392BDDA0B46E3E51E3C8F0F173AF6F2C5DF5BF450EAF7475578D91217D445D4C8A686ED31EBCE54412CF27A3906FD4D904429B315E
                            Malicious:false
                            Preview:2...>.......,...v....... .. +..2...>.......|...v...H...@....*...........................................................................................................................................I.......I.qk..B.....LZ2L[.G...2L[g..<..6......2L[g..<..6......2L[..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'......................@..T.....N...^...............0=b.R..H.._....I........V...x....................................I.qk..B.....LZ.....................@..T..................................2L[.....2L[.....2L[.........................................2L[j.A..2L[T....2L[.....2L[..r..2L[.....2L[ .7..2L[.....2L[ .........Z4...........................................4../4......p...............C.a.l.i.b.r.i..................2L[.2L[.2L[..z...y.. x.. ...........$........4...!..7!..7...............2L[;2L[.2L[..z...y.. x.. ...........$......

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001U.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):14177
                            Entropy (8bit):5.705782002886174
                            Encrypted:false
                            SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                            MD5:7CDCE7EEBF795998DA6CAC11D363291C
                            SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                            SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                            SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000001V.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):49152
                            Entropy (8bit):4.675179960179007
                            Encrypted:false
                            SSDEEP:384:vKog3lXN2puViGR+Rkp/AmbfQ8JLvpB0EPx8cK0bU1u8NY6lQs8A8AXMRZ6M7oxf:axN2vGftFBMNBlGJKvM36b
                            MD5:78BFF816F891389B28021C9F8036332A
                            SHA1:67E1C18238DD0AEE87409831571A19C6522EE372
                            SHA-256:604F2384FC21BF7FB010BFA8DA9473D1FF675BEDC3A9939D3ABD998F434C5EB4
                            SHA-512:1DFCEBA1474871AB20C694DC996703A09F2013DCD8FD24E666C84431DC70EC4F1402940FDE6385B47718F1F909C5571AFCA23C89C9F93AB2B475818961EBB9AF
                            Malicious:false
                            Preview:....&...2&.......%..J&...... ..H@...a..H...........&....%.......%..f&...... ..H@...a......................................................................&....%.......%......... ..H@...a..h........?.......?....'H...^GQt.i.......i..../....a.(>....g)".............jKA...d.+..(>...jKA..QI..Hx.:...S.QI............X.......X..................................................?.T%......T.1..0..T....8..T.......T.$.....T.......T%...N.HT"............0...........e....4........................u.^s.Q.@.).~b.......(...@kO.....(..."...P.l.a.i.n. .a.n.d. .S.i.m.p.l.e...j...P.a.g.e.L.o.c.I.D...L.o.c.V.e.r...P.a.g.e.V.e.r.C.o.m.m.e.n.t...P.a.g.e.O.v.e.r.i.d.e...P.a.g.e.N.a.m.e...2...0.0.0.5.2...1.....0...U.n.t.i.t.l.e.d. .p.a.g.e.........#.......#....{..%y..??k................F...7..s.2...........2....................?......8...........%5..Gb#...................i...c..,0...e...B4.$........{p.....G...^...?@kO.....................Y.......Yq2.MM.o.v...+-3c.....-3c].e...u%.0Z..#`...`.. ..X..Q#`..*<A.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000020.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.34319553617969
                            Encrypted:false
                            SSDEEP:48:4sv19KFFoSTDYtxoz73E8oieX0/W9k1uvcrrdhSry3iGtXVWC49SoV:4sDsom80TE8WX0/W9xvGRApGu
                            MD5:7E13FEF725C21A97534299700AA95116
                            SHA1:348905EA6458949E0A74BB2703B2669C2937E55F
                            SHA-256:61E27C51C9817084CF386C8892F9C6484E8E03B756D3B2E28A67C72DF61F9AE0
                            SHA-512:5DBC4CA157067316ED8FB95A818BE0171300CB20358FE7107BC833BF89304897E32E8A5BCB1A947DC0E40946852186351DBA14F8F9C24E24192B939DCBBC95CF
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ................aV...........aV........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............A.-TL...f..........N...^...................l.LH.p..k..........f........................................I.qk..B.....LZ.............A.-TL...f...............A.-TL...f..............................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000021.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 814x105, components 3
                            Category:dropped
                            Size (bytes):12654
                            Entropy (8bit):7.745439197485533
                            Encrypted:false
                            SSDEEP:384:JheN2cq6MLu6MLGu54cHeNzhcmhcDu53eNE3UPkhrxvu:Ji2Wix7fzVsbE3Zm
                            MD5:4BCCCDBB4273ECEBE216C84930A8D0B2
                            SHA1:FFBF617787E27BC94D9BAF89F2FE34A2BD42794B
                            SHA-256:474F9A8C25D5E21192315397EA995B1E11E2C1608157C6E0277688091BFD136A
                            SHA-512:DAD73A8C0E293B88685C0C71EF15E0DC95EE39B7FC9F849DE5D634173FD9FA0AF0AA96742D9E94BE03556AA4A817D5001C95A6736EAD5D5DF03661876785EB74
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................................................C.......................................................................i..............................................E.....................U....V...f..ASTc.......de.1Qq...!Rb....Ca."r.................................B....................b....Ra.....!Qc.....AS.1U.."C...2Bq...$#3%&.............?......3.....~......:..g..s"......:..g..s"..ic..Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. ..0...Q_..X..V5E~..c..X...@u...cTW...0...Q_..;.m.....@w...Q.+....*.4W...lUFh....v..._..wn...dW....y._..v..E~...*...@wn...dW....y._...v..U..@wn...d..{`;.|U.2g...*.3...:.0?ViN.z.@w...4.M.:m..`~..i7...q...I....J.`l...W..n..PQTiB...6....+..sj.*."...6....+..WA...x..A........(.N6`..AD.q.....'S...t.Q:.l.......f.]..N..0.. .u8..A........_W..Y...}.C...~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~.v..?U..^.r..}..Bep

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000022.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.383271121480513
                            Encrypted:false
                            SSDEEP:96:ngsQBNdeQS2cojDxEpUX/49VzzWlRAVkLPIyQdqbEmQWwIyylyya:ngsq+d28pUXA9Vzz4RAuLPIyf7wIyyUT
                            MD5:4851B23E4733D69828BE4C89D641F314
                            SHA1:924C4DB915DE64FC4B1C120D6E3663B355D20C2C
                            SHA-256:D6C60544D88FBDE44B33C1502E486BDDF32FD9022D6DAD9BB10B4256BA576EEF
                            SHA-512:0AD9596A7C6FA597C2254832945E282B657F98AE48129AA6CBFF2C4F35AFF7FB608A2AD73B2CA597594BF2F9B91679510CA93E4C5A18709B9DCF6C291D24FB75
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ............/...N0.G|4...../...N0.G|4....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................X..+Q...6H.....N...^................u....H...6.nM........f........................................I.qk..B.....LZ.................X..+Q...6H..............X..+Q...6H.....................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4......................#..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000023.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 728x77, components 3
                            Category:dropped
                            Size (bytes):2695
                            Entropy (8bit):7.434963358385164
                            Encrypted:false
                            SSDEEP:48:N9YMsguOZgKAz2vcaQU4R8r4BU0/Rc4nbIQdsohw13ZmFLY6KsVvMdBL2mr:/hsEgNz2v5T/rQC67SoWniHK4EdBH
                            MD5:B23DE98D5B4AFC269ED7EBFDDECE9716
                            SHA1:10AF507A8079293A9AE0E3B96CF63A949B4588AA
                            SHA-256:646586CB71742A2369A529876B41AF6A472C35CC508D1AE5D8395D55784814F2
                            SHA-512:BBACBE205EC0A4F4E3AB7E2B1DEE36FCF087DDF77C7D18B53AEA4B15984A47C64E19F9B8D8FA568620619CEA0361D94FE7ABEA6E502EC6ECAEFE957F42ED7EE8
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......M....".......................................,.......................1....!ABQRq.2a."CbS.......................................................Qa1A............?....{............i........l..-D.q.~..|cS.S...R\..d.8,!.....]f$....Q..di.;~5......vj......MqCe..=.*.f^..=.}.Cm]qCd..s=..u.e..v..t'.,.....S.s..N...>.d4'.,..k...N...d..9....G...y....6J.Y.l.{Vf...^B..i.3.z....:5W#4@.S\fj.%..Mb.5.v.5......S.E..#.v.I.....I......m..H....D..|.Y|...W.Wf..o..U.0.E..@.T.....................................'.S../...Z......!J..1K..rI...T.f.>.+.N..o.....\..^u........e..q.qK.GXP..-...F8".;5J...]Y......j.a.,R.......J.N........z}<qu..J.)`.}X:..}.............B...[. ......,B.).b.......(Y.O....c\.o.e&.W.#Bo..N|..N8.#J.>1D.1..b.&....q.#..UT%,.d.....m&..^...VXA..b.nbTV~.....^........q..#./.I..=Q..=..Y.*.Ib...VZ+......Y.........'.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000024.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.377677294991255
                            Encrypted:false
                            SSDEEP:48:8s1mo4A6QBtjq0E/EQrSXhfS9NTcdrdhSrr7tXMA9TfJ:8sRv6uNrE/1rSXhfS9NTARAH5
                            MD5:C12223215F0F46DD4D2E8D580FED4B69
                            SHA1:02721D67387453F748502ABDF5C83622658991A1
                            SHA-256:E8C02671D4E9523872C09576B134FB05499CA8CDE02F587B49E631C9D2749E7C
                            SHA-512:C6B03A4D4AB89287DC96FD80E833A16629A0A348CAABAE20D762163CA34FABB7EEB4C2A692D6E18DF20D4234DF0F63EB620B1F92EFF29EAF0C339C3682827C43
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ...........Q........;K"....Q........;K"......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............6....N.,H5T../.....N...^...............:N.z.N.C.....().........f........................................I.qk..B.....LZ.............6....N.,H5T../..........6....N.,H5T../.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000025.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 69x630, components 3
                            Category:dropped
                            Size (bytes):11040
                            Entropy (8bit):7.929583162638891
                            Encrypted:false
                            SSDEEP:192:u99+91V42ho91V42ho91V42ho91V4235z9pUkDCyixxo4PS6b8tEy3BcWWhhSy0b:ubKD4/D4/D4/D4uzX38u4PNYJ2zhhmb
                            MD5:02775A1E41CF53AC771D820003903913
                            SHA1:2951A94A05ECF65E86D44C3C663B9B44BAD2BC9D
                            SHA-256:83245F217DEAE4A4143B565E13C045DBB32A9063E8C6B2E43BB15CD76C5F9219
                            SHA-512:5A1FCC24BDD5EE16BC2C9BACF45BCECF35ED895EAC22D2C4EE99C1B7E79C8E8B9E5186E3D026BA08FF70E08113F0A88FBF5E61C57AF4F3EA9BA80CE9F33410E9
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................................................C.......................................................................v.E.............................................S..........................Aa..!12Qqw.....3568rv........".....4Btu.....#Rs.(W..bg.................................D.....................1..2.!4Aqrs....Qa......t..."3BRb....#.$S.Cc..............?...K/h._+.N6.-.a...5...;.r....,...0B.s(..zp..4.%r|q..E.Q^.../...C.R..?u.q8XN.>.e..:..gJ...._.n>.70G,..(........3b.&.5m...Q../...7Ie..k....e.l6..&..`Gt.P.Y^r...=..Y.e...N.B...O.#..J+........u.V;G.'.....V.]8..C.]..........E.....c..w&lX..f..\T.J?...F.,..m|..93........,.....+.R..WG...%.....(@.....p].iEz<.8.^...J.h.....a8P.1......(z..y~.........H.Z^.>..<.....L.k..IG...R.(.%..m....&u...B|.....@]ey.W.J...!d..R.8...[..>8....(.G......!.)X.....,'..F2.Z.t..Aw./..Z..#..i.kK.......b.i...qR.(....RE.............O.XP.#..(...9J..]...,.2.[w....KrW'...tY.......{~.:.+..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000026.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.499438129475946
                            Encrypted:false
                            SSDEEP:96:+sSgK1b4tpzWEP3FxXq9+FcRLIQpKXPPQAF:+sSgK1b4tpn/LXq9+FcRLIQpKXPPQA
                            MD5:5001D0890E51384145C09F921C9B0B13
                            SHA1:5683D19335653068B4CC9AC1BAED5753B1915162
                            SHA-256:FCCC5168F827665FB0E3684D269CEFD016C1F6095F32F7257EB9C25EE73BB757
                            SHA-512:420A59DCFEEA846F4229677FFBEA971EC94E4759E51108A40036A014FFE3F1E681F2D4C3C150F2E33EF4759E55062B7E028735C2900BBBCC36F6B1453FA8C479
                            Malicious:false
                            Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v................................I.......I.qk..B.....LZ..R.......R...D..G........R...D..G........R..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............)....u.%V.-..[.....N...^...............b...3.-L...F*E$.........Z................................... ....I.qk..B.....LZ.............)....u.%V.-..[..........)....u.%V.-..[............R.......R.......R...........................................Rj......RT%c....R.......R..G....R..H....R..>....R.......R .3...................;........4...4...4.."................R...R...R..z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4...........R.......R....#..R............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000027.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 105x441, components 3
                            Category:dropped
                            Size (bytes):2268
                            Entropy (8bit):7.384274251000273
                            Encrypted:false
                            SSDEEP:48:N9YMn9H5gXlM26vroVXWxyNnl1LmLR+rn4FOeewGhDbby:/h9SlMdgm09ll8R2/rby
                            MD5:09A7AE94AA8E517298A9618A13D6E0E2
                            SHA1:FA5181A7414BA32F816BF0C4278EC20C615E8B1A
                            SHA-256:3C68C7EE798E62A4A99C740153F3980D7DF029605C843410942C7F85E794823B
                            SHA-512:074E9A2BE2039D0AFEAD360157550B934FABD0CB86B5AF476C1FBC885EE60331F5A68EAF70BF76E23C8248A20FB900346839F4AA8892370B5889E64948DCC6E2
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........i..".......................................3......................!.A..1Q."q.2BRa.b...#$................................... .......................!12AqQ.............?..D.z.4....;.....7...3.t<!..d.O.....+O+.;.z6.4cz7E.........U.Z)-..@..y...........}(W...<.xv/...5.ew......yN....n.Tk.Tm.Ty.vA=...T..U....h...e.8.5%....'......e^......L.g.$.~e..O.._...... .F`.....xnL.<.......]jfv...}..\G..c.......-%...#.C.|.].`..^..W..c..B..5D.QSTaZ.5A=....BU..z%.4.h.6..=..U...W.$..l...7.:...........IPQT_...~..i..x....~.l.|.n.J..TV.21.Tg.....................j.z!+.-............"j.j...)*..TT...."....T.Tc.**j..............j.z!*.h...&.&.&..e.%..TksTW%G.?".l+$..c._9..[x...TU..........i~X..#'.qm?ttO.....}*.i...q.....9..r..?..W..d.w...f;..q...tZh..0.....2.......OD%Q-.......$......56.K.O...y._..*_C.k..p9.p..O..vu...'........0v

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000028.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 76x97, components 3
                            Category:dropped
                            Size (bytes):784
                            Entropy (8bit):6.962539208465222
                            Encrypted:false
                            SSDEEP:12:869YM8fij0W/xfuCp7ovv1bidiMn3bGi6AETQcdH8SADjoZgV6v9jUEvS3/g:N9YMWeI424diMn3yinsQeHvADu9QEvJ
                            MD5:14105A831FE32590E52C2E2E41879624
                            SHA1:078FA63FC7DB5830E9059DF02D56882240429D90
                            SHA-256:D0A3A1C3CD63C4023FE5716CBE2C211307D0E277E444D9EF76C7FC097A845FD4
                            SHA-512:8FC0ED24E8EC14C46EA523D9265DE28F85C5FC57AA54AD5B9CA162E95F79221E2AD3DD67D1293CF756B67F3D3DECAE122254134EA8D4D00DDED02114B5383947
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......a.L..".......................................-........................!A."1.Qbq....2Ba.........................................................1............?.....3.Ty\......vs....>.>..a.W..s89.d...Z}......rz...`...Z.r.do....u.W.%....gf.>.L..xz....B8=w...g.~g."HD...$..IKJ......nn..*ly..I....L...\q...Q;6.KrxZ.,...j$..ZQ..)f...q`.*..C1..cZ2]-..\.~..J.....^..(.f..9m?..C.NI.UL..X.fy.Z.........+n....r."Z...d..R./\.#...kd.D.5.!...h.3*s-+.......Xjt..}i..rK..y.../>u..]N.....Y..J......1.x./.....F6.......I...._3...k.sM.+..v;.%|.f.~.......:y....S....UKovh...W'........lF... .................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000029.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):8192
                            Entropy (8bit):2.7284422447903127
                            Encrypted:false
                            SSDEEP:96:BspeQ7zVkBzxIMfWEBpvXz9ZOYPRQ5fK:BspeQyHIAXvXz9ZOYPRCf
                            MD5:0E3EE00EDCD8531449C10105CA28AA10
                            SHA1:0AF3B5B97D28FD369F8594FCC45D895A8AD5D2AC
                            SHA-256:E8A1118F5E2566B832142D23AF94D9B2B4C41CD31B73C3AB3462FFD84AEEA0EB
                            SHA-512:155E69C53B4DDB215C3D441ACFBEAD3E551A89065F3723BA7D6FC9A82524BF5E427313A7D736CF0E381DD4FEC534B91F84BB0A6891A9FAEA2A809B4AF7E96D55
                            Malicious:false
                            Preview:2...>...........v.......................................................................................................................................2...>...........v................................I.......I.qk..B.....LZ3.......3.......%..|jI,.3.......%..|jI,.3....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................>....7.6.^_.....N...^......................J.[.I.#.............................................^....I.qk..B.....LZ...............>....7.6.^_............>....7.6.^_..........3.......3.......3...........................................3..j....3..T.l..3.......3....Q..3....Q..3....>..3.......3.. .3...................;........4...4...4.."..............3...3...3....z...y.. x.. ...........$........4...(..7(..7........................;........4...4...4.........3.......3......#3..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002A.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 95x498, components 3
                            Category:dropped
                            Size (bytes):3009
                            Entropy (8bit):7.493528353751471
                            Encrypted:false
                            SSDEEP:48:aRCTf+0hagMrbAZMJShPdvF/5OzlQFlDF7npkDdWvVBTEnBLT6NrgCX0:D+0YgMrApL553JtEdEVcL2NcX
                            MD5:D9BD80D40B458EDB2A318F639561579A
                            SHA1:83BA01519F3C7C1525C2EA4C2D9B40F28B2F2E5E
                            SHA-256:509A6945FACFB3DDC7BE6EE8B82797AD0C72DB5755486EE878125A959CC09B59
                            SHA-512:C368499667028180A922DD015980C29865AEF4A890C83E87AE29F6A27DC323DD729E6FB1C34A2168A148E6A7A972F65A5FC8ACE6981AF1D4E7057D99681CB366
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666........_.........................................:.......................r.!12BQ...3Aaq.."CRb.....#4$c.S.....................................................1A............?..p..-.....u0$.......l......)..o.FTd..DG....... .t*e..jO..Z.U......r..j.O.,..VD./.....V5D.&......A..Zi....E.N....*..........#..M<|.2.Y.../QO.x.cTM4......+.F;V.x.de*....]e..O.x.c\Y........r..j.O.,..T...hw..k.^.[B..J.sEl.w.x.m.5%zzt0..T.......b..<\.3Q..W</..!.xh6..Z..\.+M.o.Y..1............#.........|.a.l.KR>..U......e....@...\.1Z...Y...[....F.6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....Uh....FkYm.m`P...W .V.g..FjVj.\..1Q6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002B.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 700x114, components 3
                            Category:dropped
                            Size (bytes):2266
                            Entropy (8bit):5.563021222358941
                            Encrypted:false
                            SSDEEP:24:TuRCTP9rSTfIEe1HbcVY1YbDXq8eCI0bf2QQe0GVDQAzZw:aRCTN7HbcW1YbDXq+I07Ien0AVw
                            MD5:DB8A181E3F0EAD4A9472099E42ED6BE3
                            SHA1:92096AF05CC6167B1AA816811A1160B809393FA2
                            SHA-256:E9746B4E9AE9CE7B3B0068779DB3E113E2DFC9880F25373D745D0E700E69A906
                            SHA-512:A9E246E10E28D057090BA9F034ECE6131780D7F794C5C9421523388997C7EDFBB49BC32B863B6C6668911B359C304AA54969B48CB9234950D5CECD2A6F3EFFF8
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666......r...........................................5.......................!1AQ..2a...."Rq..#3BSr..C..................................................................?...X.....U...j...F.W.V]'KV.uWt.iT...{.......`.(.....V%..=.....z......V..ct+.U.B...@.............................................{.....5.........0...x4....c..;...........+......|.7E.%.9.1+}..d.........+.V#.P.HUL.E...g.li...8.>U.";0pi.]5.\..zo..."@.........................................y.6.mLN..S.....@...i..A..p.......~|V9.+.Xy.........+,L.....7Z7..p...-X...\.....:-...i....v.1...-..H....9.zk....l....^.......:.."^.t.Q.F...X..B..$............................................a.%f&3..1.5+.X..'b7bwr.).e.x....!...H...aa_..kD...b..g..p..K^.k..qX.[,.........Q...U..x...YMvj...w..:k.....j.W.8..4....c.u.}m.....o.=@.......j.S.t.|.....5h.y.%.~...G

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002C.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.231203588237326
                            Encrypted:false
                            SSDEEP:96:YZs1lBrp8r8EsXlG9O4q5QRQy46mcO+o:isdrpysX49OV5QRJPrO
                            MD5:AAE2C94DE28E0CFAF0372EB5EEDEC169
                            SHA1:EF492F4014CFB3D7DB9CDCA2E550B6DC09943C20
                            SHA-256:A7DECF569F65E237DA6B2963619759C60082497D6DC387C6CF90BEA2B5705F5E
                            SHA-512:E3E2FF8A2949A9106D7059B2DC1104AE313B2A98444F635DAD0A4784E7C5882ED4CB9F4A230A242170317EC4B2AEB945B99864E0DAF9ADFF2E41692B78C5362F
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ..S.......S,..t.2.=G)C...S,..t.2.=G)C...S..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............j..w.$.............N...^................*J....G....R(|.........f........................................I.qk..B.....LZ.............j..w.$..................j..w.$....................S.......S.......S...........................................Sj......ST.]....S.......S..B....SH......S..B....S..>.)..S..J...................;........4...4...4.."................S...S...S..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........S.......S....#..S............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002D.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 813 x 99, 8-bit/color RGBA, non-interlaced
                            Category:dropped
                            Size (bytes):99293
                            Entropy (8bit):7.9690121496708555
                            Encrypted:false
                            SSDEEP:1536:Moq1jVORV5NO5xLCBaaNk4vhpCr1CH/DATOQlWvHMHojiaAMrxArLFRZPj19AWFz:eVEbouBaIk4T8uDGOQlVHvaAMkhDh95V
                            MD5:EA45266A770EEA27A24A5BB3BE688B14
                            SHA1:9F0B23B3C8EBA4FC3C521E875EF876FBE018F3C8
                            SHA-256:EDAD0F03E6FF99FEF9EF8E8B834CE74F26CD23C5F8C067F5CEE66F304181E64D
                            SHA-512:D4EE36BDA897BBD643A699A0332DD00DE9CDCC6F46D861789BAD259A4BF87868AE3B4CFAAB6DFAF29941C7055B77A95D76BAA86A4A0DB2BF3BAF7E3317F03EB9
                            Malicious:false
                            Preview:.PNG........IHDR...-...c............sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..[Oh\E...y3kv........`.%m.R..6.1.4).o..Ki...D.......P!.].=..K...C[....f.}o7VPJIg...{3.|....d.....i..=.4.u0...n y......@j..Q..f)..mQ...4-SJ..9.d.?..5\-....:b.W..i...c.5..{..pj#.....B1C/.I.......].Su.k?.2..:.9Q...5.U...UZ...e..U.c],..2.}...1..)W./..Epr.Zt.....K.=..{......e..."...v..B.4.#....A.V1.".V}t..[..2f..Y..V9.".6.......(..gbm.P.....Y%2.c.z.:Q.2.<tYF.....u.@..KJ.;u.q:.].....$.....V....Hqk..DW.l.e.j.Z.YP?:'R..*.<........6...m@..r..j2..HK"|..L.Nc..D..y.9..B4$.......`.3.m1LE....7(OU\+./.O...%6T..w......h....).I.&n...*......#..W.41...5.#.`..I...<.?.|..*+Q.....#i........$,..n...`.s....[..E. T.w..j.,&-.r..;a....#.>(.P......f...MU\3*..;B....)..5....z..(....-...a.....}y.l..E...z>......&..g.$.....*T...N....E:./.>..#...^..E.0..%......(..@..W.X.NDM.<~.]A.>..fW.O.y.'...Z...h..).F..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002E.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.3225886411821275
                            Encrypted:false
                            SSDEEP:96:YZssU0ky0+idEPQcXI4c9a54RQyf2HY0ZtTb:issU0kRp6PQcXI4c9a54RJf240ZtT
                            MD5:C1B072C6255BFF64879556CCA5D81692
                            SHA1:936BDA1D419EF3FB59F67DD65270D9B121E5775A
                            SHA-256:EEE2C31F17BFD8CB4DDE7FA2148EEB4F8BD6D9E78869319D8F5DE6A3694CD976
                            SHA-512:34636747BD656C737E692A53D083FB81E5C739E72F4BE166E6E30493375517268871E1F3191A83880E672534AD4AB0C5792C5220BA7BFD2EFEA0D2FCC1470379
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ2.m.....2.m...2.+}..M.fq2.m...2.+}..M.fq2.m..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............i.....?"..L.q.....N...^...................Pm.G.XM=k6.x........f........................................I.qk..B.....LZ.............i.....?"..L.q..........i.....?"..L.q..........2.m.....2.m.....2.m.........................................2.mj....2.mT.]..2.m.....2.m..B..2.mH....2.m..B..2.m..>.)2.m..J...................;........4...4...4.."..............2.m.2.m.2.m..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........2.m.....2.m....#2.m............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002F.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 780x107, components 3
                            Category:dropped
                            Size (bytes):2898
                            Entropy (8bit):7.551512280854713
                            Encrypted:false
                            SSDEEP:48:N9YMTXc4gpw+EIWnqQ5G+NE9VTzRFvS4+Xh+AKrNx+JuCluc3Eeky8etajhDCFex:/hDc4rPIoNEzbS4+XhOrGJu1cUHeoVey
                            MD5:7C7D9922101488124D2E4666709198AC
                            SHA1:00CC44A1B84D4D94A0ACE8834491EB5F65D04619
                            SHA-256:20016E5FA1A32DCE5AF4E92872597E36432185A7BB2E61C91F362BD68484529B
                            SHA-512:882944B2CF040485899128E03B7499C540D481E45FE8017DBF4FE0330157B2D8ABB7334DDB31C112BA0EFE3722A554883917C54155A7F60044D2D7F3D848260F
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......k....".......................................2...........................c.....TUb...Sa...QRqr..............................!.....................Q...R..!..............?...$.)m.1...%%bV.J..H....-.%a[...I"WJ..:.X.:TT.$.......N.-NR.E..-NR.E...9..E....$.k.....B.I,I)..J...kr..+)..I,Yj..YbI..+,J..e..Z..V.e.$V..TV.X..V.YQZ.EQ..U%PY[.[.R.EP............................| F.. ...j*...!m.!j.I%.j.$...YeEYYEEUE..eY[.hEEUeEil.....%..el...V..TUYA.U.UTTUT.Z..UQQUQE...V.,...UlE.U[.lEP.P.@......................................R1...AR1m.....#..$:.T.p..IJ.t.....A..AH.,5..]F!a.XJFaa. ..a.!*.aa. X.e.......bB.b..,HX[,!..,,.c0.,..U..X..(,,...B(.,..4..B.`..".a..-......"...........................>D..IKEb...t.....)u.....)K.%+L\.J]i)*b.JR.IIL\i)u....T............T.....qs.it.iJ...])ZJb.....X....U.A...V1..B.R1....X...,.c...,%X...,%#0...,H

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002G.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.342664394259068
                            Encrypted:false
                            SSDEEP:96:+sUoceo/EShGXZ9BMRQyRtnbXXJ13L183IjGb:+sNcfs5XZ9BMRJRtLXJ
                            MD5:0C74B0D8C4EE690FDAF68ACAC3F82513
                            SHA1:8DF743B33E6871BFF1C01C583FCBCB5DC47B4574
                            SHA-256:6477DC53D11158C2A909E813B3DF35DC141AA0F59D95315FEB50605120E03138
                            SHA-512:33B4C2CC3E8A80D38F11B620156DA08197A2C8F84845F54252306753BD1561B524D3FAB9E49F8DDF57B47BC554D27523A6A175787CEE29E2DB7E6A0D7E8A8711
                            Malicious:false
                            Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ.*'......*'..F..z,r.c...*'..F..z,r.c...*'..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............".{......go5.B....N...^................b.....L.~ ."..\........f........................................I.qk..B.....LZ..............".{......go5.B..........".{......go5.B..........*'......*'......*'..........................................*'j.....*'T.]...*'......*'..B...*'H.....*'..B...*'..>.).*'..J...................;........4...4...4.."...............*'..*'..*'..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........*'......*'....#.*'............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002H.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 613x144, components 3
                            Category:dropped
                            Size (bytes):29187
                            Entropy (8bit):7.971308326749753
                            Encrypted:false
                            SSDEEP:768:RwjBOlCk+nYnGagKJWJhwMJiRO22ZIm4VXvXx1tA6BQs:i8snY3JW7uROlEfbtVL
                            MD5:DF99CAAAB9A7DE97B63343E60A699AB6
                            SHA1:B84334135CFB73BC6EF55F85926770D5AC6DFEA8
                            SHA-256:74C131777E7C437FD654427417097BC01B0813BA8E1E50E4B937BD50A1BEBCDB
                            SHA-512:5D15AAAA8B71DDFE01A7C0ADE16D9E1F5E9AAE484BCD711B38CCB103ED9564CAAC23A0031471167B660E15972D70179C2A387509B213C05D60261042A0456025
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................................................C.........................................................................e..............................................`.............................!1Qq...2ARa..."#.....3BSbr...$4C...Tcs......%&DUd...E....56Fe....................................H........................!1Qa..Aq..."b....2R...BSr..#...3..Cc....$%4...............?...b.d.8T1.;#.S.DO...~.R.......3.xe...z.6..."m..k...;*.'.f.5^.....m..<$....8.R.j.D.v..>...*dT..vGbt...I......sEWp.r3.. ..G...6.....w...l.S..q...b.....-R....^Zu5+u6...A..Z].:...5..Uzn.,l.L.....?%.*.S.+zVg7.=.s.Q.....8..:,c.......ZE...>'IF..W.0.d.......c.e.d.V.t..S$.DNR.[....g..#i.$. .U.SK2.....k...J5u u\R.....T.[4..A.O..,.T..................] .i...B.m.^f....._...{S.....<......:..|D...+...NA....Y.^f.1|..%K~1..B..^...S..v=.c..g.tX[..kTJ..t.gr....R..@.F....5j..2.K.9..g.1N.....*.U...^w......>+.l.v...@N....%Qd...t.Ni.....0;lggm...K".+!.,.....[J...>..?f.]._;

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002I.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.319991390072871
                            Encrypted:false
                            SSDEEP:96:Tgs0P5OTD+8INmEYY6UXMNZ9mi7RQy5Yg:Ms0oTjexrX89mi7RJK
                            MD5:E478D47F2FDDB2CC62AAEE36689DE215
                            SHA1:09477EAA3EE6A78A7B9BB868D302E8CA11003767
                            SHA-256:225B78EE78E0FCC699C391D3680102ED1164F49E7A0D11662703DA981D49F9AB
                            SHA-512:0C69AEEB49246867205C13CB1C2A659BD370F00D6CD6E40A0562FC02FEC73C398FE822A2EA20D66324D69F094CEFB7FE3B5F5B46D5B4AA40876B988CE7242B06
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..t.......t.j...,}.#......t.j...,}.#......t..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............9.le.SV..C.y..m....N...^..................N..EI.....eK.........f........................................I.qk..B.....LZ............9.le.SV..C.y..m........9.le.SV..C.y..m...........t.......t.......t...........................................tj......tT.]....t.......t..B....tH......t..B....t..>.)..t..J...................;........4...4...4.."................t...t...t..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4...........t.......t....#..t............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002J.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 276x139, components 3
                            Category:dropped
                            Size (bytes):4819
                            Entropy (8bit):7.874649683222419
                            Encrypted:false
                            SSDEEP:96:/hnQiz+ET2/hDi+tv34VtpWfowTHgegb6hhLT1NTS:5nQ6TAhLtvIzMvbi6hhF0
                            MD5:5D6C1F361BC04403555BE945E28E53FC
                            SHA1:00C254F7B3BC0289590C2BBDBB39C8EC2E2B2821
                            SHA-256:131D637CDC5D0B094FB9FAD17F4D2A1ACE0D03613588155AACAA2D1CB4E16DA9
                            SHA-512:34D2C0929FCC3CC10D0A2121BD55BFA9A07062C2A7B8F101071164C946895DBCB2777641E79DE4193D57A3F0778DD4F1351FAF333B7E4B4DBE31A32DD69C51F9
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................<........................!1..AQaq"...2B...#Rb..r..$3CS.cs..................................................!1A............?.............u....p.p($.Y...9,j...V.*..S86yh.G.#m.5..9...6Y.."C.R:.[..-.7U3c:..].;.....f.?%..<T...&F.Lh.N...m]..x.D.g<B.....k..S........>j.K....#U..Z....<e.:..8....o..xq.[..4v..U..y...k... k....A#..A...pn.jJ.I.7:..{.b..ns.t,...8.Td.I....m.I.5Z.).-.. ]..X.Do%.....?..4jV.`llt.E...5...u.|..\F.=.F.r<...5dV....xc.%..&...4,...f...3..H.<......eQ...P.J....7...lLc..?..-.fR..7.#.6.......}:.]'.ny..........e;u.Y..$0...i..-....f..9(....}..T,.Inb...+=Cca7....WULA1@.s...4uY5.N.f.c..].ks.....3v..~..k..m)...f gNE`S......#.....Z..6.uc.m...#k.s.f*.l.$6..?..xC.Cm.`...N2..&H...._.&.E...[....f.Z./...!.a{K..#.V.5..v.B....1...9..B.&....%s.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002K.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.373795484877386
                            Encrypted:false
                            SSDEEP:96:jeshlDr5wmvPEVRZXF9YARQysdCp+NkApG7e:jesh9r5wJ/ZXF9YARJssp+NkApme
                            MD5:93CB00AB92D5EC1215C9BC45E5A28C6B
                            SHA1:076191D84F82068D160466E200B2507155816913
                            SHA-256:B4733DE3737C5390CB3B3092C266DC0D5EEB4F7779D09A59FD1054BAD3D5276F
                            SHA-512:20D82AF8BC8A5B2F8F03CE8BDACA51359DFA9AA82756C7648ADC28BF5773AFA3DA46348F9822E068557CE0EB20DAB719041C5FECBDEAD400CE7716FB500D5EDF
                            Malicious:false
                            Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZCW......CW..c..mEa....CW..c..mEa....CW...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............B...Z..4.H..g\j....N...^...............qC.....E..;.n..........f........................................I.qk..B.....LZ.............B...Z..4.H..g\j.........B...Z..4.H..g\j.........CW......CW......CW..........................................CW.j....CW.T.]..CW......CW..B..CW.H....CW...B..CW...>.)CW...J...................;........4...4...4.."..............CW..CW..CW...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........CW......CW.....#CW.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002L.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 814x45, components 3
                            Category:dropped
                            Size (bytes):1717
                            Entropy (8bit):7.154087739587035
                            Encrypted:false
                            SSDEEP:48:N9YMzO6BOfqH/dAIWpdAIWpdAIWpdAIWUtr/SD:/hzJgfqHaPYPYPYPUt/i
                            MD5:943371B39CA847674998535110462220
                            SHA1:5CA79B7BD7E0E93271463FAEF3280F1644CBA073
                            SHA-256:9C552717E8D5079BBB226948641FF13532DF3D7BE434C6CE545F1692FA57D45A
                            SHA-512:812541836C8B6F356A4D530E5CCF1CFDCC4CA54AF048CAC19FE86707CE5EA0F41D73C501821AC627AD330291EF58C040DFC017923A7886CEEC308048DA2CE7C9
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................&.....................U.....1T..S.R.Q.................................................R....Q.a............?..d.. ...............................................+A...Z+E...V+E...U..R.....}........Q..Ah....Ah..b.AX..b.PZ+A...V+E...V..J*....Q...b.Q..Ah....Ah..b.Ah..b.PZ*.(.@z.?.`;2.......................................................Q...b.Q..EZ*.(..Z>.G.....`Z+E......J*....F+D...F+E.......b.Q...h....PZ+E...V+E......J*....F+D...F+E..............[u#...a-...f<.9^[...l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m..0.....l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002M.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.306248651102693
                            Encrypted:false
                            SSDEEP:96:asCqjWes7EKd5nXkDs9/cRQyxn2H8glfjgsw5v:as3WOKLXkDs9/cRJxn2H
                            MD5:E7A92F388D178E45A1AB36D534B26B62
                            SHA1:4AD36A922726BB4E9254ED3CE33FEDB4220A43A1
                            SHA-256:AA4E485812133B0A42A2347D1A64A67C5E63153B5A6389867F5A688E4CA79832
                            SHA-512:B7AFF032BAE452509E6C9D49E7F554428CBEE14FFCBC3B0AD4B46DD45D4657EEE4EEFA255A9BBF9AC6C677FAA606F751F7DC4F840219A0AF648A65DF2502CEFD
                            Malicious:false
                            Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ.`$......`$...y.'f....A..`$...y.'f....A..`$..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............1j......z....r.....N...^..................LF..F.|.ea...........f........................................I.qk..B.....LZ.............1j......z....r..........1j......z....r...........`$......`$......`$..........................................`$j.....`$T.]...`$......`$..B...`$H.....`$..B...`$..>.).`$..J...................;........4...4...4.."...............`$..`$..`$..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........`$......`$....#.`$............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002N.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 262x277, components 3
                            Category:dropped
                            Size (bytes):3555
                            Entropy (8bit):7.686253071499049
                            Encrypted:false
                            SSDEEP:96:/h3JeYCQV5Hn++9HBdAjU78S/mjLLwqnqahJD:53Je8b+EBdAjm8S/mjLLRnphJD
                            MD5:8A5444524F467A45A5A10245F89C855A
                            SHA1:ACE68D567B02B68275E0345C86DB1139C0EC1386
                            SHA-256:7D2B01F17354D9237A6AB99D5B9AFDF0E1CC43687125848B0C2DEDFB44CE3843
                            SHA-512:8151B447B60D110C32EC1EF286B941FFC09B99140F41BBACF5A1650A385FF4D13C0DDB2878E9A470FC7CFCC95A1AB6E44F6DE72562B0FFE093DC8A3C3C7FCC14
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................2........................!1AQ.a."2q.B..#R...3C................................ .......................!1.AQBq............?........)&vD.)3Hn*..X+....r...tmL.k..(.E...R. .Z..&...,fJ...!...6..S\t3.=...g&..Bqe.)_U.....1......-..fl.................J...u.i.mU..K..v.w.0O..E.h..D~K.(..9.,8..E.}.............i.\.....t."v..q..C............<..|3.........................*Q..../c.....f.}8....D..|k..Z......0..~..c..e..m(...|.c..'.5.5............==bx.5x.8...T;....=.--.pc...I;.V.m..,(....}...NH.ho....Q..U.E$.~...w.t>.S\....'f.{.+.g._.t....;>.....P...........-..G.h..2...J.% !.E97Ir.D..N....j...oE._...._...".?.......#".S.........Q.Tc.I..*I..k.......=$.........sk1Jp.\K.....F.3.Q..q..J....N..[l.&....OR4bB|..2ul....J...B.$&H..9#j.f.n./........?R~....B.I.@..........m

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002O.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.279855789252748
                            Encrypted:false
                            SSDEEP:48:f0sqcTR9nsE0VOtiPj75ElrXXE9KzDoQArdQqrbw+3R3BXZbs90BvZUC+:f0sqs50VO8EBX09QHARQyE4ZZkC
                            MD5:279DCA45F97CE58E6BDBDEEDCF662535
                            SHA1:6650267351519FF45A9C857986E83A748C50E87B
                            SHA-256:BF775DD6565D1AADB0994BC3FEAD3B22CA53806B248B51D88D9E576151F820E2
                            SHA-512:EB9DCE0EF19A0E6E62CDC6415323DDF9085F10AEF652DB571ED7AC384AA4B1A7A5F44294E82F380BD099AD244AD3588145C9C9ACDDE7A231F1BBFC8C58A3E453
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.................x..............x..........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................."...3z....(.....N...^...............F]f.FZ.F......o........f........................................I.qk..B.....LZ................"...3z....(............."...3z....(.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002P.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 70x626, components 3
                            Category:dropped
                            Size (bytes):3428
                            Entropy (8bit):7.766473352510893
                            Encrypted:false
                            SSDEEP:96:/hdu7isPwAp7zesusUyYAatNG87llTONQYS:5di5tfuQ9atNZlaC
                            MD5:EE9E2DF458733B61333E8A82F7A2613D
                            SHA1:A86704C969F51B86D6A05ED51C6C60214ED9FA89
                            SHA-256:BE4F0E6C89FCE91B9EBD2623567F7DFC259E0E3C77C9158742B8F64B724DF673
                            SHA-512:BFB5D6DD6B66EE21E946E90D1E482384CD10244308562DDA814189602681DADDE5752B80519E5B8515F115A71BD6BB4317A59BE65B8B5E3474AED119F8303569
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......r.F.."........................................H............................!Qaq.."12.....#3ARbr...$B...cd...&CSu.....................................+.......................12..aAQ.!#q.."................?...#...3.Za......rV.5&...../"..i.t...j..W........d.FL.V.2K....]t.f.d.NK..:.....f...... ......2.[...#..D...ZK....p.z.E.N..T..L.-....1....2.\.6FIr2..zS\U#..........fB\t..5J..~q...D....A.......!....MY..../.HY..../e.M.Y.n.~..,....'..Pc...l...d2..m.f.it$..qx-z*...._..].cOO....n..&.....FIA.....2J2..d:<qc..6.I.G.N....f.K..Dx.-.......`....2.FZ."K7.r}..<.P.Z.da.Y.....8..s....G.....b.e..g .S.......FL.Z,&..q.MG.J+..x\..m...qN=.....)..`...&Y...S....u6{.z.g.....@......FL.ZL&.Iv.w..8....U..v...*.q.B.v_./A..#.#.g.j........*J;...u...W.Ao...%....#$.....M..^\{W.SO...s,.N.....c).,.B.Gv...."k..z."..S]H.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002Q.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.348111249343912
                            Encrypted:false
                            SSDEEP:96:IspO7xN82IA/EXNrx1/pXM/p99DoRQy5YiVY3p:Isc7n87AsXNX/pXM/p99DoRJ5Y
                            MD5:4CB97D8E407C5659FA28490FCE85BE62
                            SHA1:85762292C4F9C4CC79475C5FB991E3B369E553E2
                            SHA-256:6AA29AFFB432085F3F04CBCA17BFBFD50BE0103ECDE63CAE32098A5DE360E833
                            SHA-512:43EE21C59D5039D90F71F625CA48ECC18418790DD1F360253ADD621587B606F342646817D8A3142A3E8A75A8B08F530D91B39970EB5CD60935BC144B30B7511B
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ...........g....1N].."W....g....1N].."W......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............R...B...,0|.......N...^................?$....F..x...8B........f........................................I.qk..B.....LZ..............R...B...,0|.............R...B...,0|...........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002R.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 177 x 123, 8-bit/color RGBA, non-interlaced
                            Category:dropped
                            Size (bytes):65589
                            Entropy (8bit):7.960181939300061
                            Encrypted:false
                            SSDEEP:1536:2Hlrjw3xL//DPgff+9j6yPWvHMHjkbfnwHO3AW3GL:2H2zDUU+yPVHITwNfL
                            MD5:8B48DA9F89264D14B83FF9969F869577
                            SHA1:E1BD58E2D80FEEF56DC514F3F0B3AB9669F22F95
                            SHA-256:62AD3C277E54F03F1ADB44062407346F789E63859B7AFABFD64BE6AF5E9F66EC
                            SHA-512:03B783EC968DF3F648504D068D64DD1AE110E28110FE5B3401C9D04F44897DBE0CBB5680D42CA4C665FA94A6CED4B559106EB3C06C9BF2C5B14951ECBFFAC8AE
                            Malicious:false
                            Preview:.PNG........IHDR.......{.....;Za.....sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..Y=.+I....t.y...,^vv....;. "|. .i7.....$.2g..']pH@p..]b....H.H.......d'@ B...U.xm..3{3k?..5n.._}U...3......~..>...g.....f..t...t:...p>..Si..d:..k:.Lf..t6.K.i....d<...x.8\.8.+lc...)i.$.r.....x.t.BG.R.cm.c...p.:&.6.4..K.......^...~b].0....oBYv..u.'.=.K.Q.g)6.....4.!.M......4.=....G.%.Sr........nxC.F..t.U........1...J.t..eQ....".... |...81.$D.!.>...........$...^.vY..EY8tb..'.P.g#O....S*..0'.V....x.W..........k.......s.C.S...J%.iVb..].........3....j.}*.z....+.s..@..K.....\x.C..e.Qq.....;N.....;....,....^.*..$F..{G...8.#....8'..&....8..5.....3(P._....S......|".....u.cr....+a-....&V..x...iI-<|a.{E.c.X.......?..&.C....'........(.x....>...M.?.9..#X......l...0...Z.F..<.z.0}Q..Z1..........?h..`E$K.2o.A*c^.......*..D..uL=.}.#*0.. M!.A.C......|_..(.Y........!E... .O...`;....M+..x.u~g...q>...N."D^..K..x..D.`.!.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002S.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.3687681266402905
                            Encrypted:false
                            SSDEEP:48:IlsQCadfARNt6yFpEmdPPWXkyf0W9+Ho1rdQqrogOBXBnkgqOy:is2dfARN0yvEmd2Xkyf99IERQyXOnG
                            MD5:91FA109BE8A4206541A296F0E486EAF9
                            SHA1:D6C3571BCB97C151023C85F8CC640BFF08EF7374
                            SHA-256:BB1D1C1C3B2A3649FE45F75845CDCE100E58B14D0122C0457D34077ED8787C24
                            SHA-512:848F4F6F0B01A66C9D3E4DFE39D7C1EC5CDE68A6D43CAB0A2D2F915853C8232E31980575EC2CAC9C2DE0F430C9169BACDD2BA9A18CA8519C4C8D1AAA800FDD9D
                            Malicious:false
                            Preview:2...>.......V...v...J...................................................................................................................................2...>...2.......v...~............................I.......I.qk..B.....LZ............,../...||......,../...||.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................\.-.4.../z......N...^................}v...B.....0.........f........................................I.qk..B.....LZ................\.-.4.../z..............\.-.4.../z......................................................................j......T.].............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002T.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 17x608, components 3
                            Category:dropped
                            Size (bytes):1873
                            Entropy (8bit):7.534961703340853
                            Encrypted:false
                            SSDEEP:48:N9YMw9kGzE4xTdow1C3kyIkyM66KeJY3fOxJ:/h8HzE4xTdoUCUyxyD6LCvSJ
                            MD5:4FC8500BD304AD127AF4B5E269DFF59B
                            SHA1:9A5E3432358A0FCDECE86AEB967319B93A65D14A
                            SHA-256:B4DAA90D5A53FCBC85119050B5B76962443C4DD18D7F42CDC6D4E0AD8EFAD872
                            SHA-512:E5E07054A522EB91EFD39722AFB3776389632B8F5F923C1D29796716D68CEC93BE5E44F79913804CEC7ED631FF520CBBBAAB841E01FB90AF8E8ADF84DCD47481
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......`...."........................................>.......................tu.....45.!#$%1s."fr...2Fq..AQe.Eav............................... .........................!AQR.............?..e4.bbu."m.G......u.S.-Qq.b.a..'#..E.......u.|:.f[O..jS.S.&....=.....[.....S...N.~~...'...q....N.T.Oyf..a.6..%.I.1j.e~.4..[5.WW.Y..Xp.gn...u.......Gb.O.W..k.!mJgfq....~.F.......m..}bn4.5........s,F...z.b)..O..*...5).-.-\....=`.fP....%...A..Q.&..9.....QQbD.%.:u.f...r$.10..W.F.T..MI...9...ZQH._..).....D..n.F].........*.:.j...!6Z..S....0...B.6..Ga..S.O.....U8S_.J.>...i..?..<.P..........M..F.T.C..7.E...`.4BKcMh1j....4y...+.|.^......2[.WG.W..+......E..r/V^".R...."..6..hht..f...........;E..Kx....)}Le.A.x.>..$/).._S.n.L......}..H^Sw...2. .v.io...../.........x.>..$/).._S.n.t^;O.....n...[.S...h.v.io...../....:/...[..7yK.c-

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002U.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.399399222939958
                            Encrypted:false
                            SSDEEP:48:XCsLkfzVFLm0UI3tUEe7X29l8Oot7rdQVruf680BXtjA1PkNfR01afee:XCs8m0UI3WEQX29JARQ5y0n
                            MD5:A02B7287ADCFA3CA8BD033616F30D8A8
                            SHA1:76DDD34C2DF2A0C8D34FFED3C042A39962B21D30
                            SHA-256:DDF6182E9ABD65E1AC3648E2175692136E167F34CAB27BA1FEE642635783C446
                            SHA-512:C8489975798E34E2EDC4352C17AB03C00A7EE80A9F11F936257F0B9855A8A03FF848935746D2EC14A90BE04B8FD087E51C0F457B315381FFADED60CF76C97066
                            Malicious:false
                            Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v...............................................1.E./.'.I.......I.qk..B.....LZ........1.E./.'.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............\._.....T.~.$....N...^................."..!.L.`.ng.U........Z........................................I.qk..B.....LZ..............\._.....T.~.$..........\._.....T.~.$........................................................................j.......T$c...............G.......H.......>............. .3...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000002V.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 357x69, components 3
                            Category:dropped
                            Size (bytes):5465
                            Entropy (8bit):7.79401348966645
                            Encrypted:false
                            SSDEEP:96:X0cZneDWlIKmXwxacOHHI6EhzNlSSDDgafbofgt7mGrw:XleDWlIJwQHihRdgu8imGk
                            MD5:8470F9A96B6C6CAD9EE60961E96D19B2
                            SHA1:AFE1F01FFA4E4CB06B1D770C9C59DA75B434D1AC
                            SHA-256:2DF453410796AEC7B9EFEC00059B6CE64BCF67313A95AE458BA600EA5DE14811
                            SHA-512:CAE5C2ED091BA49761F0348516D53491E578FB165F32F93AC7DAD927383E9A398B06229FAC6A8233777DF708E5001AE0037A1FA960293BDA49892C40B37F2240
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................................................C.......................................................................E.e.............................................8...............................!"1...2A#Qa.$34bBDSqt..........................................................?.....`0.....O...3Sd..@..5.0....Q.pw....;....!pN.DR....`0......N^...k.=.u.e.7{.b........?z....zV...M.....P:a.SPj.....WRK.=x.2.h..2..AS..s..A..|.Z/f$D.YX1pr......}G6._.~..)j...+.s.r".{..q..-.^@...#w|.H..*.K)....g...y..`0......2.w@.Ro.d....@...K....}...&... y..f.y.0.|DC..>p.[E.2......v..N.)Z..4.RF.D.8]..Z.|f/..+\ID.r/.o........0i..*.G.O..uj..RN. ....j...xnF...Q.Ls.U.c.D0m....z.k.P;f...b.=..L.hH.,./;.U..`sa.I...?*...I....M.0<.u....!..C..U.T.....s.Q......_..7K..*.....?....R\&=.<.u..oQ}WZ..Yu...{Fe3.h...@.s..mW.G..^....1.W.#[.q2.&u.c.G......`J./..X.C....M;.....3k$}.i.3...#/x.m.Oh.}FH]. ..5NNDIS.-.M~...6..w.d....P.;..k...........v*..T..L.P...s.!B.4..w

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000030.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 14x341, components 3
                            Category:dropped
                            Size (bytes):3361
                            Entropy (8bit):7.619405839796034
                            Encrypted:false
                            SSDEEP:96:zDqnxqMt6gGr/Nln5ANln5ANln5ANln5ANln5ANln5ANln5ANllHN6:CxqMQr/rn5Arn5Arn5Arn5Arn5Arn5AN
                            MD5:A994063FF2ABEB78917C5382B2F5FA8C
                            SHA1:BD5C4D816B04A2B6596DFE38DB01228F553FACCC
                            SHA-256:D72900E8DA72D1A7F3729971AA558E1E9B6E9CF9A0D51E83852E567256DBBFEF
                            SHA-512:CF2279033DD3EDFE6F6F9E5C517BEBD9A52863EEFD90F57F7A5AE0E0485E705254BE7ED6B50E6CA142669687727AE85E2E6035F69930B75F2E6D3EEFA961EF88
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................................................C.......................................................................U..........................................>...............................8H........59...$%&7F#'Ddf.....................................>.................................58EG........!#124$%&ACFbcde............?...n.p..v..a.~.._.>......#....8.....w.G...&.W...i...%6m..K;...4."...=..?.~......P..O...j.l..AW.jo..,..=d.h.ta..../.."...z|).J.......Ww._..<Wp.3+8...-5...G:..2.D..I>o..K.F;-.....#...`...6..T...M.....OOgV~..5...np...P..TYr...........b..{r.2.9..].DA.%C....=.v.z......CK."..R..l..y}.i..;.{....JzS.....~.?..Z....=c.h~*..p.@(@..G.....O.]...Hsd.xf".V]..S"..w...4e>....3*U.7..|M.x...|\......FD./.cIe.;.bId..+=...w.......[.k>....}.u...j.xZ.....Q4..+.....B....1O~\......I..h....LaXJ%&.w.<C...n/`.W..U.W.U.}~...}>..^.0.J.....@....LN.b.......5W...m].Eu...:....G..:4.=4ixx..@_0=.mab.T.U.....w..~.V.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000031.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.330626263816812
                            Encrypted:false
                            SSDEEP:96:gNsrJIjIDPhLREBX1v9WRkRQyP5EZKgIjaSyEf9:gNstvDPhSBX1v9WRkRJP5EZKgW
                            MD5:527A8D944EE806ADE13D2723C527F653
                            SHA1:72151BFA9D607573FB2948DA392D70A866D802EB
                            SHA-256:6EB51418C85C13F3EFD8411B1E2609C3AC71A3FAB048DA9326EE6B3FAA069679
                            SHA-512:82329A4CE08416E9862ABB8C0C55DD9E79945DDEAF8E9414F06497479582F0CFFA72608E81797633E8408E9E09A88D302F328D2538C73B4A48D2E5314EB9FD26
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ...........N"..2........N"..2..........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................X..4.e...^.....N...^...............D.g.\..J.....]@........f........................................I.qk..B.....LZ................X..4.e...^.............X..4.e...^.........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000032.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:15:20], progressive, precision 8, 604x784, components 3
                            Category:dropped
                            Size (bytes):140755
                            Entropy (8bit):7.9013245181576695
                            Encrypted:false
                            SSDEEP:3072:i/aDiblRsFcOco8dofE5Zx1+NQI8Wh9aiOe5NTO:mnbM+TxaAi98W3aiOwTO
                            MD5:CC087700C07D674D69AFDFDA0FA9825C
                            SHA1:F11113DF69DACDB255C6CBCFB29C1D1CCE40B346
                            SHA-256:A7FA7F092EFF43030A56342C39A765F8D5CC48C7DB815DDFC8C1E5EC40117FAE
                            SHA-512:843202D975EFA91E73287052A893584B6E5AE601F91612B56539AA2F73D1AD3F997FCAD1E711E0F483A2E91D46D9643D0B026B43F4E94116A5D2FB6551536034
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:15:20.............................\.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.......J...\O.,......../$..........OE.m.o......T....Z..l.g.-....m.?...Y....3......"....].j.X.k.S.k.....4..R....{....?F.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000033.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.364140374537992
                            Encrypted:false
                            SSDEEP:48:YuSsnNH8xz29Hdt4hPEuVLxeXle9eTo9rdQqrzYQWBXDDc0pxIJvDwmL4FT:YVs6iHdq1EuVwX49eT8RQyrWx/
                            MD5:C370C3B0AC0E7753050CE82B3B8168BC
                            SHA1:C3ACF595A595BB1755B980951249EB23A02D87D4
                            SHA-256:D63446EA1D32EEA9F926EC7866B9058C28C0115C49E21E1F939B2D3849237554
                            SHA-512:58AA19D2F6924AEA18FD0D3321E9F94B29BC8904BBBD6364C451CB73EFDFB4CFBA016FBFC011DD5FE311C0A4CDC68F87A8644AABFE7FCE05A03FC0A44A71CC74
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.{.......{.4-G..1..uUE..{.4-G..1..uUE..{...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............-..#....9...Cc....N...^...............g.^....G....N..........f........................................I.qk..B.....LZ.............-..#....9...Cc.........-..#....9...Cc..........{.......{.......{...........................................{.j.....{.T.]...{.......{..B...{.H.....{...B...{...>.).{...J...................;........4...4...4.."...............{...{...{...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........{.......{.....#.{.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000034.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:13:06], progressive, precision 8, 570x779, components 3
                            Category:dropped
                            Size (bytes):129887
                            Entropy (8bit):7.8877849553452695
                            Encrypted:false
                            SSDEEP:3072:QS1x1rXglsteJ79wHi4vNQR5yBlUdOSILe9hSj9jeWMPjdlOJ:vvglst1HiwWR5yBA2LeS9jd1
                            MD5:737E96E41D79D3BDACE7AB4F8CBF6274
                            SHA1:E6202A41A4F86B27D9EBCAEF7670B16C0ED67CF2
                            SHA-256:7966F3D8A2D61ECB49A35E163781858E052C0B122A18A1238AFE27B57E2850E8
                            SHA-512:D398C8521DB2FB3F8456FE792CF37472F3B851DD7298DB20E2DB79144F8E846D051878E77E5EF5D00E6840EDB90C6E2D97935BC1023A15FC45038CCE731E9895
                            Malicious:false
                            Preview:......JFIF.....H.H.....iExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:13:06.............................:.......................................................&.(.................................3.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................u.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...W..I:..*....a....Aa ...w.T.M.v.........3x.......8Y....$.."-..m.I.0~sxB[@..=...:..\.Y?....@O.L;9i..U....?.5">+9.s\Z..vN

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000035.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.355623539229566
                            Encrypted:false
                            SSDEEP:48:YuU/soFn1V9tHO2yLEr7LlXN9Xk92Ro5rdQqrHtDBX0CpxZ9J:YNssV9EEr7pXN9U92RIRQyVn
                            MD5:45F18E4EEDEA767CD2C22168054AFB75
                            SHA1:1AD741988F5999CC15BDD25AE9C88D5F43400B36
                            SHA-256:A5AB2C243019D1F6B06F9A0377E0F61350C52D1E7A89096667EC25475D887570
                            SHA-512:9D705893B53C3BF0BCC7F90C320DB4B7620D57F8CCD08F1D2165C5EB25F6A24D527DB0E3697F01E0B81E16688F57BB91DF748ACB9BF88780EA309DE42ABF0DA4
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ~W......~W........O<.V."~W........O<.V."~W...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............`.T4..............N...^...............Q.....TC.?if............f........................................I.qk..B.....LZ............`.T4..................`.T4...................~W......~W......~W..........................................~W.j....~W.T.]..~W......~W..B..~W.H....~W...B..~W...>.)~W...J...................;........4...4...4.."..............~W..~W..~W...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........~W......~W.....#~W.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000036.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):84941
                            Entropy (8bit):7.966881945560921
                            Encrypted:false
                            SSDEEP:1536:X3sWfhTVd+xu6rA6SOONM0/YFXnviDwoPCaNSm+z/ze/fWNj7GfigeKyCGzw+QKW:nsOhdDJOwY1voPCaom+z/zeHAfGihCG8
                            MD5:CB84C108A76C2AFFCAC2551A3C1EAD56
                            SHA1:8BB7C2A12B056C1ED12EBBAE5BC9F60CCE880FFE
                            SHA-256:139BB0E79F89C3DDEF79B1716A5FBAB4C07DF5785FB3CDF6B4EEDDBF6C078452
                            SHA-512:6EF85144E9A7ACD0FF2E52A5FF42093153EFB69127B1C8549EEBC49B6CC196A46B65EE39A2CAD0206F6A41476D8B5B35D29EAC9942B8F84972B32E14CAFEED27
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d....................................................................................!.1A.Qa..q...........".2..BRbr#.T.3C....S$.cs.D..4%5......................!1A..Qaq."2..BR....3...b#.r.C4.............?.......m.q..'O.....r......_.1....8h....?.....O]~..k......GO...''._...!....o........''..g..H?k.......1...?.....z......>...+0..................GO...''._.........}.O.Z|.L?...........?.........[~t.......}......NO.....v.......J.......?..g..H?k......GO,m..r}o.z.....}......dC.9?..g..H_..........?.....O]~...m...C?.z..f....W.=u.B..m..C.-?.a.....3._.?.......o....np.M....g..H_............9?..g..H...../..kO...''._...!~...o.....0.M....g..H.........../......O]~.~...o.......7..+.... ..l?.}........&....3._./....?.........W.=u.C..m..C.+?..o.W.=u.A.^.O....:......_.........}..t

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000037.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.317615445750807
                            Encrypted:false
                            SSDEEP:48:YumsR8VxmTPtg78Ee+hBXUL9OmolrdQqrjxrMs4BX0AnG7PDhgGNaO:Yps4CPKwEPHX49OmcRQyFAs4QJ
                            MD5:52C7DFE57044279078165D6760DD2C23
                            SHA1:5407C7E7376D4F5982EC6AEC35F7EB4CAA84E81F
                            SHA-256:4E3840EABCD2ED747843CF5C45CCD1F82E310EA8595D1001A1007595B27F776C
                            SHA-512:2B5D5364413334A25AFED061E88AFEEEEFA3664B548074B2E468D54B3F3A36CAAE152601E847B1D5CF4DE0CA16E6D53300E635131C80BABDF124B0B8B57B8F1C
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.............bR.-..".........bR.-..".........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............b..#l.'g..G..p....N...^................{.~..zB.{J.............f........................................I.qk..B.....LZ............b..#l.'g..G..p........b..#l.'g..G..p........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000038.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 40 x 623, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):1569
                            Entropy (8bit):7.583832946136897
                            Encrypted:false
                            SSDEEP:24:KArPoy/sSfmBL0EGEsRgeTLLXFnViAAEslVorlP0i8OmO57EnGAkYelBKMN:9oQPTgeL5ViAe8rQs7HAkrlc+
                            MD5:07DB3F43DE7C1392C67802E74707DAA6
                            SHA1:C173ADB1999065C5E1E6DBEF934B4D4D7AF0CC23
                            SHA-256:51E05999A1C9F17DF28CB474E57DD8E64BDAB824874A532C20A23766A01F8967
                            SHA-512:E509255519D4E521E82332FF418DD5A6BBBC8476399A0D9C3D81542C1CABA535B2D79E5BC90F73F9EE8468643302137671934ABD600FC696F16161C91FEAC111
                            Malicious:false
                            Preview:.PNG........IHDR...(...o.....>.c.....PLTE................................................................................................................................................................................................a.o.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.Y.. ..........}%.../].`<..y....V...m.....<....)..;Ki..'9...2.:.c...t..V..d.t;-y.Z.=K>B.."{Lj.~G..|..ENC.!Sw,....";.p..g....E.B..S.-...k..P."..E......l[./D.-.....Q+.G<>.+..b...#..y(...{a.M..J...<....v.W..F.qm.`.....(.mk.nX....l.Px8.0\Z....7G...$*.....&..Z.VJ.~......J.2|...2H..../...=.)q....ZT" .,%..h.p....Z$.!........r...Hh.f. ....P .d..1d....2.3h....;.A.... ....d..g4...A..^.....2.ew..."h...y/..j.h..B.......%.2.%..{r...+dG.=9h....P1...A...c...^h.]Q0.8x....q .!3....ZW"Z.!3...G.vC.GG..".&..X!3.|xB..V.P!.+zS..NX!3.....Nh.y(.Z.1.h..B...Z+....l8Xcu.B...K...@U..@Q...mB...x...&L C....mB.....@kC...Y.,.... ..e\F.B..........y..e\..:$(....Z.a...yn...f..z.~Q.{o...].ln.r....^.@.{..c.7..{...

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000039.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.328921489445907
                            Encrypted:false
                            SSDEEP:48:/ks3rQtmat0MrkUE+YlL6X/rA9S2orBrdQqrn1h1rsBXEo91mOZ:Ms4maaM5EpluX/k9S2MRQyxQn9
                            MD5:A608E73568FE4EEC5D0D365EFD27420B
                            SHA1:B6AC7E38D5EE7CBB9FEF5DEA61C61014AA2FDBE4
                            SHA-256:84F1F4E759A10C7F83CABE46328BB9DB58E13BEA53CA317F284B300CADEEC486
                            SHA-512:857EE4A1ED4ED825F424B9D9BC4EF3E820749F2CEE35396647976A8E41C7A724DBDF14D40F57FA036A6E67FBB661389E1851C49C665FF75CDB81A07BE4587471
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZX.v.....X.v..v.....-...X.v..v.....-...X.v..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............H.o..N.....v..a.....N...^....................59N.....3.........f........................................I.qk..B.....LZ............H.o..N.....v..a.........H.o..N.....v..a..........X.v.....X.v.....X.v.........................................X.vj....X.vT.]..X.v.....X.v..B..X.vH....X.v..B..X.v..>.)X.v..J...................;........4...4...4.."..............X.v.X.v.X.v..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........X.v.....X.v....#X.v............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003A.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):40035
                            Entropy (8bit):7.360144465307449
                            Encrypted:false
                            SSDEEP:768:MQhziQo1RKGlyyzYjlxuxwRUj/BN837xRmwH2uDTCn8qXFQziN:ThzrSzalg6O563l4uTC8q1Ig
                            MD5:B1DDD365D87605F96D72042CB56572F6
                            SHA1:ADF71DAD1A62B8A58A657C2EDBDD665A19EB846B
                            SHA-256:06E09DE80C3F32254DA4FE6B2CBAD7C05EF144DD54B8C65745E195BBF7317A2E
                            SHA-512:9C686092CC9524F34EA6CEC9AAE936A6225BCC54DE38DE1786EBA8F532959A80FF885E8664A09E4C318D7CA4B278E807D3D1F135BE55F30979B844FF5EC9699A
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!1....AQ.aq.....".3.5...2B#s.$%..Rr.CS4&6...bE'7.c.DTtU...d.eu...VFfv.Gw.....Wg......................!...1AQaq........"2..4..Rbr#3$...B.s5Cc.S%.D............?..^.f....R*.N{.{f.....O.r.V.;U..~...U.(..>M._.yI.{8,..^.t...s`...j.O..U5t.&&..h.G.6Da.;.....J.......E..QD...C...}..N...tR.....~..].J:.V$.*.r......]...W......4.[.)6..Y_.....4...........m._'HR.a......]U=.....n...0.W..]..K..){.+...w...f...<|..1/.|.....b..-..y....]U#Ctn.7m.._.|..2I;|....tM....q.q.}.N)....'...9&...nR...R..}.........m._.LZ}u.../K....9.~..?.{....V.#..dx.Zk.:=..:.j].....E#....E~w%....J..[S..[......gr...vb.r]..<..ut..i...[P.w....:..Gkn>......#..m...9km`......t).up.....w....VOR.{&.nQI..}...wD.7Ey#n....MO.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003B.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.6353619351564035
                            Encrypted:false
                            SSDEEP:96:5sul7Mg3uFDxTE3/J1Xgi9efoRQytSn77m4ecoB:5szg3u83/J1XN9efoRJI
                            MD5:1D9EB758F1D54C8077E011820450059B
                            SHA1:8BE400396628CC417197FFDAB7A69B2DD6E78498
                            SHA-256:68A4A3420E894C8BBEA80F4E051B8E4353DE56292E1767852560E68D866B83A8
                            SHA-512:B938E3D28DB0054D06DBC124646509D41559AF972B1F4AA28883613A2AC2C8106833AC32F53396B7ABB067D82C2182D9533C880930E085A607F23F3FDB721662
                            Malicious:false
                            Preview:2...>...........v...~...................................................................................................................................2...>...f.......v................................I.......I.qk..B.....LZ.t.......t..Y@...<.......t..Y@...<.......t...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............!.....5.A...e.....N...^................?J|..VF....\...........f...................................:....I.qk..B.....LZ..............!.....5.A...e...........!.....5.A...e...........t.......t.......t...........................................t.j.....t.T.]...t.......t...B...t.H.....t...B...t...>.).t...J...................;........4...4...4.."...............t...t...t...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........t.......t.....#.t.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003C.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:10:32], progressive, precision 8, 594x773, components 3
                            Category:dropped
                            Size (bytes):242903
                            Entropy (8bit):7.944495275553473
                            Encrypted:false
                            SSDEEP:6144:YVxOYlZX2kCWfYoFMXC/sBFC9r+4iEGM4rrcPoWmwkU6FJ:+OwZ2kbFMC/L99ifvokU6/
                            MD5:C594A4AA7234EF91E6C2714CFE1410F1
                            SHA1:C0F720D4CE3196852814D0B7347F0CAA0C6FD526
                            SHA-256:10C833E47BE1C8496F949A6B059C2D79212A4DD66BDE62116EA337FA4FE0B654
                            SHA-512:7313F6545A334F9E2DE5430B2DB5C419C4C8A40E075338DAFCD74970BCC6309786946E5DFB57531612BF4C6269495655706D920FD99922FDACFF9796710DA9C0
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:10:32.............................R.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...v&.F;-v;}FH..Z...N..)Y.......h;C....G.0W..ww...MI..Z+..\.........c..4.1.~.Yo.Y6.&. q...............l.A#.~s?yYg..7ky...r

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003D.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.352195327940627
                            Encrypted:false
                            SSDEEP:48:YuHcDsPY3qX1CI2xEdCNJGtm8EXMRLZX6xIC9Wio9rdQqrDmBXkOJWxIDN3DnrJY:YQWsM8CNJGREXMR1X6xIC9WisRQy6w
                            MD5:FC2AA099973351E4C8CA05E8D3309EEF
                            SHA1:95EAD8E42F395C34CA4FD89C0F366B0760C4AA92
                            SHA-256:B95A476E8A350E61B01805DA8353DAE94275E1F2F188D92DEC10728AD0759C9E
                            SHA-512:99D0799B7D2104AB53A41921E30BFC741E05A059B35B9FA8FEE28F47AD65C1908B7EEBCFB74BD036DB00F13D5CA5562A3E8FBCB3318372B975C193DFECB5F5DF
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.........................................I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'............./c..].N.5!.t ..5....N...^..................~..qC..l..H.S........f........................................I.qk..B.....LZ............/c..].N.5!.t ..5......../c..].N.5!.t ..5........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003E.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:12:29], progressive, precision 8, 598x766, components 3
                            Category:dropped
                            Size (bytes):70028
                            Entropy (8bit):7.742089280742944
                            Encrypted:false
                            SSDEEP:1536:ub4bgbB7g9cKCmSzaNF0jAdAzQKTEFBQqUp/i0yG1pidLHTVX:ub4bIB7Qg2OjbzjgWp/i0yGCZx
                            MD5:EC7811912ACA47F6AEB912469761D70D
                            SHA1:C759BC2D908705D599B03BDB366C951B11F99A4E
                            SHA-256:FBB4573E3BEE1B337077691BEBAE15D6FAC52432405D31396D526D7694A8283D
                            SHA-512:881828150993A8C56E36CDA2051D89C1F6E0322643902C9506392C163E8734A2933A46486F40E5BC8C8D0164E180605E52620EF22FE14540AEA787A38B22E98E
                            Malicious:false
                            Preview:......JFIF.....H.H.....7Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:12:29.............................V.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................}.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....H.yM..? .Z.. .^.x..p.8.A...K.... .\{..)..y....t..=.^y)..v.@.W>. .h.. ..p.:.\)(.$....$.I).....!....E..Z.....&.5.).

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003F.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.336402780247177
                            Encrypted:false
                            SSDEEP:96:PyspyW4oqXyqE5VfXwQT9m3wRQyUfyeig:aspyW4ouoXfXwQT9m3wRJUfyei
                            MD5:966872106F20B04EDA03A23715A52CEE
                            SHA1:F079893CD14047E71541A5A9B1AA81E8475D09F9
                            SHA-256:BFC1D80D4D749CF327F7C6D6C5956C4069EE77B88BB86632EF11A59376404588
                            SHA-512:707F2ED9E4D85D80705088E55AC78433B4B52DE7E507A0551CD955E8B9776876E1F1E572F014E4CABC96AB3AEF8131F904F3F5F644054659B89A3B0B4F30DB63
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.].......]...G..0...\$|..]...G..0...\$|..]...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................<..C....Hv.(.....N...^.................e...sH.3.=............f........................................I.qk..B.....LZ...............<..C....Hv.(............<..C....Hv.(...........].......].......]...........................................].j.....].T.]...].......]...B...].H.....]...B...]...>.).]...J...................;........4...4...4.."...............]...]...]...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........].......].....#.].............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003G.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                            Category:dropped
                            Size (bytes):24268
                            Entropy (8bit):6.946124661664625
                            Encrypted:false
                            SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                            MD5:3CD906D179F59DDFA112510C7E996351
                            SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                            SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                            SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003H.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.336374730862387
                            Encrypted:false
                            SSDEEP:48:asQG1NVxN6y+tWYj4Er0LmX/Km9jnqmo1rdQqrD7hG7BXoqGp0UB+zGbdN1:asX6LAEamX/Km9jnqmkRQyWM3
                            MD5:5E10FF08A7A056B1A2D4E35F2426C459
                            SHA1:C72B33B2EF94C1A03D0A530E115C1E7AED990BA0
                            SHA-256:EF1C8D4E716E9E65FD8CBB70B8CA953BB3A93503665C5174276CEE7A01655F79
                            SHA-512:C58CDAB0DD52AF3E87E173B1D74A171415D573277464A14F52E62594EA102F942644DC84B18E269BE0AEB95E3D867A08DBE2BDB41ACD0C7E00F076FA138E6A9E
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ................-....N..........-....N.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............e..Bz...<.]T.......N...^..................:|.G...J+.v.........f........................................I.qk..B.....LZ............e..Bz...<.]T...........e..Bz...<.]T...........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003I.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):47294
                            Entropy (8bit):7.497888607667405
                            Encrypted:false
                            SSDEEP:768:aQ10VrIBdBvDpQrQ7P9/FUOLG2vTSeG9lkCsMKzXeMBk3CBp:aC0JIBL+QsOLG2+ZAC1KqM2I
                            MD5:7A450E086AD14BA7D89BA5DB3D3AE6C7
                            SHA1:E7AEAFCFCE476390E18C19456BDF6529D863D518
                            SHA-256:BDD997068701ED3A00A224EB694B003C01AC69B857FE7B4147D6C34875B1632B
                            SHA-512:9B6D50A6CDB6081DA107A2CDDB1BD2811A5764994C8E3F67D56CA81084BE0D068C27435154E867199F38688EA65E8DE02A56DCAC47D0F5E55F0FBB6598814938
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..A..Qa"..q..2.......B#...R%.r...$&b...3Ss.4dU6F.cE..'GC..t..5eufW......................!.1..AQ.aq..".....2BR......r.#3.d...b..Ccs.t......$4T...SD%5Ue&Vf............?..M.7(..).:.a.q.......>..[:O...afQ.uCO..U.....go.l..p..YqVklQ.{i.w&.]Z.\+JQw._.n.'.h..,.bj..X.].k&.Q.>gU..f...1|....[...jQ.%Zb.......t..........*..V..j.6....Vj..i.....?...IY.P.....$.j........[l.....S.4.J9.U\.......7I..[..=*N5....xW..../...=?n....uG.D..S.>...8..3........n.S....]k.*...4.>.R.o..{..l.H.#.^....<amG.m&.......,....wDY.W.m.X....We.IR.Nu...y..Z.l.._S.mr.m...y.]m.R.MT...6.5.5}.K..#%..k].7.Y.q]...%.r.7.R^jR..z.K.T[t.a..d.)glW.r.v,.`....O..^..o:.Uc.\..D....f..D......yt.Q...Y.....

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003J.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.464705498625178
                            Encrypted:false
                            SSDEEP:48:AqCY2s4vw40jetuCBOXEwLqFLz1Xy19KooVrdQqrNhBkBX2+k9Jt:Aqr2sH40qeEweXS9KoMRQyNca
                            MD5:FFD48154EAE7962C9A4253991DCA6AA1
                            SHA1:A19C9D268F6622D858BD92D0746D49CB21D858C2
                            SHA-256:7B14B085E242E11E5EEDF9520E62CB6DDA55C1E6EDA5A7F63EB0AA1D12DF2618
                            SHA-512:9079120058AEE24C9CB1B28B64E17F0C34394CAB3A7B3EDF6FC1179E35E5EC16294CBC545A1B385F033D9181B44796FD2A65266B123C8461D9B2C51D6897A614
                            Malicious:false
                            Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZ=.s.....=.s &yQ.?8...q#=.s &yQ.?8...q#=.s..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............[>.MV..=..r[......N...^................DR../.M.Zl.4\..........f........................................I.qk..B.....LZ............[>.MV..=..r[..........[>.MV..=..r[...........=.s.....=.s.....=.s.........................................=.sj....=.sT.]..=.s.....=.s..B..=.sH....=.s..B..=.s..>.)=.s..J...................;........4...4...4.."..............=.s.=.s.=.s..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........=.s.....=.s....#=.s............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003K.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 60 x 336, 4-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):347
                            Entropy (8bit):6.85024426015615
                            Encrypted:false
                            SSDEEP:6:6v/lhPtnlx/QulkWNY2V18A6Akp7eee1VDjMHCyLezyKUX5Gp:6v/7RrIubiA6AkpNhiyKe+
                            MD5:78762C169F8B104CB57DFF5A1669D2DF
                            SHA1:9638B71B584CD636834016A635ABF8D9C0887711
                            SHA-256:E64FDCD0B108737D8B8F7B677029F924031D6BBAA50585D9C3DEF7C7E92ECAF2
                            SHA-512:5ED899AAF73B72DEC32E171FFA112382667D5BF3FBA98C92E313E66C0A6975EA97068F4CD32B62283F18DBD5345C11E3610F7EEAC2F2DE71FC44593180B9CEAC
                            Malicious:false
                            Preview:.PNG........IHDR...<...P.............PLTE......................=l......bKGD....H....cmPPJCmp0712....Om......IDATh......@..aI...B..C..l...^.%.`....>.]..|0.....a...hb...0......q.......p"....;...K..x=...p...y.yy~J....|...\.......y..X.......'...>1...Ky..f....&........N`..f0..b...3.......`Z.3..3.....o.......4.&........SV...4.....IEND.B`.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003L.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.350235821780943
                            Encrypted:false
                            SSDEEP:48:wBsAajw3Ey8Zt+uE6HcXmEc9KsoxrdQqr8iwBXmzpa9ccRh:wBsQd8ZrEPXg9KsgRQy8XkaR
                            MD5:8D390C78AD733409B297B32EB5E84E33
                            SHA1:86E0961DE3AF32F8CEE1AA519694838014725E91
                            SHA-256:7925052E0FAB2B95875B0C0A70324A288508B2F4FA54A6230E3465E33A1AB197
                            SHA-512:5F784B3E8F3B892B4CA4CEAA51067520541C50B76E8E042567A2EAF80168AB381CB912F646B8153FDBADBED46D11FAF086EB51C22A3AFA4E52C2EA853FC59037
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.q%......q%~TNA.>WI.pc.(.q%~TNA.>WI.pc.(.q%..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............o.Y.].....>.bYY<....N...^..................06.L.;'.............f........................................I.qk..B.....LZ............o.Y.].....>.bYY<........o.Y.].....>.bYY<..........q%......q%......q%..........................................q%j.....q%T.]...q%......q%..B...q%H.....q%..B...q%..>.).q%..J...................;........4...4...4.."...............q%..q%..q%..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........q%......q%....#.q%............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003M.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 40 x 617, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):827
                            Entropy (8bit):7.23139555596658
                            Encrypted:false
                            SSDEEP:12:6v/7Hs2NwBW1mtjeSfaTHHy05riYUtr8y8PQvPYzzg979Reip0QPqc:oOsotazy4rStr8y8PQIzWea0Qv
                            MD5:3E675D61F588462FB452342B14BCF9C0
                            SHA1:86B62019BC3C5BE48B654256B5D10293FC8C842A
                            SHA-256:639EADAD468B6B32B9124B1F4395A8DA3027FF7258D102173BA070AE2ED541AE
                            SHA-512:E6EA855B642ED36FA82F8E469A826DC57EB0C36E307045FF8D166F67AF9242C87840833BE31FBE4706DC54100E999D6A3D3A78D0633A3114735818874AD34758
                            Malicious:false
                            Preview:.PNG........IHDR...(...i..........`PLTE...................................................................................................bKGD....H....cmPPJCmp0712....H.s....qIDATx^...0.Cg.;......@j..2c.=~KP.[H~..@..8...?U.g.n.a=.=.).....3..u^(.....L....5..........8.}..T.f.n.a=.=.).....3..u^(.....L..r....s..8.....W]....,..9..G?.a..`c.z...E.p...)Y.P.....#....@9.7].....,..9..G?.a..`c.z...E.p...)Y.P...`b....0.b.+~{.Pu...1..<..0._.l.@O.y.(...V3%..J....s... .(g.+.qyWu...1..<..0._.l.@O.y.(...V3%...%R.L.Q..x..R.<t.o......7.............:/.E..j.da@i..`b..Z......u.>.?...7.............:/.E..j.da@.Dj..9.W....s. .....:.......L...">w..7... .....:..."...L..."..a....D..Ya.l....E.{.@&.|.._...7..D..Ya.l.....{.@&.|....0.J.."z.0s..s....=g ..>........"z.0s..s....=g ..>..l..1...y..g......IEND.B`.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003N.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.342398642863817
                            Encrypted:false
                            SSDEEP:48:Ks6JO436Nt2QDAEX24L1Xz9kqKmoFrdQqrsV0BX4NkpIp:Ksn436NoEXn5Xz9jKmERQysK5I
                            MD5:14A0A6FBF500E97C5FB5C9FF715771D0
                            SHA1:2B390508680343F98ACB87710A00DF0FDA49BDC1
                            SHA-256:296A92807F3D6A1E75F9CF2F6D37CEEC4739161FDCAADEFBCC5DBC1B90F47F0E
                            SHA-512:F524B2844CF2AFE00E0CCF84377FD9FDABF6C799A8A7C301F0FC05452920688B421F0996ABE51156022714D1A91FA68F7C6A7E29B8EFF27A5267AB55A5FAF58F
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.........f.......k.....f.......k.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................-..!....._.....N...^...................w.@.\:..:..........f........................................I.qk..B.....LZ.................-..!....._..............-..!....._.....................................................................j......T.]............B....H........B......>.)....J...................;........4...4...4.."........................z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4......................#..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003O.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 50 x 600, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):4410
                            Entropy (8bit):7.857636973514526
                            Encrypted:false
                            SSDEEP:96:E/pQuIhKZ7u06dICH3AroiTe8DGTl55poBUmLNjpH7MvDHjfm:MpdZtPbknnRPpkLNVMvu
                            MD5:2494381A1ACDC83843B912CFCDE5643B
                            SHA1:98F9D1CC140076D1AE5A9EA19F47658FD5DF0D66
                            SHA-256:5EEBE803E434A845D19BC600DF3C75E98BB69BD0DE473CEEC410D1B3A9154E28
                            SHA-512:0E64CC3723DC41D94910F7ADFB6A0DFB5049350FD15A873695614E4A89ABD78B166BA4E9C8CB95E275FB56981539DECD2A7F28FBC25E80DD5E2DEA8077CC9489
                            Malicious:false
                            Preview:.PNG........IHDR...2...X.......E.....PLTE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................B..(....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.].\TU.?3"...(..L........q.Q...H.*j......W..Xd.ie.f..%.XT...em..m.m.vkik...>.}..}|..{'.U..~......}....s.............,CVu.x.:C..5...;.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003P.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.338768270283132
                            Encrypted:false
                            SSDEEP:96:YZsGsGQlhllEZnf04XjwS96UsvRQycyQi8vA1J8voUz:asgQlaB04XjwS96UsvRJcL
                            MD5:487AD80E5EE44DB0FF518AEE7DF75DB6
                            SHA1:21458A6FB3E734C483BA306E35A84710DB532291
                            SHA-256:C427FDA09FB8E1D314CA65FB2474F2F9B8E6FFF37DC61E776C8F502F10DE7E90
                            SHA-512:67EC9AB3C0DFAEAE7DD75E61BED655578DBA0316B7298953010A81AFDD4ECF8F5C16F23A4BB285730FB89B6F00ED24694FFBA54403CDF4262B4FFDF5584AE3D6
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.rt......rt'.p..+..w.4^..rt'.p..+..w.4^..rt..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............$p..........H....N...^..................//.mF.....7.z........f........................................I.qk..B.....LZ............$p..........H........$p..........H..........rt......rt......rt..........................................rtj.....rtT.]...rt......rt..B...rtH.....rt..B...rt..>.).rt..J...................;........4...4...4.."...............rt..rt..rt..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........rt......rt....#.rt............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003Q.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):136726
                            Entropy (8bit):7.973487854173386
                            Encrypted:false
                            SSDEEP:3072:SIXmy5Tl704vW2ZKkvV8UU0ZWUF0BJwySIdgz816YzDc1+opecYPn:Sny5Tl704fZFV8UU6LGXwyS4xohpQPn
                            MD5:4A2472AC2A9434E35701362D1C56EDDF
                            SHA1:16FA2EA2D2808D75445896E03B67A93000EEDDD8
                            SHA-256:505F731CB7707EFAB2EB06685B392DC7E59265A40B55AAE43E5DC15C0A86CBA4
                            SHA-512:5E28D8FB2AC62ED270968072A30013334461F7CAE96058AF9EAA6E10912989DC47112D2133892BF61F7A516B77C6FF71BA2A000B750A9F95C787E538B09595C2
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQaq".....2B....R#..b3...r...C$...X.....Sc...9.%'.(Hs4Dgw..T..5GW.x.)......................!.1..AQa"2.q.......B..#c........b6.Rr.3s$.&..S...C4.%5............?.........(......(......(......(......(......(......(......(.G/.GE&...)..P.x..B.({i2Y;.z?G...Yfc.)H..^....#.....}3..Sc^.H..+...M.a.P.....GS.....H_.3..<....1f........1.<.\..nn-..s.s.\9Y....=.......S.0.......N..cA..Io..r.3..........ay.....K.....,.;9..Q......xO.Fa.2..>........{4k.....|....?U....3.8..._/3....#.. t.y......yY.......e.<........#.....B.....Z.%.Y..S.ye.W4...l.......X...%.@y}>....l.yi..D..W......L..._D.Q....)...E....n.%...*..K.4#.8`..I....h..h.o..I......-...hB...3..u.(5..........n...,.@....a.t.9.....@.s.>.&...@

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003R.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.348413067407403
                            Encrypted:false
                            SSDEEP:96:7WhsBRNsuvpAEKHPXMp69WgYRQy4c5jo+WyDoPZl:7WhsrNssdAPX269WgYRJ4c5jo+WyDohl
                            MD5:D6712CA5DEF610DBBC5164A46A60B845
                            SHA1:2CBE4C54A8EE25D37D88A69D96733A84C89A83F0
                            SHA-256:8F6A1E44E3BC41AEB823A872FD24E47FE0D6292A81CDC78C1B3D1C95DFB5F9EA
                            SHA-512:54B48C29E5D61A9641A09275B78934B9B7CA4AE17F0A467A19036B997563D0B79708C5096C598AA7CB79FCCD6CA531D230AF44443D43F606723321F14E131130
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZo.......o..b..........io..b..........io....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................c...+......G....N...^.................W%.6.N....ksgc........f........................................I.qk..B.....LZ...............c...+......G...........c...+......G.........o.......o.......o...........................................o..j....o..T.]..o.......o...B..o..H....o....B..o....>.)o....J...................;........4...4...4.."..............o...o...o....z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4.........o.......o......#o..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003S.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 77 x 627, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):5136
                            Entropy (8bit):7.622045262603241
                            Encrypted:false
                            SSDEEP:96:djzuNKb3XHco17p2wolIxIx7lpskdsC/ddWNKeabJbMojpxLDTu1:VzuNKb397pwlIxKp7qs3bJb5FBTw
                            MD5:FA38AFA965141EA3F17863EE8DCCDE61
                            SHA1:2B4611E651AF7549C1AA73932B1136B561A7602F
                            SHA-256:E1CB1A0EC9BE62D5445C73AA84DF38234002A7E164EE830C9DF24997802CB5D2
                            SHA-512:A372674F5CA343321BA9C413D346070709F7685706C9C6C3DC7F61846B59253A5E6FE800DBA10AE870FD3887439B2AA106FBBB51751E92A163938A4393C43E28
                            Malicious:false
                            Preview:.PNG........IHDR...M...s.....}8nv....PLTE.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................z`.....tRNS...................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003T.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.415765426967799
                            Encrypted:false
                            SSDEEP:48:zWsLBso9Kzk0at9Sth4EBDXYHk+x9ykoCKrdQqrpDEDdV+rDBXOs2DJ+u/Z:vLBs5zk0an3ENXw9ykZKRQyg83g+e
                            MD5:00A0D0002678E2FEBCD8C43630FBDC66
                            SHA1:1939DD751C8CD304AA47B38569235FEA0C74DE74
                            SHA-256:1458AB8AD53103CBFAA167DD48BCDCABEBC9DE9914CD9D7689B5658B8447A725
                            SHA-512:65F4E8917C0F606D716AC1689FB4896B17962F536820C7B1F7DBE06D1858F55C1A31DE32792857775EB2253CE4BC45DFAEC75325E1724BEFE40E61E30434A874
                            Malicious:false
                            Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ.mE......mE7..*...K3.V...mE7..*...K3.V...mE..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............q...q..3...o(z.....N...^................\(..*.J.3.#?..........f........................................I.qk..B.....LZ.............q...q..3...o(z..........q...q..3...o(z...........mE......mE......mE..........................................mEj.....mET.]...mE......mE..B...mEH.....mE..B...mE..>.).mE..J...................;........4...4...4.."...............mE..mE..mE..z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........mE......mE....#.mE............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003U.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):52945
                            Entropy (8bit):7.6490972666456765
                            Encrypted:false
                            SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                            MD5:AD003F032F32FAC4672D4CE237FA5C5B
                            SHA1:AE234931B452F0D649D91291763B919CF350EA49
                            SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                            SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000003V.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.389292139772903
                            Encrypted:false
                            SSDEEP:48:zW+spcybcVq816Otm3IEbLQXXkXMv49q93VrdqrbE33BXA+Z92Md2sZUhKA:Nspu1kONEbXXP9q9FRygHZu
                            MD5:B3D2AAD18EEC98E903C71D6FCA089B00
                            SHA1:325E9857D266615CA0FAD44F2A1913184A1D49D3
                            SHA-256:122C340D2F9DCE41B93A96643D03B78AC9430C43E2202473E3CDC89499263653
                            SHA-512:F7D2CE73B0124FB1F831DBE284159E476F124C543546F57F51542044E179C973B75B1FA65E2278F817FCE648EF4C71DEA7DD9D616796A5FA7DF1D0FDF99F14A7
                            Malicious:false
                            Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................(.......(.^..U."..>.....I.......I.qk..B.....LZ.(.^..U."..>.....(...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............>.I5....b.M:.=....N...^................0t/.2.E...i............f........................................I.qk..B.....LZ.............>.I5....b.M:.=.........>.I5....b.M:.=..........(.......(.......(...........................................(.j.....(.T.]...(.......(...B...(.H.....(...B...(...>.).(...J...................;........4...4...4.."...............(...(...(...z...y.. x.. ...........$........4...)..7)..7........................;........4...4...4..........(.......(.....#.(.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000040.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):79656
                            Entropy (8bit):7.966459570826366
                            Encrypted:false
                            SSDEEP:1536:2kuUliOeU4os8ii3nF3Hxro/qxXD9u/kjYgMZqoEs6ZUldm:3uUsOXYIAixR2k7WAZV
                            MD5:39FF3ACAE544EAC172B1269F825B9E9F
                            SHA1:2D40DE8D90BD21D56314D3F99CEF4FBAE3712C0F
                            SHA-256:70475431CCA3C91A4EFA3B8F04864371D2D3A45696674A1A0562FE9CD8DB287C
                            SHA-512:3B9F3B32696AB7779864E83DC0C45960114A130BEE0CF4D0643DE57FF952171E5D775AA49141EE31A28A9B5D052B26EB421F26EA736D7EF4B3A7EC812CA411CB
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1A.Qa"..q.....2#..BRb..r3$.Cc..Ss.4...D%5&..T...'7....................!1.A..Q.aq..."2.....B3.r.#..R...bc$4..D.s%............?..Y..T.o.\......=.a..j..'^..s..[../........Y.......<...(..4.....7y..Ln.[9.cK.ilN...u@$.V.9.V?3..s.KL.z..w.jW.C.............@.~+.o?o8...k....,.m..9.".....q.....d....z.W...q...~...'..e..>..f#...S.....F....pU.......7..N.vfK......S..G.#.....}.c.........RXt.bq1.`.....[+8\.*.N..:......}.....r..........')......Na...&...m......c...a4_%d.............co..0.n.L.Q..E.Lt..y.|..F..4.i(>.._..\.eNL8..?z9I:hLgC.@.p....g.t......'.I!d..?1f..R..........|..4.wJ*..%g..~0bt.....*...v.......O...:.~.>~..o.x...9.@>...s.&.E.0/G.c..t.<..F.t.A.z. ......;.........Gp.P

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000041.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.469149284792936
                            Encrypted:false
                            SSDEEP:96:5asGHNHPHlhoV+3ENXE93FJERy2/lvHPHqH1YHCHrUHu:0sGHNHPHlhoVxNXE93DERyolvHPHqH1Q
                            MD5:4612A2618EC4D9474A7F9C23DA52D3C1
                            SHA1:8915705CCD9989FAC63C4F44BFEE9094A39AA6F2
                            SHA-256:C1F549562B9F8A25527E294F130C19668EDFEC5057E3C8CC0C2A58C2D60521FE
                            SHA-512:0E3FA64E93A2C3CDC710D8D5D5209F16C8319CEDB589DA642267A4977AEFA0DB46DF208FBD29F45AB91A4565B3801469AA29E04F545C6EFAEF82EA738D22C2F5
                            Malicious:false
                            Preview:2...>.......p...v...d.....................................................?....?........................................................................2...>...L.......v................................I.......I.qk..B.....LZ.r.......r......$s*..r...r......$s*..r...r...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............k)..*...!}.........N...^................v....6O.{.n..P.........f................................... ....I.qk..B.....LZ............k)..*...!}.............k)..*...!}...............r.......r.......r...........................................r.j.....r.T.]...r.......r...B...r.H.....r...B...r...>.).r...J...................;........4...4...4.."...............r...r...r...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4..........r.......r.....#.r.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000042.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):40884
                            Entropy (8bit):7.545929039957292
                            Encrypted:false
                            SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                            MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                            SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                            SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                            SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000043.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.34006258912763
                            Encrypted:false
                            SSDEEP:48:YuwrDsnEd28xq7+t8ZtSxEf9+XX89v4DobZrdqr3sNRXB1t8HEf/RPR:YRsyq7+t8ZYE1+XX89v4DOZRy+L
                            MD5:ED566CF131958FB73F67D75BC25BBD6D
                            SHA1:F8531165125E9A549A2343DE6D95D145326C2B94
                            SHA-256:F7CA946FDABB5FF439399AF353BCF436C6684424F853A1F1BC58A1173C7E0A70
                            SHA-512:DBD0F5FDD04E7FA705D5796C9A94FD89912D9AA21FA6896C9E363791C1E5AD34CD8FDE4D24D9F5458D17D91347E5C1C5DCF1328420614790920EC23F84AFA5D3
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ................0.*w...........0.*w........I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'........................,...v....N...^...............8B....H.j.............f........................................I.qk..B.....LZ.......................,...v...................,...v........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000044.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                            Category:dropped
                            Size (bytes):68633
                            Entropy (8bit):7.709776384921022
                            Encrypted:false
                            SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                            MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                            SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                            SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                            SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000045.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.436409310311845
                            Encrypted:false
                            SSDEEP:96:57asSsj73KEg3abmXxXs9lVAQRyw9fRlU:57asjjjng3abmXxXs9lVAQRyYfR
                            MD5:E0A5F5D3091D20E28CB67D6C0F87019D
                            SHA1:E71B4D00759ECA0E854DEACED08CD8B6CC44412A
                            SHA-256:FE49A9DFCAF7ACE6E4163B8A65EF25CBE97180D3BD1A1444F099D23CF3758F48
                            SHA-512:F6063F1EC1C1448F20813B872B5D9E00FD0B71B72DA989BC62FE31121021A2EACCD1B3909A8283AAE4ACF7472CF3F92A389FB22D84D78A68F5A0BB3F0903D280
                            Malicious:false
                            Preview:2...>.......t...v...h...................................................................................................................................2...>...P.......v................................I.......I.qk..B.....LZ...........:.*i...7$\.....:.*i...7$\.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'........................J.......N...^...............ApQ..GBF..*..S.........f...................................$....I.qk..B.....LZ.......................J......................J...........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000046.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 176 x 513, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):11043
                            Entropy (8bit):7.96811228801767
                            Encrypted:false
                            SSDEEP:192:YyroOCsBI9pkCFsHHX2RE6VOlPuIqmBtJNBfAr+ADP1IATaNeTyZ4GF+WQQ6Qwq2:BUOCsB2kCGH32RiPDtDBfArPDP1I/eyM
                            MD5:8E9AB9C28B155A66BC5C0DA5E2A4EFB5
                            SHA1:972E61F162D48F1CEE21963ECBB2FE439105DB55
                            SHA-256:B243A24FA13BC8523450E22F408F9EFF15301C938F8CA52A57018B58CE6785DE
                            SHA-512:12062D69E676B3B34AFCEF25AC17B40294282D5BAB6C0110680293D7CC96EC17EBCFE104C284E64A30EE3C483E319E9C37C03F6EE82C79632180E45C7A684E8C
                            Malicious:false
                            Preview:.PNG........IHDR..............`....`PLTE............................................................................................... .......bKGD....H....cmPPJCmp0712....H.s...*YIDATx^.]...,.N.8.i......0..e..y.......8.6....Fo.........=...F..._..........O..{..............3.|.L.|.............>.....v..n.1J...k...."....7........J._.5LQ`..k...._Z.W.x:..k...g..._.....u<.Q{...1...q6.cs...l............30.g...< W...a.5..>O....9}..c..........s|I.).>.fo4.<q......>...c.:.u..co.#.7,.O..G./.K.|..q.p...(.(....iH.......m..+.7...../..{W.l....b....?.`^.q.9L&.>.hN2`1..m...]$.0J....rBy......{.._...G....;.r.Q..;..,...9..F...t;.+..2.Ub......V...8.k..5.........'[..s.H..).......%j._.&.....BN..V..q...T...#..........0.E&.o7....$..m..8g.f._$..k.8...5......HgQ...L..\.........)B.I.r.(..8.a..$N.9.=..o..Q..(.e.a..O.....c.= .......$0..X.S,..(p......$..l.c.I...=."......g....^..#~,&.a9iK..ZNE`...pFJ.@Wd?.<..Bt.E.......e...i.%d...}.!..B......9.........B}.....5...;..hL.D.....4z.....|.)

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000047.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.331555813985236
                            Encrypted:false
                            SSDEEP:48:UsuBeFGQ8tGWeEQLgXqxx9N12oZrdqrTzzGRX3ps9eC1Lp:UsvGQ8teEQ8Xqxx9N12QRy/zGra
                            MD5:AC81A6D754C0F6405FE5A69C1070C4E9
                            SHA1:FE2CB16CB3A56B3DF71C8BDBBC21D6851D8B2480
                            SHA-256:DB30B75B4E2AC30F376FAB7DF14F0D8A791A8A33F417527A02B11784BE444B3D
                            SHA-512:59573A0797F1B17CFA3E3D826BF1333E96D84AE8193D5A40F1D42732BDC6549A396B81030254439D9157751E05B50FC03F3D02C48573D067DAC5A4963EDEB537
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ..............{.-~.x.zo.......{.-~.x.zo......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................l...vE.........N...^................t.GZ.5M.8.V............f........................................I.qk..B.....LZ.................l...vE..................l...vE.............................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000048.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 40 x 650, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):647
                            Entropy (8bit):6.854433034679255
                            Encrypted:false
                            SSDEEP:12:6v/71rwqZMXVs99W1YvpLp/Fvl+f43ocLtuplb+CrGotLRd:+wqWXVs99rpLpNvr3pIx3b
                            MD5:DD876AA103BEC3AC83C769D768AD39FB
                            SHA1:1833603AA9B6A7E53F9AD8A336F96CCE33088234
                            SHA-256:1262DD23AD54E935CFA10FEB1BE56648E43BEF1116696CA71D87E6E033B1CA7D
                            SHA-512:946DB2277213104A3B29EC4388578B05027B974A3093B4CCAD8847397AA51AE308BC6A199E5705E1F901D6E4B1BA34D8DECFD6E5B6685184A307D749D7CFAEDD
                            Malicious:false
                            Preview:.PNG........IHDR...(.........xk....`PLTE.........................................................................................>.S.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.)..1..7w....6.*.H`T6.ha.k.............b!....Ba..C..P.4K..@.....h.E..X....PX+.P.-.....@@"...o.O4....xZ<...B...B..,A..y.s<......b!....Ba..C..0_p. .......=..,...i. ...=.j..N...........{4+...xZ<...B....|.....$.K<.vyE..X....PX+.P.-.:... .'p......\,...i. ...=.j........K.....%J..S+.....q..k.H.@DD.s...:..J.K.DDL.\.@`,.DD.:.(]..N....KD....A M.....F..S+.....1.sq........\.t..;..../...~k...4.DD.:..]..N....KD........@DD.s...:..J.K..[...Q....V......IEND.B`.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000049.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.341974689184768
                            Encrypted:false
                            SSDEEP:96:JEsa3Eqxth9EjF0cX4c9rCgRyK+m87Yo:JEsodxmxRXN9rCgRyKr8
                            MD5:4B8F33A8D0906CAE880BF888A0D88140
                            SHA1:AD9B8FFC692CC830F9AA10CE5ABF2AE270BC863A
                            SHA-256:07585A5027237E8DC3E48A33E32D1E190BA217D3AAE627917A4DE05610018869
                            SHA-512:65BDB8403065208804489084F03F4CE5AE7B73F511355FB62B0AF5D1C36BDF1DBA90EC291A2472854C9AED7F4E3DBA4312E9FEA3398E79F5E17F54A30D9782FA
                            Malicious:false
                            Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ[.......[.......#V....[.......#V....[....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............y~.NC...<LF..L......N...^...................ZTiA................f........................................I.qk..B.....LZ............y~.NC...<LF..L..........y~.NC...<LF..L...........[.......[.......[...........................................[..j....[..T.]..[.......[....B..[..H....[....B..[....>.)[....J...................;........4...4...4.."..............[...[...[....z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........[.......[......#[..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004A.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:27:10], progressive, precision 8, 102x792, components 3
                            Category:dropped
                            Size (bytes):52912
                            Entropy (8bit):7.679147474806877
                            Encrypted:false
                            SSDEEP:1536:DB/nIviNJD9C8kfJj6TkVr4q24FsUpjPc021si:DdnIvi3D9C8Cl6Dq24ayPCz
                            MD5:1122BF4C2A42B4FA7F29D3C94954A7C9
                            SHA1:3750077A830FE21735A43ABD35C63BA9A4D4B0DE
                            SHA-256:423B0DD1A93B391D15B1DC8D8757C3BF5725FF2E7A59E6E3140033E2876B67F6
                            SHA-512:4626EFE2EDED2361D6296B57F994DC434CC9D02357A8A6A67D84A544FB8A1CFE0005EA98F846AB963BED7F2B6CE96BC9181182C9459843A52A98D3A731A4FE73
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:27:10............................f.........................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....]+\.9.9.P.d..Z.?~>.-...]6=....*.......S.9G...b<$..Z..........>.v.o:.o%.e...z.F`...[.wo..z.....k..E...5....G..7.......c2..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004B.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.32168008490134
                            Encrypted:false
                            SSDEEP:96:ms8ITx/ZZZEksXb9TKoRy9SOTAoY9oGl:ms5ZwksXb9TKoRy9SPD
                            MD5:F63E0385D5E8F09DE5124A9E9D832A17
                            SHA1:FF13E38B643E06099D1486293B0DF3A67EC941F7
                            SHA-256:087DC5904F2FB83F57C1E373D7C44A3EFE21C9CF50114612F1F72E149E88915A
                            SHA-512:4659571E950A3F2510956BB43C5829A3BBF1A2BF481DE506A70A331796D963DA571146746CF06A89CA9DE68C62507386F805EC8A92A0F200456F698035F062E1
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZs.......s...S-...U.>....s...S-...U.>....s....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............!xn|..b......J......N...^...............k.x.B:hK..p............f........................................I.qk..B.....LZ............!xn|..b......J..........!xn|..b......J...........s.......s.......s...........................................s..j....s..T.]..s.......s....B..s..H....s....B..s....>.)s....J...................;........4...4...4.."..............s...s...s....z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........s.......s......#s..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004C.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                            Category:dropped
                            Size (bytes):27862
                            Entropy (8bit):7.238903610770013
                            Encrypted:false
                            SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                            MD5:E62F2908FA5F7189ED8EEBD413928DEE
                            SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                            SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                            SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004D.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.48673221871746
                            Encrypted:false
                            SSDEEP:48:F0PsRdkZgX36MtfjlfE5zb6XXK9G9T4o9rdqrX4krRXjhpWNao2UpneSx:CsHX3fhVE5X6XXMG9T48RyDre
                            MD5:27D760F7D6D960E0A569477E2CC9DFDD
                            SHA1:4EF7E2B586AFC0A658AE6FDDC30D8C1BF3B7F816
                            SHA-256:54A2811D0AF222D9EE26D740CFA3993409F1D49DD709EB62B118F6FB29AC6487
                            SHA-512:5C8917ABE28841B4DD0526945D6FB37DDFE47B7AA960279F4EBF6F6D8BB05ACAB4F5279923C4C96A624377B9AF9BC34FF1D5DD220833BF1E18B323845CF0CFB4
                            Malicious:false
                            Preview:2...>.......r...v...f...................................................................................................................................2...>...N.......v................................I.......I.qk..B.....LZ9.......9......!..5l.-.9......!..5l.-.9....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............t.5...R...K.+....N...^..................&%JTH.DgY..ug........f..................................."....I.qk..B.....LZ..............t.5...R...K.+..........t.5...R...K.+.........9.......9.......9...........................................9..j....9..T.]..9.......9...B..9..H....9....B..9....>.)9....J...................;........4...4...4.."..............9...9...9....z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........9.......9......#9..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004E.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 50 x 556, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):977
                            Entropy (8bit):7.231269197132181
                            Encrypted:false
                            SSDEEP:12:6v/7QiFJaY/z+obuqFA4fypjQSbtBK+lcqNGSbb7XTJArRRzN5DjNRkPmu5cCbR2:x0QY7xbjy9pY0JPXLTWroeuCCbX0
                            MD5:B7F74C18002A81A578A4EE60C407A8D3
                            SHA1:70A7D4BB1B3ADF4397D168AD0D81B286F88EBDE0
                            SHA-256:95F59A0433050180D4C0E8858B83363D51BEA6752A8B7CA516A8677854D8F5B6
                            SHA-512:13186A7CDCE80BCA9D2238666D6D7A989FA1887EABFA5D8A9A63EEC304DFD4BE8EFF652205FA56E1D1CEE7D3680AF8C70A952AF73AB3C246400E8D4EBECBDBA9
                            Malicious:false
                            Preview:.PNG........IHDR...2...,........A....PLTE...................................................................................................................................................................................$.y.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^...0.D_.......cck.....%a...X.a0Y...-..!.G...[....(.r.H.$...1 .zq.4V.e|a.6.X..4..kl.%....=w....6..TN.....{.4..T/.z...../.....3..!~..t.#b..^.....E!.SFb ...-.....^...,..C.!.b...i._c...s.X.w.. lsQH..H.gKc@@...i. ....m...;Ci....@G.; V{..lO..\.R9e$..{.....P...E.+.2.0D.B,..P...56.?......K.6..TN....^z.4..T/.z...../.....3..!~..t.]b........E!.SFb ...-.....^...,..C.!.b...i._c..Y.O...?.9k2.M.?5 .n.P...,...d._..%M?....6....,.1..R.4.a.R.+..U.Q..P...vd..T........j .]@....."..lJ../.90.4...Y. ...9.%...{......Hc%.....i..%M?aG..H....o.q.......4.......X.d9.r..CI.O.5.Ri0?.s\b....w...>/k..4V.)Y....P...vd..T........j .]@....."..lJ../.90..2..MP..l..?....K.X.....IEND.B`.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004F.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.353645564873936
                            Encrypted:false
                            SSDEEP:48:3wXslVAsDtDoImuE3VpLX6XPHs9D7oQsrdqryJJRX8Rg9Ei9:As8sDtFE3TOXvs9D7jsRyKJu4
                            MD5:AE890B88664F272F3D5E8EE05E222565
                            SHA1:9737D9146C4C0333F6E6253ED25C8720001635DB
                            SHA-256:60874FC2D3A95C22E80DB8673EF036F83DBB47DB4C37445DF52301F93EF4A987
                            SHA-512:258B75C4F5D7EE70838BA9A8F86C87AD511B2FEA338C7D36CAC7304719C226E0DFA5ABBDB86F2DA62FDA23E3D49C68A82817C84255482A69249850FE21AF1A50
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.......#[.`....H..7..#[.`....H..7....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............?Qp..cH....B...B....N...^................0d3.$\@.H.............f........................................I.qk..B.....LZ............?Qp..cH....B...B........?Qp..cH....B...B................................................................j.....T.]...........B...H.......B.....>.)...J...................;........4...4...4..".....................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4....................#.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004G.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):34299
                            Entropy (8bit):7.247541176493898
                            Encrypted:false
                            SSDEEP:768:BrSX4V3P8AIc4KLkHeXRUer0zrhOmXfvG0yH82I:tSXuIc4K2eBtswKsHg
                            MD5:E9C52A7381075E4EBC59296F96C79399
                            SHA1:BE295AD24D46E2420D7163642B658BF3234A27EA
                            SHA-256:D56CEFE9EE2FAE72E31BDBA7DD2AA4426EA22E3CEB22EF68C8F63F9F24D5A8BC
                            SHA-512:95CC96DD4459EBAE623176033BA204CCDC50681A768F8CBAE94C16927D140224E49D5197CAE669C83C77010C5C04C1346CF126BEF49DB686F636C5480342A77F
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.......................................................................................!.1..A..Qaq......".#4.2r3.$.%...B.5U&6....Rb.Cs.7..cDTEFVf'...S..dtevw.u.........Gg.....................!1..AQ.aq.2....."#3.4....r..BRb$CS.D............?..5..............#....v.q.m.}\..{....;...r....h.....J..q|..'.;\..6..v......e...../.k..|.8..i..|..]..3e.m....n..Z.GS..n".y..w.-...[a...7A.....i.4.)9\..~C...=.........s..\V]c.D1<./.g.l.&v..~.h..]....zb>G..y:vNS.\......LU....t.{*..Z#.?..v-...wn.rR...P.....y\=.v....../..9_...m4...V.|.+.o.#.......xj....}..>.s.>C...m.[;.>.p...=^.i.X.(..1...{.F#N.W...xi.z...4..u[{...yO.....8..}\..2...KlX.nbya...2.&.F...R.b.k.7.GV.x.h.y\.Q..O<\>......-...=...r......\......Z.Z...Jf.'....z..Y.q>.p....o..K....h..R..c.lg?......A.Z...Y.q3.L|.'5...

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004H.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.330613975125796
                            Encrypted:false
                            SSDEEP:48:y/nsTsFWkGftS8tYA7EHSFLUXyJ29MgzMoBrdqrqGpRXzpml6V:y/nsSG88qyEyFwXy09bMYRyfpw6
                            MD5:440CF16C15053D8568695F0479BC7A72
                            SHA1:4905002CCEDAAF35D7F7F175BE75353AA0D94723
                            SHA-256:36F379B3F5BF36C4C11D0AC650BE03A20AD2B6AE7F88D85F5C2452D8E0FD4CAA
                            SHA-512:45D8D051237D1AD60C5A9C4A2BD49BA3F5C670A05693261F35712DD57C282189E43147D064B2DE11CD7A78682F425F1F723F368BDEC5B3534D59EB80AFE5ED9F
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ1]K.....1]K.?.....3,...1]K.?.....3,...1]K..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............j..lJ?.&...Z......N...^.....................4O..&..K5U........f........................................I.qk..B.....LZ.............j..lJ?.&...Z...........j..lJ?.&...Z...........1]K.....1]K.....1]K.........................................1]Kj....1]KT.]..1]K.....1]K..B..1]KH....1]K..B..1]K..>.)1]K..J...................;........4...4...4.."..............1]K.1]K.1]K..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........1]K.....1]K....#1]K............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004I.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 171 x 552, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):10056
                            Entropy (8bit):7.956064700093514
                            Encrypted:false
                            SSDEEP:192:edmu1fpj5DVHuooK4EpGLbAdT+dBXYBR8D1V2p6KwoPR6KUX9ojwRpgA:2Pp/B4LbAF+dBo/1E3S6JScpgA
                            MD5:E1B57A8851177DD25DC05B50B904656A
                            SHA1:96D2E31A325322F2720722973814D2CAED23D546
                            SHA-256:2035407A0540E1C4F7934DB08BA4ADD750FCB9A62863DDD9553E7871C81A99E3
                            SHA-512:BC7DC1201884E6DAFDC1F9D8E32656BFAEE0BB4905835E09B65299FE2D7C064B27EAA10B531F9BECF970C986E89A5FD8A0B83F508BBA34EB4E38B3F7F5FC623A
                            Malicious:false
                            Preview:.PNG........IHDR.......(.....!..t....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4.....bKGD....H....cmPPJCmp0712....H.s...#.IDATx^.w`......$..B....... ....fz5..6`l\.8...Nsz{.//y./....{.7}g.....e.....~.......s...f.....%c...6....O.PJ...Y.oi...9..'j.2..6.-

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004J.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.368193433762802
                            Encrypted:false
                            SSDEEP:48:BZOs+HNtYFOtR+EXh2aLUX/n9/D9xoeyrdqrQHBRXSF+pyF:BYsutYFOKEfIXv9L9xJyRyQhdy
                            MD5:578EE2D9EED147551284C01EEFA2436B
                            SHA1:DEC22516D592BB8ACE8375E6167D55F80A0F82A3
                            SHA-256:2A56DFBC77499EC0EC37638628236F2DFC08D45B8669982C38D0E28C8FB17135
                            SHA-512:33B29E584083E660AA7F48B4537AA7D22DFCAE077EFD6F252D344031A468CE622837E681E8484B3351D72A3978E538047F790CA6617F985232C81C84307C9FE5
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..............7.8.);n.y......7.8.);n.y.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................=q.'.9[.U..=S....N...^..................C.zB....m..........f........................................I.qk..B.....LZ...............=q.'.9[.U..=S...........=q.'.9[.U..=S........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004K.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:11:38], progressive, precision 8, 577x757, components 3
                            Category:dropped
                            Size (bytes):84097
                            Entropy (8bit):7.78862495530604
                            Encrypted:false
                            SSDEEP:1536:cgHTEuD99rHwA5MSadIV2MApVmfJkAKOQ/Z1I7ngpDDyHfKFVITrU:HHjXidIhApV88/jIEmrU
                            MD5:37EED97290E8ECB46A576C84F0810568
                            SHA1:18D9FACB4CFA3CBF63B882CABCF30B203EDF4126
                            SHA-256:140DD943D0F0CFE6AAA98470B7D1A7CB62CA02CB1D8F522DD2AC77433232EF41
                            SHA-512:E0F57314C136211B8253EB2AC0093DED82198E7170D4F97C40D82FD4EC4123D2AAFE3EB4EBC3E7523C4DF4D77619408773871BDE15B6DC6C4049C71D5B9D4222
                            Malicious:false
                            Preview:......JFIF.....H.H.....hExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:11:38.............................A.......................................................&.(.................................2.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....b.xH......T..I...S.q.~..../s.R.x.....8.a..vE.5...-.G.A.4...._......$K..d.@NC.q....J.....>e".I.%...I0).R.I$........M3.F .

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004L.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.324047080466499
                            Encrypted:false
                            SSDEEP:48:bsEWIlCt68ntpXl8EMx8XP/9zDohrdqr8exLfM6RXu78JHBJJ:bsSCt68nh8EXXX9zDYRy8X6x
                            MD5:14180808F08C6ACD40A08A36CE7607C1
                            SHA1:228262FAB0BCCE20296A84E1BC321C987FEA60DC
                            SHA-256:E87EC9A717BD72796D706CAC3C3EFABC57039D8936F4F2603703199078581093
                            SHA-512:F49D5F171F4F186490FED50F46F592E8E2B32364ECA33F80F35DE37F5409B589FBD43900F0550715EC5341672C0046F00808F9D60A7C4FB941B08D91265FE7D2
                            Malicious:false
                            Preview:2...>.......L...v...@...................................................................................................................................2...>...(.......v...t............................I.......I.qk..B.....LZ%.4.....%.4n#:.......J..%.4n#:.......J..%.4..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................njh.....".sk.....N...^................+...@.pD...T........f........................................I.qk..B.....LZ...............njh.....".sk............njh.....".sk..........%.4.....%.4.....%.4.........................................%.4j....%.4T.]..%.4.....%.4..B..%.4H....%.4..B..%.4..>.)%.4..J...................;........4...4...4.."..............%.4.%.4.%.4..z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........%.4.....%.4....#%.4............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004M.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:26:15], progressive, precision 8, 216x792, components 3
                            Category:dropped
                            Size (bytes):64118
                            Entropy (8bit):7.742974333356952
                            Encrypted:false
                            SSDEEP:1536:ORG4azGOKXzkEmR4bdRSbxONOoz0khbSb4J/5GZK5SWUlRwUYdv1M:ZXzGXzJdhRmgHfIb4J/5GZK5SWUldYdq
                            MD5:864EEA0336F8628AE4A1ED46D4406807
                            SHA1:CFCD7A751DFDBE52A20C03EE0C60FDFFA7A45B93
                            SHA-256:7CE10D1EA660D2F9CF8B704F3FAB2966A4CE2627D9858D32C75D857095012098
                            SHA-512:0CAA0C54C14571C279A75F0D5922F78A17803CF6EE1724D66819F7F5944C0F5B25CB586BB686A52808CDF2F8FEB3E4864052A914884054EF7DE44124A8CA951E
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:26:15.....................................................................................(.....................&...........s.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................#.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....NC+n....<.=.7..&.8A56..@^.Q..\\...E.>..".&G.......J .'....$.I)........0.../..mv...D....<v0=..ugc+..l.o...=.c.......x.&D..{`8...v

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004N.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.345003505445993
                            Encrypted:false
                            SSDEEP:48:isyT3knT2TqHW7ttcEpiXQK9AG5oCardqrvC5DRXEnB2T2ThTDKTpT4mT76jl:isXHW7ME4XQK9T5BaRyvC0VO6j
                            MD5:3B7426500FC569CF31E32ED09994D49A
                            SHA1:E3EA23F290D2558665076860A4E967209A68D450
                            SHA-256:69048279FD629F6552B79A9E889F2CA746319059951FD12454FA703BEB3906C4
                            SHA-512:F8E3CF409EDD15955B3A85A7B17DD8BB7252ADA1943EDC355C7A82FDBE4467180B559FC92015DB8081C4105C49FF8E22D83BDAE0D0B9C2F3A13B76FAB54F64A0
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ...........0F<9....C./....0F<9....C./......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................i....+.;A..O6....N...^...............z. ....K..............f........................................I.qk..B.....LZ...............i....+.;A..O6...........i....+.;A..O6........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004O.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:09:29], progressive, precision 8, 609x675, components 3
                            Category:dropped
                            Size (bytes):65998
                            Entropy (8bit):7.671031449942883
                            Encrypted:false
                            SSDEEP:1536:klZtmExaFrtWgpc+Sg+DKeplHClpHfRtPMbe:VEWWl+SNDKqlH8p/vse
                            MD5:B4F0A040890EE6F61EF8D9E094893C9C
                            SHA1:303BCBA1D777B03BFD99CC01A48E0BB493C93E04
                            SHA-256:1F81DDE3B42F23F0666D92EBF14D62893B31B39D72C07AEE070EAE28C2E6980E
                            SHA-512:8F07E4D519F2FD001006BB34F7F8274B9AF9EC55367B88D41D24E5824FCE4354FD1290CE4735E43930829702ED53F41DF02C673904A7091E9354C28E029AD4EF
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:09:29.............................a.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..-O..s(...gO..@...[..+....+...H.'m........L.......@.......[k...S..O..p.'{X..3......]W..w.+.V....[.-.....2..i..i$.p.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004P.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):8192
                            Entropy (8bit):3.238519072068941
                            Encrypted:false
                            SSDEEP:96:esNz1WmdgTle2+WEcAqXXBsy9DZNqNPgR0Tqhe1EVMSi:esNz1zgTleTc9XBsy9DZMIR0Ce1EVMS
                            MD5:9DFC7517B3C5B507FE93136BEEB2F304
                            SHA1:3258AC78586AC0FE57B3212BED8C0600934DFD19
                            SHA-256:5FAAA4FAC6CA47BDC52D6F9957BE32AEF4AD4C6A94F8BD8CB6FE338CEC8490FE
                            SHA-512:4C46A7333E520966663631110043CE8F28E550630C81ACB312C2B28C1CDE195BD7967F01FA99F6DBBF6B5A2B08B521AA33A9054CF297457157E39FB98DB54AB5
                            Malicious:false
                            Preview:2...>...........v.......................................................................................................................................2...>...j.......v................................I.......I.qk..B.....LZ.z.......z..#.....D'....z..#.....D'....z...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............:../..|.E?..M....N...^...............q..^...L.3[~.V..........&...................................>....I.qk..B.....LZ..............:../..|.E?..M..........:../..|.E?..M..........z.......z.......z...........................................z.j.....z.T.a...z.......z...D...z.H.....z...N...z...?.#.z...9...................;........4...4...4.."...............z...z...z...z...y.. x.. ...........$........4...*..7*..7...........Op.b..F.$..i.................;........4...4...4..........z.......z.....#.z.............................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004Q.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                            Category:dropped
                            Size (bytes):32656
                            Entropy (8bit):3.9517299510231485
                            Encrypted:false
                            SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                            MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                            SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                            SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                            SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                            Malicious:false
                            Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004R.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                            Category:dropped
                            Size (bytes):12824
                            Entropy (8bit):7.974776104184905
                            Encrypted:false
                            SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                            MD5:2628353534C5AD86CBFE57B6616D46DD
                            SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                            SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                            SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                            Malicious:false
                            Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004S.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                            Category:dropped
                            Size (bytes):32656
                            Entropy (8bit):3.9517299510231485
                            Encrypted:false
                            SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                            MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                            SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                            SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                            SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                            Malicious:false
                            Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004T.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                            Category:dropped
                            Size (bytes):12824
                            Entropy (8bit):7.974776104184905
                            Encrypted:false
                            SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                            MD5:2628353534C5AD86CBFE57B6616D46DD
                            SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                            SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                            SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                            Malicious:false
                            Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004U.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                            Category:dropped
                            Size (bytes):32656
                            Entropy (8bit):3.9517299510231485
                            Encrypted:false
                            SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                            MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                            SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                            SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                            SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                            Malicious:false
                            Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000004V.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                            Category:dropped
                            Size (bytes):12824
                            Entropy (8bit):7.974776104184905
                            Encrypted:false
                            SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                            MD5:2628353534C5AD86CBFE57B6616D46DD
                            SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                            SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                            SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                            Malicious:false
                            Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000050.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.340878191924927
                            Encrypted:false
                            SSDEEP:48:YuasCgRvClg4ggrN0XCHuStNZWjtxEya7+KX/+K9FdljdcCrd3rNx7RX/Fsg4gl5:YlsJgr8CHfC/EyaSKXmK9TlOCRbbx
                            MD5:C7D759546E4F3D942D2159C79257C771
                            SHA1:CC2B29C2419B030E06984F5D256B9A33C07AF7E9
                            SHA-256:1401A500EA5704ED79026D75DD671EAC124EF1C59688DE9A516EE12C53882C05
                            SHA-512:11D103D0BA195F96BDD3C40DCE7600FB95AE31259FA2BD02BF1A1BDD36F3650AED0F7EF51CF4F63453A8D912B284A879D0ACA6C900D8CF57BA42748BAD50BD97
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZWn......Wn.p\!_....|I,H1Wn.p\!_....|I,H1Wn...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...................m...<."\......N...^...............p6...]L...z.^w.........f........................................I.qk..B.....LZ..................m...<."\................m...<."\...........Wn......Wn......Wn..........................................Wn.j....Wn.T.]..Wn......Wn...B..Wn.H....Wn...B..Wn...>.)Wn...J...................;........4...4...4.."..............Wn..Wn..Wn...z...y.. x.. ...........$........4...*..7*..7........................;........4...4...4.........Wn......Wn.....#Wn.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000051.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):39010
                            Entropy (8bit):7.362726513389497
                            Encrypted:false
                            SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                            MD5:9700DE02720CDB5A45EDE51F1A4647EC
                            SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                            SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                            SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000052.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.416818788341292
                            Encrypted:false
                            SSDEEP:96:NsZCr7q7BcuXE+pXk9WzKRuRbp6GsGZAG7GRGsGAwGfG:NsZCPAqHUXk9WzKARbp6GsGZAG7GRGsm
                            MD5:628A7F7BABB691704AD9DA10A850CACF
                            SHA1:60D5081F41BE0F2C7E91215E79D8DAA3A44DDE06
                            SHA-256:B2B357EDC4003663A495F1329D2D3B261D465871100B8D12560C9F7F7EBDEAA3
                            SHA-512:FADC4A5259B2AB7FD0801171C132B6E33EA0D624D37B5021EDC4605D414495F5EBC3B51708D033EF41D2116F1CD3270190FD212DECD281FD265B2E3DFB15AF76
                            Malicious:false
                            Preview:2...>.......h...v...\...................................................................................................................................2...>...D.......v................................I.......I.qk..B.....LZ..O.......O.).~...)U..."..O.).~...)U..."..O..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.....................:.ZQ..NC....N...^.................?3H..G.d$E.`.........f........................................I.qk..B.....LZ....................:.ZQ..NC................:.ZQ..NC...........O.......O.......O...........................................Oj......OT.]....O.......O..B....OH......O..B....O..>.)..O..J...................;........4...4...4.."................O...O...O..z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4...........O.......O....#..O............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000053.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):25622
                            Entropy (8bit):7.058784902089801
                            Encrypted:false
                            SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                            MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                            SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                            SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                            SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000054.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.324619518184479
                            Encrypted:false
                            SSDEEP:48:Yu+NsztS7ABBZZ6PnjMtB0m8EHGK2XTT89shj4Nrd3rUgxREyBdXaC+vReZBH0C5:YVsrnQjMaEmNXTA9shARbthkxu
                            MD5:71B7CF95248F08A3531BCE87FC5BB892
                            SHA1:BA038881AB94FCAB08EB855751B4203427B4FCA6
                            SHA-256:8A3F3733528F0AFA1C9ED2F0B4F03BB6FA16859819A3645E411BADD563A39DA0
                            SHA-512:C3872E445DC5EAFEA80D4204115FEF715A9318AEC17EF555FE26E591496B43B816ED6680BBE2DA5EE6930B9E08B81E72A1E9723421552090669199BD0D996F16
                            Malicious:false
                            Preview:2...>.......P...v...D...................................................?....?..........................................................................2...>...,.......v...x............................I.......I.qk..B.....LZ.s.......s.2-7....4.1./H.s.2-7....4.1./H.s...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.......................LU.......N...^.....................@.F.U.Cu.........f........................................I.qk..B.....LZ......................LU.....................LU.............s.......s.......s...........................................s.j.....s.T.]...s.......s...B...s.H.....s...B...s...>.).s...J...................;........4...4...4.."...............s...s...s...z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4..........s.......s.....#.s.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000055.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 50 x 500, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):2033
                            Entropy (8bit):6.8741208714657
                            Encrypted:false
                            SSDEEP:48:P37XYSDTz+UUl7DHt7Ah8l1+4ZfFclFUXwobKXlZr:v7j3z+UoDN0h8ugf2AwobMN
                            MD5:CA7D2BECCBC3741D73453DCF21D846E0
                            SHA1:E34B7788498E33FFF0CFB00125E6BA9E090F6CED
                            SHA-256:E9EAD0BFC09D32CB366010CDFEDE1C432A2D1D550CB7332BADAC1BEE9482BC86
                            SHA-512:7FE2C3654262B1EEBED4F6D83DA7D3450E1BE52500A3964185FC0092041506A237A2728E5D7EEA0A3814E413E822B803B789C49CF744D51816A2E4EDE5B4247B
                            Malicious:false
                            Preview:.PNG........IHDR...2.........H'......PLTE........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.\.W.G...=a.ewA..a.!r( ...%Dc..x.x....N.OO...3=...S...........~.z.D.0...g.2P.7.*M.#'....z.......3TPj.Z.[5....V..z'L3...a.j9..C>..9.z

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000056.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.353104818544262
                            Encrypted:false
                            SSDEEP:96:nVgBscw6X815E8/X/1Zv9EEoRbmhyf4dKbuRVsbOhG:nuscw6N8/X/9EEoRbEkhbuRVsbeG
                            MD5:F369E415FC44C16D565588E1AE99E6CF
                            SHA1:8FBD4F83D60ED5D71669D95F0B6A09F41D2D9D80
                            SHA-256:BA21BD822D595D3A345BCD21C66AF3E098105DD302BF3C8D5850B48B869ACC5B
                            SHA-512:A49A662D308E2A25DB967ABA6E439999D2ABFEAA3B8756A196F98C3C5C825A193D7C63D550608CEDCCE85EDE5EA254E9589B9AECB953BEED23AE992A2CE4DB44
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v...............................................-...I.......I.qk..B.....LZ............-.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................<.K.....A.....N...^................x....@..s.............f........................................I.qk..B.....LZ...............<.K.....A............<.K.....A.........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000057.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):55804
                            Entropy (8bit):7.433623355028275
                            Encrypted:false
                            SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                            MD5:4126992F65FE53D3E3E78F6B27FD49DC
                            SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                            SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                            SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000058.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.4499305600001735
                            Encrypted:false
                            SSDEEP:96:8s+OClzch9H9EsXdHB9sYD4RMEFClrNlDWot:8sAc3asXlB9sYD4RMEd
                            MD5:1E8D8E6F3DF0E56108C2C29F1FEAF1FC
                            SHA1:7A96D9B5DF6CD2B0970A3F17854CD57E3D16768F
                            SHA-256:25B5F706DF67ED627EE5A360D95EBF8D06209E7C6F10B4EEB182C8CFC4977907
                            SHA-512:55663B854EEC82F1CEAD3FC27D3C4C0E47930B8EF8983337FAEF02F5600B835BBE9E81BA40E01B225B969D48F42EE91C9AF4C36D018CAA36C871F309BD229C2D
                            Malicious:false
                            Preview:2...>.......n...v...b...................................................................................................................................2...>...J.......v................................I.......I.qk..B.....LZR.......R..w..y..j./..ZR..w..y..j./..ZR....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............,..HV1.<k..w..y....N...^...............T..:/.{E.-.....U........f........................................I.qk..B.....LZ.............,..HV1.<k..w..y.........,..HV1.<k..w..y.........R.......R.......R...........................................R..j....R..T.]..R.......R....B..R..H....R....B..R....>.)R....J...................;........4...4...4.."..............R...R...R....z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........R.......R......#R..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000059.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                            Category:dropped
                            Size (bytes):59832
                            Entropy (8bit):7.308211468398169
                            Encrypted:false
                            SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                            MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                            SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                            SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                            SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                            Malicious:false
                            Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005A.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.36775548994395
                            Encrypted:false
                            SSDEEP:48:WFqstxlA4PJxJ7zaGtUEQ2IXp9PUtpj4JrdMrSAdX82JzQbElZT+og:vslVhzJWEGXp98tpMRMbC2t8o
                            MD5:72714B8634DC13ACF38FA49364B7A006
                            SHA1:3FCA34E05AFF3D689DFE5B7EA41ED53C5E216DFB
                            SHA-256:F505641EA8807C051E5C19FA184D81A872EC097D56B2DEC383286E91BF678A20
                            SHA-512:3AE8B166068E15343A6D885855EE69BC5A7A09DFD0A2D834D08FF7FD1FB43E2425C4E981FD4E0A46CF6DA43E94061B648194929B111F337BE5369A5CFFBE0473
                            Malicious:false
                            Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ.........y.._....r.r....y.._....r.r......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................4.B.|:.....N...^................Ff.x.;C....=.j.........H........................................I.qk..B.....LZ.................4.B.|:..............4.B.|:.....................................................................j......T.^............B......C......>......|.... .3...................;........4...4...4.."........................z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4......................#..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005B.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                            Category:dropped
                            Size (bytes):33032
                            Entropy (8bit):2.941351060644542
                            Encrypted:false
                            SSDEEP:384:ofmqvnCfmqsp1Ue5xzMq+Qh0dffUmS0w5xzMq+Qh0di:AGAp1rmSl
                            MD5:ACF4A9F470281F475EA45E113E9FB009
                            SHA1:B20698DDA5E5AFDD86BB359A6578C9860D5DF71F
                            SHA-256:5DC2367A80588A7518DB5014122510BF0FD784711015EF83A8718336584F82D0
                            SHA-512:998B7DB9DB08FD15A293267E2371052E436E024AF8D34F96D3C8FF04B1316678DFC1674C921CB404121FF381A4FC39DC759E6698F19D42A6261CBD39469B0A08
                            Malicious:false
                            Preview:....l...........................Ac...... EMF........$...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC........................F...(.......GDIC............^...........F...........EMF+*@..$..........?...........?.........@..X...L........................."B...B...B...................?...........??.....n............;...<..@<...<...<...<...<...=...=.. =..0=..@=..P=..`=..p=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...>...>...>...>...>...>...>...>.. >..$>..(>..,>..0>..4>..8>..<>..@>..D>..H>..L>..P>..T>..X>..\>..`>..d>..h>..l>..p>..t>..x>..|>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...?...?...?...?...?...?

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005C.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 3005 x 184, 8-bit/color RGBA, non-interlaced
                            Category:dropped
                            Size (bytes):12180
                            Entropy (8bit):5.318266117301791
                            Encrypted:false
                            SSDEEP:96:k1bHyG/fKOOOOQJUg+g2S+kEm6alfsfsfn32:+bSG/yOOOOQ+g+gOab32
                            MD5:5C859FF69B3A271A9AAB08DFA21E8894
                            SHA1:3156302A7450ADFF4D1B6EC893E955D3764D4DD4
                            SHA-256:B4A8E9A67EE0B897615AC4CCE388FFC175AB92D9E192E6875C79A4E7C1B5BB6E
                            SHA-512:4CF518136EEBCA4F400A115D9B7BB0CAC9FA650BF910B99E15F04A259B7D3EFCFFD6796886FE09DB08C37C332B14BC8500845C09C8EAE1F2306F90E98D3C99E0
                            Malicious:false
                            Preview:.PNG........IHDR..............;j.....sRGB.........pHYs..........+..../9IDATx^...dW...S=.dL$.............-.`...'...x.7.D...(...$.?cO....9S]=.v...Z.......{..wNuf.&.....a.k5~...._..\.yk..v.....}{._.Q...5...._9o.n.....}7.].1v..t......q....3.<..0<.p.......0....s...... @....... @....... @....... @....... @...X.'..U-..... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%@....... @....... @....... @....... @....... @....../)m.. @....... @....... @....... @....... @....... @ ....`.)....... @....... @....... @....... @....... @....K.0.....J....... @....... @....... @....... @....... @...`.....\.... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005D.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.336226858589528
                            Encrypted:false
                            SSDEEP:48:AbsGQJgVrUbULltngD7EPEczowLl7Xvg98svp5BrdMrYjx4YWQXHb09YmB:Abs6VrUbULlCEsAowpXo98GRRMpGe
                            MD5:22D87E9F0F0C27AD7C9D801DCD0E04FD
                            SHA1:56B38EA56F86B66097DC0621E3B43D367C49226A
                            SHA-256:763DA843FBB1BAA9E5093DDF93827DBE7254FC31993CDE6FC06D123316D13C77
                            SHA-512:6EBED150DD9544F13A8007665F62C6AA652C606931733602786A5FE98D12A8A73E2B204C13F7C5C0A22D0DA0B2ABF43475063C78F65DF8DAB416B6DCA447ABF2
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z...........................s.......s...Nu...[.....Y.I.......I.qk..B.....LZs...Nu...[.....Ys....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............m*...w.2.s..z......N...^................j....A.6.............f........................................I.qk..B.....LZ.............m*...w.2.s..z...........m*...w.2.s..z...........s.......s.......s...........................................s..j....s..T.]..s.......s....B..s..H....s....B..s....>.)s....J...................;........4...4...4.."..............s...s...s....z...y.. x.. ...........$........4...+..7+..7........................;........4...4...4.........s.......s......#s..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005E.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 39 x 600, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):2104
                            Entropy (8bit):7.252780160030615
                            Encrypted:false
                            SSDEEP:48:2PPEOtz2P/LJtVRaqBG8qFOPvHlcEXgkuwf+j:2PZFSjJDjqFOPPlXgG+j
                            MD5:F6C596F505504044DF1E36BA5DA3F09B
                            SHA1:BCF17EC408899B822492B47E307DE638CC792447
                            SHA-256:EDBB86F160050FBF1F9860276802BAE292DBFD0BC98E3EA90D43D981E9F0C54A
                            SHA-512:E8D067A1932CED8746FE7D665EEC34EA92A98AFF3DF26FFA9DD02742DDEA3C5654124A88A649FA33DB596F96A5FC9CB2C693D03132F1C8B254ACB56DB4763BD8
                            Malicious:false
                            Preview:.PNG........IHDR...'...X.......:....PLTE.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................{.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^..c.%i.F...m.m.f.m.m.m{&....X...9.....M.WUW.d.N.O...E$...$...)H....n....N.k..v.....v1L[w)w.}..!...Y.X.V.D.......[....;..[..;....

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005F.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.352575558177629
                            Encrypted:false
                            SSDEEP:96:XKsFxZxoxbEm0FJfE2oXrQdI99ksRMci30cxoxpxOxBx3x3I:6sTPSbF0F+pXcI99ksRMci30eSfsnB
                            MD5:AE8DDF3A41F2A1088E581F365A76AA39
                            SHA1:2FB9A0999A130C5A52A8EAC483A87CADBF7B219C
                            SHA-256:3209300FE29E5448DA317A0CBAA47AF961064542E4209EE0055DED8E954727DF
                            SHA-512:26A9BE4AD4C2BE7D82DE953DB6ABDDE0C5EE2494F3F2C16A522B78A72BC1279189422992BAABDE58DA560CE30571DCF708247C3D22D90D7874503E8BE9198476
                            Malicious:false
                            Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................D.......D.1.....{.!P.\..I.......I.qk..B.....LZ.D.1.....{.!P.\..D...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.................MU=........t....N...^................Q....hF..k-............f........................................I.qk..B.....LZ................MU=........t............MU=........t..........D.......D.......D...........................................D.j.....D.T.]...D.......D...B...D.H.....D...B...D...>.).D...J...................;........4...4...4.."...............D...D...D...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........D.......D.....#.D.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005G.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):14177
                            Entropy (8bit):5.705782002886174
                            Encrypted:false
                            SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                            MD5:7CDCE7EEBF795998DA6CAC11D363291C
                            SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                            SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                            SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005H.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.307960130472198
                            Encrypted:false
                            SSDEEP:48:+VxsF3AaQc2Uq/teNEYXL7XxGX49hshpyxrdMrxR2FX1T8agRm69Z32B/lagRmx1:4xsgh/cEQ/sX49hYERM2XxDkZ
                            MD5:F3FC3893DF4ED722F98D774C26468680
                            SHA1:C375887FE54FA6F63A5BA2CF48F51C54DB6FC4D9
                            SHA-256:8B4622211E47627932D7298969141CBA066C1E6C2CEE98157A619ED50C855BED
                            SHA-512:74B1F280BEF4941662F8D758E4A905898954609E75EBCDE570CD366D165EDBBD12B3A9E895EAFF32FB269FB46B4D096F5949FD12B82C8B14907902A053D9874D
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ...........GL3 .$[.8...9...GL3 .$[.8...9.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............@....G..avM ......N...^.................4`.@@J...r..60........f........................................I.qk..B.....LZ.............@....G..avM ...........@....G..avM ..........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005I.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:44:07], progressive, precision 8, 611x163, components 3
                            Category:dropped
                            Size (bytes):36740
                            Entropy (8bit):7.48266872907324
                            Encrypted:false
                            SSDEEP:768:3nwDxjTvoE0Rjwit4rjucDILWg7/Da0JgGQ8e1S8SA/Khos0:SxjTmZw7nucDILj77a0JgGQvScb
                            MD5:9C205C8D770516C5AA70D31B2CA00AF3
                            SHA1:9A1002F0CF7F92F1BE2BB25BAD61CEBFAC282482
                            SHA-256:E111F96490755C7D71E87C88ACAEA38AFE55BB865B1A14A83C5BD239648D5E2C
                            SHA-512:A3E105208B32831265428572B0937DD3C17B793D8611B2DA8D4939F1BEC6050999D375E3F6B87D53AD49DFA0EAE737B0141D37597AA42116C310761973D4A134
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:44:07............................c.........................................................(.....................&...........n.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d................................................................................................................................................."...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..o...4.gP.~.c...K{...V.=...].<.........vS.........s....(.t......X......kk7....~-...yF}^c.Z.\.G./.?t...>....:.>......./.ib..).

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005J.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.429740491841111
                            Encrypted:false
                            SSDEEP:48:5sZLzpC6XMtCWDVfELLTJXcfDbq9NsJpy5rdMrrrv2QEFXZ5kV4OYg:5s1pC6c0WZfELBXcfDW9Nc0RMrD2QTY
                            MD5:B7E418AD0D2D6539102CC72055D582BC
                            SHA1:D687137DE714DAFDCE7C5A5B50A57676D2E236B7
                            SHA-256:38348C2BC0CDBA7675F45B7001844EB0840DE215CC1A3BAA4216CCEDE65C72A4
                            SHA-512:49637660257ADBADF35B544BA59CD6196A1FA8AE35A85B61A5D3F78C258D759C507C81E7E73A1A58F88BF8D09ED79111C67330870C1AF98A61147B9899601520
                            Malicious:false
                            Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ.8.......8......!....}j6.8......!....}j6.8...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................]..)...}r........N...^.................4..9.E...>D,_.........f........................................I.qk..B.....LZ...............]..)...}r...............]..)...}r..............8.......8.......8...........................................8.j.....8.T.]...8.......8...B...8.H.....8...B...8...>.).8...J...................;........4...4...4.."...............8...8...8...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........8.......8.....#.8.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005K.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):53259
                            Entropy (8bit):7.651662052139301
                            Encrypted:false
                            SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                            MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                            SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                            SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                            SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005L.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.348989849777921
                            Encrypted:false
                            SSDEEP:96:ArsxxPsx6lEXZXF9xa2q7RMRPocOcboPB9:asLsRXZXF9xNq7RMRS
                            MD5:813260E9DA339C29CDA6D4EDDF8FA6F3
                            SHA1:4348C7CF64BD14829B804A7F4105015E6FE05FF7
                            SHA-256:BF2E710116214CE492532122DA21F7A7DCB4C7A37D7E0B92B6F38ED19378EDA4
                            SHA-512:2DA0EC2924007096BF2572D1A5559D8F4FF101F64223C04F0A713FBA8999DA0435B0019BB02058CEB17827DA8F6A7E1D7A8969953B4B8B31DEEFDAF1D5937F0A
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ................>.A...v.........>.A...v......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............4..NK...$~..~.....N...^..................x..J..]u...k........f........................................I.qk..B.....LZ............4..NK...$~..~.........4..NK...$~..~.........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005M.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):60924
                            Entropy (8bit):7.758472758205366
                            Encrypted:false
                            SSDEEP:1536:kU7O7+CFqO6DkxTgPzo2wqggrrX8QvN1I/ZLBttB9+dPFXbc:hVuqJDaTqo2wq1L84N1I/Z1tT9X
                            MD5:D58C51D2CF586A5E14A9EC8529C3B0A8
                            SHA1:F4811A353797C29B1E3F5A61B125C46E1534D587
                            SHA-256:F927C7825851974A2149868146970706523A49165133CEE6027A43E8C9ABDF27
                            SHA-512:34B963173AFBDF07432F4B983D29F10376E4771FE666E9D50B1A81DA0B9F6001FD86B4A08B9711386DE153BF6E03C8E932E2D181C8EAF94EFF34D20FCA7570E0
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d................................................................................................!1AQ.aq....".....2B...Rbr#.s.4...3$.5u.6v..CSc...DT..f..t..&F........................!1..A.Qaq....."2....B.s....Rbr..#4...35...CSc.$...DTdt..%..............?....O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.........................................................yK..xd...6..|%....\j..e.=...Y..f..I.|-....e...$R.j.......~.W#....{.....V.k.|F..z^..:.~..f......"x.....L..K..r../.;..[..l...;.U...W...X.........8.....y?..B...m.......j..Q.g3..G.K....GL.o..n7a..Y..[.'.........x........\......~...f...0\Wc.n?k.|.....1.ww;..2..?...r4uF.MXdB6..W..mG2NJ.E........u...2.q...Z..=(l)jU.X...U.\X.......O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.......................................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005N.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.329991732047708
                            Encrypted:false
                            SSDEEP:48:g5+es6jRvWBsDtCuEJtJUXcX/Z9UqswpyFrdMrvvjxFXio9msZp1:g5DsQUsDzESXcX/Z9Uq1YRMluy
                            MD5:F32CF870CEED6CA7D0B12124158085C8
                            SHA1:57D476E66EEADAC3A6DD047C1E492DB5C56AAD78
                            SHA-256:789B96A49BC56DDC1B3C5367584D3C051E5CA2A7A3C8AD2ECDCBB32375D816FE
                            SHA-512:E7370A0F64BCA1DB109CA97A2D1B011FC0EDB3D582A840C1D574DA71047AE8531E6A0A200675A041AD67BB7CF25429929E47C2924D973B3E0DC622F8E6F93332
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ................+.U.}..8........+.U.}..8.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............T..'d.<l....u....N...^..................w..?M..+..J.........f........................................I.qk..B.....LZ..............T..'d.<l....u..........T..'d.<l....u........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005O.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 39 x 579, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):515
                            Entropy (8bit):6.740133870626016
                            Encrypted:false
                            SSDEEP:12:6v/7su2/c30mqkg9VgFHe7Ll8UmJX/N+1Zmkk8f3lbtI4:4mc38gFHe18lkk8f3lbth
                            MD5:E96BE30D892A5412CF262FEE652921CA
                            SHA1:8190A0BFE21D04BC6F3A406E91B87CA69C03A2DE
                            SHA-256:0E31DA4DFCFF4A36C64C1CE940362D2309769F36369E4C43C317D5F2FA15658E
                            SHA-512:D647F51ABBD013226A6ADD0D551D058C633F867F9AF5A9E099B85D6E291D220F7B85958B07381CD4C7C4F72356DBAFE2A86932AE398E28C56CDDF0744E92EE24
                            Malicious:false
                            Preview:.PNG........IHDR...'...C........b...`PLTE..................................................................................................bKGD....H....cmPPJCmp0712....H.s....9IDATx^..I..@.C..<..?mo.#C((.J}...~..B...b.I.i.\<.e.....(p.I.EO...q.x.......dRz....K..b0.:.<c.o..0.x\:...F....I&..ap....."P@....DO...q)p*..@Y.CL2)=......1.........4....._.G..^`..lDO...q...X....SL..z....K..#.L#..I6..ap.Ls.,....7&..ap.p..lI...,GO...q.....k.n1..4......3=.f.x.$..4.....o....x.$+..0.x\.,&6...............IEND.B`.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005P.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.363079025676992
                            Encrypted:false
                            SSDEEP:48:usM+Bz5FspV4MtbqEPA8pMlLX6sL9xsMpy1rdMrZVfBFX29KJuFqzl05kuIL/Ko5:us4pV4MUEPV0X6g9x5wRMPBVHI
                            MD5:F0521AD28C0C129020BAAE18080EB9A2
                            SHA1:4E3BD3F020762DB6C641679A16435D5C9EBCD135
                            SHA-256:C41AD1A355B04305C7559A728FA61133450F4D4064B411F44D7897521FCB75A0
                            SHA-512:F088A54687FF3504D3AE52C44CA29FC2BC0007FA0748CE6387C5AAB3BF412184B180EDB0FA7B4289B37A552B8D1E5A7C28D6506FD5533EB90EC3D7F686DBA7E9
                            Malicious:false
                            Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZh.L.....h.L....4CX...%oh.L....4CX...%oh.L..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'............."H..2=B.#.[.#.?....N...^....................+tM.G$.*...........f........................................I.qk..B.....LZ............"H..2=B.#.[.#.?........"H..2=B.#.[.#.?.........h.L.....h.L.....h.L.........................................h.Lj....h.LT.]..h.L.....h.L..B..h.LH....h.L..B..h.L..>.)h.L..J...................;........4...4...4.."..............h.L.h.L.h.L..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........h.L.....h.L....#h.L............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005Q.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 30 x 700, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):1547
                            Entropy (8bit):6.4194805172468286
                            Encrypted:false
                            SSDEEP:24:dZeDNYbS+238CTUFPA6SXG5qSacX9q73eXu0vC3dU+OB2gbwHRuZ:dykp9FzBBacXQ3uNC3n7xuZ
                            MD5:0BA36A74DFBF411FAB348404CCEC3348
                            SHA1:4C619790E517416E178161028987DF1CD3B871CC
                            SHA-256:2E7AAF26BEC32148B96442E8FFF1BD2CEF2D72630969F23B9A2ABEDB6CFEC93B
                            SHA-512:90AF53DB7C413E2ADB970AC345F73E4ED8AF626E179C929E6560118F7A9E98DC7C5FF02B2B3F6C98D397E0FE2D85F3427C6928C328872149E176FA8A99E91F54
                            Malicious:false
                            Preview:.PNG........IHDR...............\....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................D......bKGD....H....cmPPJCmp0712....H.s.....IDATx^.WSTA........b.0gPPP0..E.9b@L(.c.N.U>..@......;...}..B.(....$......5..XS...I....).!....D^.uE...\..5........F."o..-...m.n. .^.....q= .

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005R.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.350518914000616
                            Encrypted:false
                            SSDEEP:48:UzsMf34iR3tdeATJE05gjRcX2lQepc9pUTpyVrdMrzbeFFXdTfpf7/92hTM9pfxV:6ssR3uUJEDcXCNpc96TYRMGF92i5
                            MD5:1E7AD91954F3EBB04F465B65CCDB5359
                            SHA1:BD309C87E5250E8E9EC338D4A987E59E6559D23D
                            SHA-256:2E2009403BEC7ABA1959353171B32A43E88B128D04527F7B11EF6E190DBBC96F
                            SHA-512:8F9CF9FB9835E835C04B75CC78A655E4A0FAA94C376C4D42F7D122FCFCB7F28D2972A1346E8766D4704EEA6ED03353AC139041ACFE14A284476ABA20A767FCDD
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.1.......1...5..... m.p..1...5..... m.p..1...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............[.s.,..:l..o......N...^...................WjE...%.u..........f........................................I.qk..B.....LZ..............[.s.,..:l..o............[.s.,..:l..o............1.......1.......1...........................................1.j.....1.T.]...1.......1...B...1.H.....1...B...1...>.).1...J...................;........4...4...4.."...............1...1...1...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4..........1.......1.....#.1.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005S.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):95763
                            Entropy (8bit):7.931689087616878
                            Encrypted:false
                            SSDEEP:1536:EoES7mhTyzabUaE77xAOmq0zVruQlttNxlipxVWssMU2YhRy2v6pKKYhQzwMc2:zz7mhTyzabUa4b4xuQlttnlGx8x9h02M
                            MD5:177DD42CA99CAA2CCBF2974221680334
                            SHA1:35FD86B3DD082A6D4930C67BC0E05D3B5817465A
                            SHA-256:525A857D0EDA855A64D3619DF58B1C2D013A73E60FA0D49B155ECFCB2C134C7C
                            SHA-512:6FB6D9A6C97B1115C3246690A2F339CD612899AC25ACBA00296EAEAA0A1D094E7339D670969764FE23EB7C08FCDD01C6F78FBC0735D504D5E02AD342901719B3
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!..1AQa...q......."...2..B#Rb3..r$...6..C4....Ss%5...tu.c..Dd.EU7....................!.1.AQ..aq......"r..2...4Rb#3$B.Ss............?..H..dV....U..-..0]Cp.%O.Z.Y.e.=/.q.....j76.w@s...5.&&&5...n..w..>.1....;.vR..[.......=.......KtY]u3.g18...).r....&.IZ'.....g..4kY..X..b.......y<...r1........e.._...X...w....op.m%Jr31...S.Vo.._....OI\]....F..V-....\...2j..X.....y.p.$4.....&#..]..n.V..x..P...F..C.f....])..~..Z\.....,..#..v..v...2V.k.SuaydO../[.*c._..oTV<Z.s.[...o.x..>....-....v...#....-.X..L.Z./#.XG.-.0......%w..H.@aZ....C.}...N~.;..R......5.D......I.... .R........s.>..ks....(...S...9....2=. :^.. p.+?(....$..Q..I.........=|..`2. v..t......U*.8.u.. ...'...*...2;u....& 3..$.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005T.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.260623058690876
                            Encrypted:false
                            SSDEEP:96:usoonDWxilYEy0vXH9qYYRMCBDX5SSDaJA:usZnDWxijycXH9fYRMCBDX5SSDgA
                            MD5:222767A75C372BCC92689F11E916E5F9
                            SHA1:5BAA1ED0DD77512CA76E97E34A40AD9758993718
                            SHA-256:CED0FEECA7315FF8D43FA5D7992FFCB3876F684592F8C052F13CC8E5DC15CB2D
                            SHA-512:81FF82602F8C72E963875ABB36F9F903ACA64F5D0A938B4A1B95A9B0948A832F0DF5FB19B1420AE1BAFB57067CC7672EA7AD16D0B971E3C1FAC1CD7CA845EEFC
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ.....................'.q.............'.q.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............z......$P.s.g......N...^...............n.dq4m0M....'%.\........f........................................I.qk..B.....LZ.............z......$P.s.g...........z......$P.s.g..........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005U.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):67991
                            Entropy (8bit):7.870481231782746
                            Encrypted:false
                            SSDEEP:1536:3PC0XJjsmsKuZRG1pXuZ6z3wARnV9AEnieCc7cllJcHJ:qyMBzkUZ0gq25c7Z
                            MD5:1271B1905D18A40D79A5B9DB27EE97EA
                            SHA1:9618608FBD7342DE6C71220A36C3F4995BA9C13E
                            SHA-256:5B321A4D81BD499B289B1755F6450A42047C494DFBC112DBD56DA4CED2C15C1A
                            SHA-512:C32DD26047F6B8AA061085B38AC2B8335868E1BFD8731DB65544309223A955FA4BF45B06AC8D244408658F51A1775B6F19FF0FFC804989DE706DE8EB36F1436F
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1..AQa..q..".........2...BR#b.r.3...$.'...)..C%7gw..(.S.W89.......................!1.A.Qa.q".....2...#....B.t......rc.$%67Rb3s&'CUu.v....S.d5.V4T.e.............?...?..Wj.e.e.......w/..E..eOw_.....6......u..C6h.,..;.g.D8Z..-)O..jy..e;.u.g..w..[.L""k'w.......'1'.[......=..P...S.9a.V./O....q=8xk]...........9......F...e9'....9.O.... .&.....p......c.4...mr...?.......L..'.....0....+..|_...POM=7.?.2.a....};.Z..y./....>./.C.<...;.....|.1>...........S.8.o.O...+..n2...k../.X..9...Y...:.....\...Dk......q.K..\.Wuh.!Z?.mu...R.5.A.S.h.0..[..v..+M.....aUi*.k..?#..._...X..R.&]..[..;../]L..f..V......*.e...ut&.#.J.5....c%..o.$..v.<K.6..T.IP.....6X.*.uf..t0^..-.)m$.!.q(.j.f;..WB6.b.B..R.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000005V.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.2786919004354385
                            Encrypted:false
                            SSDEEP:48:gsDRL1xk4qQtCBEvlLhjXP5S9QEULpyi8rdMr7k/hehFXBI9948d:gs1JK4qQAEd1XPs9QTLr8RM7EaUd
                            MD5:9E5FF92D852D14050D66A87F48FB87CF
                            SHA1:DD1E0EEE3F7797E7736F7C9270F1C1160E1E6A23
                            SHA-256:0334C46428B723B87DD728E7A7B965AA198FBF88A75ED50002DF9FCE3CE2B8C9
                            SHA-512:58A031540BB12D6183B841CFBC1769594C994E351F705582C3618C78043C887A143F7267BED328C554974EF72B75CC4CBBADDDF0AA5B7E11DF99A14A016DABAC
                            Malicious:false
                            Preview:2...>.......R...v...F...................................................................................................................................2...>...........v...z............................I.......I.qk..B.....LZ.............A*..)..X.......A*..)..X.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............P..\.4....##[w......N...^.................x\Uv]O..oW.].S........f........................................I.qk..B.....LZ............P..\.4....##[w..........P..\.4....##[w..........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000060.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                            Category:dropped
                            Size (bytes):22203
                            Entropy (8bit):6.977175130747846
                            Encrypted:false
                            SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                            MD5:2D3128554F6286809B2C8E99DE5FD3F6
                            SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                            SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                            SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                            Malicious:false
                            Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000061.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.422280048532179
                            Encrypted:false
                            SSDEEP:48:9saDzJKZSi0cEsMtGkYUXE15LvRXDbD9hUBpy5rdMruUCwFXfJkkK/CvVu4g:9secEsMUkfEDNXDP9iB8RM704
                            MD5:2E2E827755892A67B5AF22A74C88E517
                            SHA1:E9C6D31F101D7E96095C8CAF13CAE0D2F3A6F855
                            SHA-256:211C8D597215B73810544753318DF19281B04DFCB3DF3C7ABBF2162271A96BE8
                            SHA-512:3BB1A2E8E1EB75170F79722524A6F90FE76E89850472F34424D99C2DF3A02E2AD387158255A6651F9BE3A18B228C340189A19AB1F3E3457198887AC9C730C3B9
                            Malicious:false
                            Preview:2...>.......l...v...`...................................................................................................................................2...>...H.......v................................I.......I.qk..B.....LZ}q......}q..g......!...H}q..g......!...H}q...I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.......................X.]!....N...^....................6dH.{.#............f........................................I.qk..B.....LZ......................X.]!..................X.]!.........}q......}q......}q..........................................}q.j....}q.T.]..}q......}q...B..}q.H....}q...B..}q...>.)}q...J...................;........4...4...4.."..............}q..}q..}q...z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........}q......}q.....#}q.............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000062.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):15740
                            Entropy (8bit):6.0674556182683945
                            Encrypted:false
                            SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                            MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                            SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                            SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                            SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000063.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.344071036848104
                            Encrypted:false
                            SSDEEP:48:5rMspnQeaJtqoEEAkL6EjbXgQF9lUwpylrdMrEkXmNFXUB35ys1:5rMsqeaJ4ZEjXbXgQF92wARMEkGiys
                            MD5:A4634B1A3A313CC6D2FB78E7A971F442
                            SHA1:09E437890A811CE5465A1A5B52109677BE52416C
                            SHA-256:CEAE2EE64C3716DC26F51DDFE39B8F9E733397ADFA47BA0D242A8C7B61004D42
                            SHA-512:48E79FC15A4F6B8D84C8E168FDBEF5EF089ADD759C7DEB00C77F6CC151235B1EC35AA7DA5832E9711A81668BCE29B07137B071F0275447735E7E87B02C0D6879
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ............P...4..k.C......P...4..k.C.......I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............'gP[d....)...t....N...^..................|..}G.....P..........f........................................I.qk..B.....LZ..............'gP[d....)...t..........'gP[d....)...t........................................................................j.......T.]...............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000064.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):86187
                            Entropy (8bit):7.951356272886186
                            Encrypted:false
                            SSDEEP:1536:AbmHwD7za0syWMetp3TdPFzoJamVdAQZCiUit9qbYN6LerhWMzIWgN1EeaYhJM:1QnzsyTeP3TPAdAQZCi5qbYEKrhWWMNO
                            MD5:FEE4785DF76E93A9DC2F4501CBAEAE12
                            SHA1:8FB4527BDE05EF208FCDB168098A07707C27501F
                            SHA-256:F091DED5E283AF6848670A3172E7C43C6099875D39B3FC69C2BDBA914F609602
                            SHA-512:7E99D33151A0D3873D6A819C98EA8E62D928C087B7BA2080F11C7BCF746AD60A44D4FF6EE3D2D2E8DFA4BF1FC6285ED56BB83F91C2FC6FC4FDFF2000105F10B1
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................1.!Aq...Qa."...2..BR#...br......6v.7..3.CSc...$4.s..&dt%u.f.......................!1.AQ..aq........"2.B#....Rb3..t.5u.67.8.r..$....C4.cs.Sd%.DEUe&.............?............w.....c.....i.A.....3...7.......7..P......%.........?Th..l./?.;.....$}..=5Oa...F.c.A/...D.D..]..y..3e.5\%.fo2.X.*]q.5Ee.}..i..md.T....#...-...Mu...9...-+..~w5O.);..G..'.;..).....A_...M.vV..y.q......,<.3.(...._K:..XM.......w.......9..T.......?b..a-%.c;.}..>....|.,lZKCEB.t...fw|.Sw^..Y..:.J.................t._P..v..j.1.R8.R....G..W*H<(Xi........i..xcu...WM.dqM>'W..g....M.q.....+.....b'..~....>..T.~Jc....fj.X.x..9...N.w.6:..>.......&.(h..u...t._...)_k#7Za...cZ....P...Y..;.V.,..xo.....f........Y...\6...M'L._

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000065.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.656380429528036
                            Encrypted:false
                            SSDEEP:48:eGy5R5JsMBDpDjB8BJHTM0yKtypEdzbULmBhr5X0R95UQpyl7rdMrWRGF0FXgJ8/:wfJs1M0yKwEtUgJ5XM9KQ4RMXF0SdKJ
                            MD5:E90584951D1A4C7C25542C6C1D979927
                            SHA1:595F1206460916420114FBF025C455798574B753
                            SHA-256:4731835334EAED8D0C5D25570DB0851B62ECAADD95EDB99673FA472EFB45156F
                            SHA-512:897ED3B817374D8CB8F59E321AA93390C59CD3181B3AA52D6C3AC58A9CE929CFD864AD4383A703E2C1822F9A153D09FA2DEE6E2C1867619E7DF3CB79CC8ABEB2
                            Malicious:false
                            Preview:2...>...........v.......................................................................................................................................2...>...t.......v................................I.......I.qk..B.....LZ].......]...a%..'}\..G..]...a%..'}\..G..]....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'...............oO\.s.*.H.9..F....N...^.................R.}.M...d.q..........f...................................H....I.qk..B.....LZ..............oO\.s.*.H.9..F..........oO\.s.*.H.9..F.........].......].......]...........................................]..j....]..T.]..].......]....B..]..H....]....B..]....>.)]....J...................;........4...4...4.."..............]...]...]....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........].......]......#]..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000066.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 85 x 470, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):11197
                            Entropy (8bit):7.975073010774664
                            Encrypted:false
                            SSDEEP:192:p9wNdtRKcVHso6zsqm06xaqZdingVzLZ7/PGSIz/yycRTbChh/JzhbEx15RGb:mdtMcVHqgAqTinMzLZ7/uSIz/yTR/mhF
                            MD5:DDC3CC30794277500EFE4BC6667EC123
                            SHA1:EFC9642C1F95B5FC38764476AE481649C016FA0C
                            SHA-256:7F5B660A1A0BF46C75AAF19B4F77A0E086DE003EC03AFC1F58D871D55AA5BA9E
                            SHA-512:25232A84604C3959634D33090238FEC8D51E40AD84EB3A08BB8522A81BE1E83378649C014E98E1DFCDF46B7BFAC92D8D2429211CD11D7EE0334C9C3DF7C1B6A6
                            Malicious:false
                            Preview:.PNG........IHDR...U.........1x5.....PLTE....................................e........................................................s...............x..........................o..............................................................................................................................................................~.............................m...............................................j...............................................p.......z......................................................x..............|........................................v.......................y..........................................................h...........................................................................P..{....bKGD....H....cmPPJCmp0712....H.s...(SIDATx^.}i@S..N....h...!..)....AI%..p.L."a..)..`U..,h..:O.b.:.j+.Z).b..zN.s..{O...&|..N}...${....~.....k}.[k}{.o^.D_..W:35ly..7rL....6n0.A...b

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000067.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.352757653942755
                            Encrypted:false
                            SSDEEP:48:p0stWSMjnGhtPBPoElL0VWXaLW9UyUIpycSrdMrfchjd7FXI4am1bi5:p0sEbGh1CEl9X39UFIIRMfcRd7dlbi
                            MD5:AF190914DA3565539A0A6FE2306E2B2A
                            SHA1:1C91B7741E3648A367D605A3C695EA94B97B55FE
                            SHA-256:5E1888003053F3168737670F75A17528533C5967006BE99708DD4E37FA7795C9
                            SHA-512:3490CC73DE3E462BC4DFCE1C07B8DD2CB5F71402EDA617293654BA1BFF63C8BD2A841CE3DCA8D1035A1F1392313F1E33E04DB645A64CA4614AC191AAA84622E4
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZo.......o..4g{..&..~.Q.o..4g{..&..~.Q.o....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..................:.&G...`{.....N...^....................A.it....w........f........................................I.qk..B.....LZ.................:.&G...`{..............:.&G...`{..........o.......o.......o...........................................o..j....o..T.]..o.......o....B..o..H....o....B..o....>.)o....J...................;........4...4...4.."..............o...o...o....z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4.........o.......o......#o..............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000068.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 88 x 574, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):19920
                            Entropy (8bit):7.987696084459766
                            Encrypted:false
                            SSDEEP:384:DRSgtAxJx7bzvAsVSqQElOT4uHmpmvNYT9aPU+QtsC2LgfIqJZnbeyRB:DsgaN7bzvAsVdK4uGQFUZ6bU/p3
                            MD5:1BDAD9B3B6DE549162F9567697389E1C
                            SHA1:5D9C09159F07A3A9BDCC6C4B9BD9CB72D0184E6F
                            SHA-256:0908A4CFA23F93011176D47F45843E9CA2973030421996E8E27484781F54B0EC
                            SHA-512:475040779AC247BB5C3E11862FB55FBDDFA12D759EE86A33E11BC1F3B656D6CD0F9B25146C0113E43E1D8001D8867D3BC3BF7E6FE21F3A0016CB1F8B70B7A15A
                            Malicious:false
                            Preview:.PNG........IHDR...X...>......y=h....PLTE..................................t........iw..............................................._n|...Tds...ky......................................................p~.....................................................dr.................v.............................................n{.......ap}..........x.....z...................u......................|..Vfu............r.....w........................................~...................Zjx...................................Yiw............w..|....................Xgv{.....y...........................jx..............\lz.........}..z.....t..[ky........u..y.....gu................................{..........}.....u....................~...........y....r.....bKGD....H....cmPPJCmp0712....H.s...JfIDATx^...\.W./.}....Sy...(..4....D.-.....H...% .$"D.Qr.......`..;...6...N......s...^...L.....Y{.GQU`..~...j....{...-Ax.K..&.....F..I\i..

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\00000069.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):8192
                            Entropy (8bit):2.9037911743744673
                            Encrypted:false
                            SSDEEP:96:Js67jinE1dN0fEXrA9JGMRMHoSnKl3Jn3KoOp:JsKjV1dN08X89JGMRMIS
                            MD5:7FE7E023F5304B23C2A71A72B9F56B9A
                            SHA1:CB4461E0B38AC5B6D345361F6AFB99DFA4E1B5F2
                            SHA-256:7C7FB4D10E28F4581DC4F54EF10108931ED0A520D406E3D539BCA9179F0CD6FF
                            SHA-512:22741BE32BA2402B2DBF7D01AF04C96C17BA1313423DA162A5A36F1E2551C5AF9D1E44ED901D50CF7E517A8B353D4E70F77544EA1F253BF7D73A529D3EE54526
                            Malicious:false
                            Preview:2...>...........v.......................................................................................................................................2...>.......H...v................................I.......I.qk..B.....LZ.............Q.#..0...&.....Q.#..0...&.....I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................e1y+...@b(......N...^...................[Z2H..%.............f........................................I.qk..B.....LZ...............e1y+...@b(.............e1y+...@b(..........................................................................j.......T.]..............B.....H.........B.......>.).....J...................;........4...4...4.."...........................z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4........................#...............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006A.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):179460
                            Entropy (8bit):7.979020171518325
                            Encrypted:false
                            SSDEEP:3072:oiKXvL7lv0am/R1vrdH+9dK6zPQ6bbnGDpcGGDNMIOIMAT8q9Vc02Q57S4A+vMFz:+vlvC/HvgA6fGqGGJlO1qZ71W6CzDn
                            MD5:4E131DBFEC5C2462273CA7B35675B9D9
                            SHA1:CA037F444D819A118AC37D7AA3782B9BF94C1616
                            SHA-256:2A4A3530D652E227DDD5ADC096A95F6034718F7C380B07DB622022D768815059
                            SHA-512:C333ECEB1439D0238BF44FB7896E62DBA4C645B70413AA0F99C1F10E8DCD20C2EEE5C83F2E9DDE9A2494C85A6D8D13CFFFC4160E2F598E17867015F5244D656A
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1AQ.aq...".....2Rr..Bb..#34.....CSs.$5c.t....%.Dd.6.T..u.U....E.7w........................!.1A.Qaq......2."r.3....BRb.#4......CsSc...$.5..%.DT.t67d..Uu...'............?..c.......p..z..i.....z......kj........F>f......3N...M....RM.&..-.~.Q..'.....q.a..w...-~......g.{..&.......V.n.D....>FS!n.....@..)...W..q..Wr{..J.gf.{.M$.P@m.,..9..&m.D...w.._...-.O........s.....h.k~......(.K...V..l.-...+.9.k......*......#.p#.O..9M..mF...C.......7+.AI....4vw.;..H......e..Q.u[.eUK.....z.....[.Kt...s..Lf.4..l{.....sh.............=..;..iqkj.m.a...NH......v..H..$..q.y......c...U[Mcf.......+...S-...^....4..T..YtL.x.v.;.....<...Ik|B.$.s8......3.+.8.l.. h.:....%B..W..I.QRS..,*x.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006B.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.311477552289423
                            Encrypted:false
                            SSDEEP:48:usYuJFQ6MSc8fKtv9e7SW5E4wF8XY7j89psQpyVrdMr74Jd7Kt1FXyVG+DYgg:ustQ6I8fKA5Ed8Xi89pFoRMc6t1dg
                            MD5:6B5BC1E644BD1DF3E71B98E1F4672FE6
                            SHA1:7FB83E482D79953257F86F0CC71440FF44F253C5
                            SHA-256:EC368F34E481E8A8AA7B20739C32545B9CAA38809AFF2F35C89ECF3F17732638
                            SHA-512:101CD3B2432F8EE3A61C66FBF96E3E3C297891E9EE38F411396E091A36FD6B52E6500201341AAD985A685FEB6A9AFBFD2AF8BE249F7F68B99FEFACAFE64E6072
                            Malicious:false
                            Preview:2...>.......T...v...H...................................................................................................................................2...>...0.......v...|............................I.......I.qk..B.....LZ..u.......u.By...o.y..f;..u.By...o.y..f;..u..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'..............h.^F.....Z.........N...^....................$F..<W..........f........................................I.qk..B.....LZ.............h.^F.....Z..............h.^F.....Z................u.......u.......u...........................................uj......uT.]....u.......u..B....uH......u..B....u..>.)..u..J...................;........4...4...4.."................u...u...u..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........u.......u....#..u............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006C.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):109698
                            Entropy (8bit):7.954100577911302
                            Encrypted:false
                            SSDEEP:3072:rDlmvIWr0aRtNCfShCWBxyCHMlcVG0Ezy4FR:rDliIfot8ahCWBcCHDVwR
                            MD5:8D804A60E86627383BED6280ED62F1CF
                            SHA1:E23FF14B10AD0762DD67FBA3CD6EFC85647C0384
                            SHA-256:494547E566FB7A63DD429EB0699FE41AA8998F8EA2F758D813FE3D56C3075719
                            SHA-512:0FB19F3D00159F2748C3A54E952E551B9FEA6910D67A54DECA8D099992E50383EADB92768FF1F75CFFAE82A7A157B1E0F77A2F0BE7EC64FD2324304FDCA46577
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...............................................................................................!"#.123..AQB$..aq.RCS...b..c4%..rs..D&....5E6'..TdUte...u.....FV...7.......................!"..1A2B..QaqR.#.br3.........C%...$5.....c4U..Eeu&SsD.6T..................?.....O.C.....^..R<A.g...[....3.....r.0.....nX.S....}...[.?Z.....A.?..~~I..rY|N.o...9......!...o7r../-.y...'5.3.U.s".-.0.1......SS...&.Q.j.*.$m.e..:x....`}...EP.?.7..~G(so.......O.....z.N..<....~^a.e...........p9.?<._..|......~.<@.D.9..G..?.?z.y?z.C.U.w..[.,..A.+........s......g...G.^....pz.xY.....d8.y.X...P..O(A.O..~:._.......<...o..4s..^.^b..x......_a.....|{c...:..X.....}.._...[?..NK.c...}.<......H.G....+x.Z..|....n...o....`.nk.#.%x......-|...|7......N!=././..w.8x.".8....'x........w...,>....j[w8a..}..lS..?.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006D.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):4.302372697273945
                            Encrypted:false
                            SSDEEP:48:ysPw+6sgtgYh2E3yTYIXK7H5I9JsApy1rdMrV+4FXSNaFBYF:ysj6sg2YAEFIXKz5I9JdgRMo4JBY
                            MD5:BAFBCCD2B4717E0BF0D8C235FDDB0BFC
                            SHA1:EBCC2FF0768CBF391E2B017918212BA6E1EED827
                            SHA-256:0DF0971CE87CE3A48258EB1DC0D7B2D806A967D1BBC6194AC56A6215FDAC3C87
                            SHA-512:49A833ED51B22F24E56774B718BEB179DC36BB860ACFC49C6C42B05C7579E1D78B6484D9F74E08984BA71F5FFB2AD84696DCB421CCC2F897184A7005270269D2
                            Malicious:false
                            Preview:2...>.......N...v...B...................................................................................................................................2...>...*.......v...v............................I.......I.qk..B.....LZ..&.......&.6F5....e...I..&.6F5....e...I..&..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............T./$.;...H..*.......N...^...............y....cPL......-G........f........................................I.qk..B.....LZ............T./$.;...H..*...........T./$.;...H..*..............&.......&.......&...........................................&j......&T.]....&.......&..B....&H......&..B....&..>.)..&..J...................;........4...4...4.."................&...&...&..z...y.. x.. ...........$........4...,..7,..7........................;........4...4...4...........&.......&....#..&............................................

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006E.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):41893
                            Entropy (8bit):7.52654558351485
                            Encrypted:false
                            SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                            MD5:F25427EFECFEE786D5A9F630726DD140
                            SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                            SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                            SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006F.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):2.482825840986115
                            Encrypted:false
                            SSDEEP:24:dHkTF24meG2ae2oFAvedCDJyUlADq9lU8UllSIp7eaGUlgRxgUliY6I7UlitwJ:5kp24xfvdCtlADq9lUNllFlMl4litwJ
                            MD5:1D09621A64BE7DC6E9A0130E7895BD48
                            SHA1:5463D8510C05439C3D329E6485494D9B0CCDECE3
                            SHA-256:716AE05EA14390E8EB1D567FA1A9A6B13E39DC2A5EFE5408676C3B93213ECBFC
                            SHA-512:528DC3B2C5706A7BE235A75C68A01CF531037D298146B74C2A8432F635AC30D9726A23435DAC6D50BDD68A3BAAE7F625C4C6932027B28C5B784655B14C01DB92
                            Malicious:false
                            Preview:.........................................................................................................................................................................................................{.......{..n..4....I..S=0.....S=0.....0....@&...cB4.`.....m.H...c..c....@.&..}m....c..S=0.....0....@&.S=0...........|.......|..................................................w.e..8..w.e..Q..w.e..[..w.e..b..w.e..o...|...k...|.`......................4..~...1...(...(.......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.\.r.o.o.t.\.T.e.m.p.l.a.t.e.s.\.1.0.3.3.\.O.N.E.N.O.T.E.\.1.6.\.S.t.a.t.i.o.n.e.r.y.......S.t.a.t.i.o.n.e.r.y.........1.......S.t.a.t.i.o.n.e.r.y............w.e..1... ..$....S.t.a.t.i.o.n.e.r.y.........c.......cB4.`.....m.H.w.e.....w.eR..K.U.sS..X2...............................S=0.w.e..c...............................S=0..c..,.......................S=0..c..,0............A...XB.)..P.................w.e.w.e..1... ..$....S.t.a.t.i.o.n.e.r.y...

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006G.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):3.288790330336319
                            Encrypted:false
                            SSDEEP:24:S5S2Maow7qlmq2X8/GwUFOKtrZCrBJmQEtaDsNKUJ2+pXEZVbsPJmQEtaDssDEZS:S5SSn7qlODu8jxZEDbPUErl7jT/dMDB
                            MD5:79DBA647ED4050FC86C523CFB42B247B
                            SHA1:38BACD20E6D11B5EC469DB7F3F0B339E7B77AEEE
                            SHA-256:A83C5D1CA6D8A3321FB8DBC48FE82847EB2159A4825D50B0AF67E4281FBE1972
                            SHA-512:65ABFD51082B0AE71B666A21CF4E692F0FF7F5A99499C30A028B2FEC8AB0FBF41695B948BC06503A49AB678547A05C25E5EC6DA97DC1E571936725D9127D5B63
                            Malicious:false
                            Preview:........$...........t......................................?....................................................................................................\.........................................?.......?..GAM.....zj.n.x.....n.xX1...+ '|%..n.xX1...+ '|%..n.x....<Y.......x..-...._..z1.'A.4....>_..........................................................................?T&h.......{.....X.........4...............$.._..T.9...J.T(T................4..(.....x.(.......}.......}..9S.-.4...!............<Y.......x..-2...v.......4...................n.x................................._.......n.x..c..,0...e...B4.$........[.-...I.......9........................}..9S.-.4...!..}.....q....~.(^_,..._..z1.'A.4....>_.......>.......@..........<Y.......x..-_..z1.'A.4....>...........................q....~.(^_,_......._..z1.'A.4............?.........c..,0...e...B4.$..............E........................................0...........e....4..................T.o. .D.o. .L.i.s.t........s.)..O@

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006H.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):12288
                            Entropy (8bit):3.924544270799941
                            Encrypted:false
                            SSDEEP:192:ls8wUhCvGQwr2X/IsTcFERzSLWgrw4g1StKTV9iUFrr:auu99LRzCcf
                            MD5:DB5AD761F6CFF3FC2E655DF5C567397F
                            SHA1:621ECB68B7CFE6C97D8EF635248E1DE4CBD7839F
                            SHA-256:4304CE0CC4A11B1F6BF545BDFC3B366F9015E6A5B21C769D3E34AF318A824F5B
                            SHA-512:C892398184D9AA6A9A98C824479B6F401AADFC0FB12537EF8C7FCDBA5B25EBEC75F74AA2763FF66B2DBFACB5B5AFF975B71446651F44C7D4E7BBA4F2549BD0FA
                            Malicious:false
                            Preview:2...>...........v.......X .. "..2...>...d...<...v.......@....!...........................................................................................................................................I.......I.qk..B.....LZ..^.;.....^...-.._.K.t....^...-.._.K.t....^..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'.............PMx6.......I..1.....N...^...............8.!lr..A..-F..}K........h...L...............................D....I.qk..B.....LZ............PMx6.......I..1....................................^.......^.......^...........................................^j......^T&n....^.......^.......^H......^..K....^.......^$..........^-..^J..^..z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.5............(..^#..^8..^..z...,4. .......$>........4...4.@..7.....................D..n4..o4..p4...4. .F

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006I.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                            Category:dropped
                            Size (bytes):68633
                            Entropy (8bit):7.709776384921022
                            Encrypted:false
                            SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                            MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                            SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                            SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                            SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006J.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):20480
                            Entropy (8bit):4.077339518380277
                            Encrypted:false
                            SSDEEP:192:1bCaDfkamAlXrPnxwhgBvPSpHdPF/1fQryOs1+u/9enU7KXOClu4crRJdXfqc7Gv:xCawKGPF/l6skU7EaRJbGLR9Lk9
                            MD5:1C310E6F2B069EFCA79788E8F3C4A63A
                            SHA1:F0EEA387D0BD37A50925993C5021CBACB7D04B19
                            SHA-256:643183B279D806A21532B884A78C109E2A0F38189E735189EEA22ECF181AEF13
                            SHA-512:DBB1BEE085D8A10CDC60B03C1340316EC3DDC55174EA86F017AD16CDAAEC41624C8C967D5EC1CFCE0ED809EA4B57CF55E79726DB92A2D7F2F30864B2F4131B57
                            Malicious:false
                            Preview:N...>.......L...d... .... ...9..N...>...........d...h...@...@;...........................................................................................................................................I.......I.qk..B.....LZ............l....F..M%&......._%.I.M%&......l....F.>....I.qk..B.....LZ.I...........M%&.....M%&.....M%&.........................................M%&j....M%&T.7..M%&..~..M%&.....M%&H....M%&.....M%&....&M%&........'M%&2M%&..z...,4. ...."......$>........4..`..7......L.o.w. .P.r.i.o.r.i.t.y......................M%&:M%&.M%&..z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.2.3...............z... ..$........................................2..7.........1.h...?.......?...?....rA\.-?>...o.u.t.l.i.n.e.L.o.c.I.D...o.u.t.l.i.n.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.4........?ff.A......'M%&%M%&.M%&..z...,4. .......$>........4.@.4..`..7.....................D..n4..o4..p4...4. ..1.......M%&*....M%&....%M%&#...'M%&&...9M%&....

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006K.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                            Category:dropped
                            Size (bytes):59832
                            Entropy (8bit):7.308211468398169
                            Encrypted:false
                            SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                            MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                            SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                            SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                            SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                            Malicious:false
                            Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006L.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):20480
                            Entropy (8bit):3.215646308914028
                            Encrypted:false
                            SSDEEP:384:X//xFLigvdq/BUvqYEz7bRJGH3+vxEEN:X//xFLiglq/BUvqRfbRgH3+vxEE
                            MD5:C676991B095C0CAC39F43CF510814CD9
                            SHA1:E5D6AA0C16511E28A3BB51D07BE99CD1B4A5E7C6
                            SHA-256:6AE05BD0704D3F3F7BB7E840CBD7D1C6FC4FBAD7D32C1E4EB121BD7CB8CE926E
                            SHA-512:4F904B6C875DFBDDE0E77CB3306560B39DF49D4E4480A3D3895F0072C39C0D30FD0CEA3787BB3D361DF130D4046885104809E01FAC51AE8183F427067407B581
                            Malicious:false
                            Preview:2...>...........v........ ...-..2...>...B.......v.......@....,...........................................................................................................................................I.......I.qk..B.....LZ7L@.P...7L@9y.T.$$.6CV.7L@9y.T.$$.6CV.7L@..I.qk..B.....LZ.I................................I.......I...................................................I.t.....I................................................................4..'...'................}aV..1..Ek......N...^................l...B.J....%..............................l...B.J....%..........l...B.J....%............}aV..1..Ek...................................7L@.....7L@.....7L@.........................................7L@j.^..7L@T'...7L@.....7L@.....7L@..-..7L@.....7L@.....7L@ .L......7L@37L@I7L@..z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o.m.m.e.n.t.......0.0.0.6.............7L@37L@97L@..z...y.. x.. ...........$........2..72..7.....*...o.e.L.o.c.I.D...o.e.L.o.c.C.o

                            C:\Users\user\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\0000006M.bin

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):53259
                            Entropy (8bit):7.651662052139301
                            Encrypted:false
                            SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                            MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                            SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                            SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                            SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                            C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):2278
                            Entropy (8bit):3.850594188673751
                            Encrypted:false
                            SSDEEP:48:uiTrlKxsxxtxl9Il8uQSkfZkrlVaVdRLlS2Md1rc:vJYHcZI0ZLcY
                            MD5:61A87A30CEF4FA2EC8FCA3B2DFE5E79F
                            SHA1:FC16B771614FDFEA1784645807B9A9F5D6A7213B
                            SHA-256:7FCF9748CFDF92E9BD393A4CB6B0BAF6B7C11E99663E2B0DF4A9A237146C7BAC
                            SHA-512:C74F88BA57B396607624FBE5B60361433B16DE0E47E1DB5203F608A4DCD1742B0F9048A453228C925B22877ACE2EFE6FD88788095E365655332033876C391DA8
                            Malicious:false
                            Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.M.z.3.s.+.2.V.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.C.F.M.9.u.Z.

                            C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4542
                            Entropy (8bit):3.997864080982996
                            Encrypted:false
                            SSDEEP:96:euYfEaU0WecWDwT+nqc/ltpuXz/Py08ixntrHLh8kqEp:Xapn19t2z/PyQ7j98fY
                            MD5:96563C52615BBFEF0F0669980A2976A6
                            SHA1:3BDF25C97935E5F24C57134F2A83BF351FB32F5C
                            SHA-256:9695CB62CB278311BEFC507957719CF80DB83B7749A76209AC4292983DCC5FB2
                            SHA-512:C31F2CFFD846005C50F857F1553844583974F316D72C2757CF3769BE2900AEFA3AC6D6FB832D201CD4BE23718CA6BBCB0A25D7E9CA6FAA82D76AB9320763E152
                            Malicious:false
                            Preview:{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Y.n.6.z.m.e.W.V.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.C.F.M.9.u.Z.

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\doomed\14645.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):38896
                            Entropy (8bit):7.995415446685447
                            Encrypted:true
                            SSDEEP:768:ayjLr5NxP5MCGJhV8Mj/yEa6bbO+es1O5eDIAOojsNbDyCM:ayjHdvEheOPa6GsM5eHOo4BtM
                            MD5:9378A7EA1DA4ACE8A4C0E52E296B8BCA
                            SHA1:E2A933D52AD785891835898024E8FE2A14435730
                            SHA-256:C7A11D293146013ABBDB9C01BE298C6BDCA7C3C5DE9DE947BAC9BC327A4A6E4B
                            SHA-512:A73378019F9165A329AA758A488938D310BCE7F4776A21797D062312B375A9CD39F07D5FC920E339B1FA8DB7BA9536BCF18CA0CC6F3558D18861476F2ED29FE2
                            Malicious:true
                            Preview:.~!:R<...P.jJ.f.9_.....{....I[<~-.f..7.W."vm.rm4....y.n..$.......S"......5I..S>..Po.....y....?.j.w.....M+..?I.....{~...;.){.k.%...2..R...r.s#/I..y9%.i.Q.H.....&.$.........L..IyE.=..m....)..'o+.2....6..(....Z..q...Y..^..........~......a.;.../...p..L....,...@p..,...g....2...]/.+.>.....`53..V..P.c...++..>.LA..7.4h.K....W.........b..d"B.....D./;..{D.....z#....2.!.MZP.jz...!.v...z.......b.....].I..b.&..k....^j:9W.\g`.d....N..g6...T......b.$.;...[~".4.....M...9...m9.....%...0..#3..Z.....TU..q........|.<Q.).|E.2..u\.9...4.s...........R...!...W...h.b.."..........6..S..<.<.=2..*.E#Z.!..r.k...v4.......;p..~.>._v...x...6gC.$.u.....@..."d...S-1..I........G.L...a...Z...M2..,.^.Y.....8...........i.X..K.A..*.m d...R.;~N....VI.1.5..C!n....t}...D.Sp.ti........[..`a..7V@...m.i..dkR:WW......m.e..G].E..U.)......v...+.a..?OxV....R]....T$S...RG.Qd../o.[F...[.V...t7.L.uL...$....._.;.62~5Q[.....,.T.'.p`-=%.#7..|..FCo*.UK.......tE.....5H....S..9`..m..^c.;'E.uy..,..

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\8DCFB1B835965528392E2DFD5B0DE10B8BC522E9.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):10043
                            Entropy (8bit):7.98504983647095
                            Encrypted:false
                            SSDEEP:192:d8tPeyIFUJcYWZ5I0NOb20Dz0+9QH59SiCON9YbFhlW/FIeD2k0oph1Ict78J:dCVaYWzI910IQ2iCgeRhlsIe/pha88J
                            MD5:DC74DE353BE774A44DCAC619E10BCD9B
                            SHA1:D53FCCC536239D0730456D13A9658D439BF1F841
                            SHA-256:4DC4895C1D87B6B39D349E6ADAEAF16301C6AFFC4AD6A8534B916349688B5E61
                            SHA-512:F378D3E5CBC4F8B82A5259797D4C7F377E23F6FC8E5EF0F4EE62012051B49CEB62FD764BDF1F2DFE1B2D142C3F83FC92C5DF842C2AD967B374CE768B971890D0
                            Malicious:false
                            Preview:...X....B..l|}..../.F....W.6....SL.O).....;.|f.$J....]d.&........,.Q.R.&-0...=6=..^.k......l.....f~.;k.R&..C{`.M#5..w5..6..1...9.c....E.k...]..z}.w..I7N...jv.;.(...W...iz...E...........|.<1....Q.E 0#......<.0.b..Veu.=^...Sl(mPzI.S...-.......xeK.....8}.&"...f..r]X.e.....^n.5..H..Z.Q....I$.F<.$R...b....h..@HL......W..R...>/g\d7...y..Xt...#..MR.].M..}....I.]...w..2]z.....lH.:\\.d.....Q..48..~M..X.M...).......$.Ld..Ppr...e.4.y.........J..q.N.......I._../.E..6l..I..V..5.....q.ZPBBcw.uwU.8.z.....r.]..e...f}Sa...&U.(.F..m......>....{$..........OJ\^...Y..0....M..F4.P.<qO7`.\.....n...*I......4.\N."5{....>D.`'...i}..@Nv,|TQ.u..x...+.VZ.X..[..^t;.(}...~S.....)..Zd.............>.....)M...S...j....l..&..Y..7.h./....%X/.L......X.\.a.|..8.7{.NM..F.O.{u.>...^T....P...L.E...K}9..X.q.Y...i ..V@=X..Ni,]&R.t.'."f..g..9(...H.CP...p..L..'.u.......`.w>ao./:....7xVO.-.*J%....3<..H._(.....V|.7.R.......mhM.^r...O.H..q.P.l0u./...@..p.i.|.LNivw..m-1`.j.=./J|.

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\9648808B6C63CD1AAD97A7B68F84F35C95682143.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):9617
                            Entropy (8bit):7.981764938494949
                            Encrypted:false
                            SSDEEP:192:nHuyjZoqgeD/RYvDRX/nLbJGCVKb/JAg6I66LZAebnBxLse3gagWx1QlwPsyLoyT:nH/jqqH7CZfBRIFVDbBxLslKy0syMygU
                            MD5:1D2FB0C7C36458F7E6D3626D0F5B9C0E
                            SHA1:8E684B642B99A291EFEA3B3A6802A44488E3D00A
                            SHA-256:89F5BEFF5A765118592BA18E682A7F155EF4C5585065DC3CDAD848901BDF3EA1
                            SHA-512:01AF4BB25CCC9857099C421058D457914629EB4EE947BE9CACA8D204893DDCE987306677A272928FF5EEA976735E9B299082C56DEDD40CC86D77D593826F678B
                            Malicious:false
                            Preview:.'....BB.P....MR.Y^...18...Ak5@.Y.......X.W..... .3.......ff...h.c...7."J..p.M.IF...Ls..`......._..a...-..oJ>.....h.".(G.1..LZ.e.?.3F.e..pbe.f...a...bh....,....I.Z.ir..t..:/......D..S.8'\......_\... ..~r..aV./...u}.&2....rJ....h.Y...KY...C.g<..4$8...B.{.rRu....\.JG....W.j........C...iX1<[.......Kt....[...E..2.4*#.Y..F..$v..A.I-ruL.....2...../...|3..T/..Kc....A..C*.]..t..k...b....C").:...|.3......;s..A......H2..l7p......sR. <+.....e.9..C#.O&....*^.......VWX.67.........%.M...\v...._P.......HzaF..I....I...T-..._.#..z1..r..^..Q7.......M.g....B.T...:..[...B."....t..($I.@.E.nO.N.......7Q...d.j.............x.R.f..d7...I:.e...6....[.\8O.qG....DZjoL.&.I..=...T..._...o$1H....G....os..b...sC...>..v..@.N2..>..KBN..</iZ..a^k..^.9.(..o<.....@ns....C)Acez...x.6.\..4q;oo...+.s.~..@..-....D.....D.Y..d..&:.....Q.L.LE`..`.!B.z.R;Q.......m.G.q.+..#...c..@..s\...Y..X..>.....J.i..k..J,....'2..x.....6[ ..\.......D...B.Y.<..8.tF*.....Z.......b.....a.$ay

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\99B7BF8F4F0080766794EDBDC37140FABC009DF4.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):10386
                            Entropy (8bit):7.983491855907933
                            Encrypted:false
                            SSDEEP:192:wZe1WvtTxdUBJYzaNFr8Xl6a9vQA4EnDrnJsT/24z/9JiKRRWc86lz18Gb2ZKhwh:wZe1WvhxdUJYzo46YvQAhfnJMrR9B866
                            MD5:CA643E3BD1CCA3EE83C5979FF2059D59
                            SHA1:2779C9BCFF7A898EBDB1FF42E54C548A7A756C8B
                            SHA-256:69DCE5F2F0DAB8FB2C99AF07C36CF38DF16D5DE028C6C8418750326CD1A8E294
                            SHA-512:E98B731E28BDB3984259D255BC3B68F87BD426C6B71940882560AC24758C051E2E376F9C9411DE65274068D09873FFE96DB5124025795D400065A4D237D15C6F
                            Malicious:false
                            Preview:PB......q..o5.[..%...../oTdw.....POb...H%..?\)........(.:..j....UL.:W..0.....#.ZG...^+.C...|.. ......3.e.'........j.%.k.2:..2..0. )....G....iP.J.+.c.YJi.w.Li......L.1.F....0xYA<._..v..S..S...7....-..q0.)ie.....N.voa."!k.'..+...&.BlAV.#&h.V..N..k.`@z..de...u|.EY....N5_..g...<\.lt.1..........C....Q...."....h`...h6.%s=}p....4.)...S.._}.....h.6.`.A-m.KW.nF.....Q\...&..;.a..y...i..I.....|.3F...(y@..A.j.f.U~.1;..D.C.T....X.!4..3............6......G...V.....gD.0.B..c..`.......J....7.....2?Z.P.a.X.V.$...x.>..!.....H...^*m5.a...m|...Xv8...d.26+..6f......j..w....uev...I...Q..,...;..}...)zR2q....2.3.....u..:....bTN..!........3Z.1U...<...A...Y..uB..4q.....J..<..b.)..\1'..E?.'.......\*..'._.t.jL>..3..X.vO.u.q...Qe...R.rp.f9..xw....s,._C..A@.M. .pa.....4'.Y....+I.#....C^..G...x.7....}&.A.....+..U...._P...%y.."....`....up2.....^...*.b1L.4v.:~. .....:...^..x...M.#8............=T...8..,.0..O.+.....w..m\..$......p.Gy.='...8.4%hD/6..{.Q^..._u.JPlY.._u..~..._

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\99D01D160AC7ADE6301F3559541FEF1A6F6155F0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:COM executable for DOS
                            Category:dropped
                            Size (bytes):10959
                            Entropy (8bit):7.983361314547609
                            Encrypted:false
                            SSDEEP:192:I1H/Fa8Xjlx7uOtWCp7j1JNYqDs7HkBbfXntk2mtwsCzLJcqiz72iW:w/Fa8f9kCJj7+h7ivt2Gl6z6iW
                            MD5:384EFEA4C93EDD4E5496AE90E0293E76
                            SHA1:7172B66FBCA849D58A8ED1F21BFDD82405F6D9FA
                            SHA-256:1B07904BE427C0BC8DE9DB72880C4F55C39634BA140479EFCE5C43E82D104CE7
                            SHA-512:304C14DCAA5500077DD7DCC2C712D402C940930B98C4DE341963B53B5AD4EA9B56C7C6115C7B16D5E087BC3B472D3E99B4C454F2760AA73C38CF7EAC3CEA9472
                            Malicious:false
                            Preview:.Q..N.A.. ...............t>o&.3>..e....B>..h.....1..R{/.d.=.....Vj.-6.K.h.p,.5%Na..Hr ......\eR9.zG..u...L......l.u..8Zy.....g_\....m....l..)j`.|i..L.J..*..~..Hk9......1..M L@R..Q.l9..z2...'.f>6..5..\.|...GX"..4..v(D0.W...cX]^.....*..........:.LQ..S..h..Q0..G..z.E!..6.L...[.....3.."!.2..R.....B.-R...7...V.d.]>L.].....4N.....i.....FI..`.7.)..h...g....~.....N..r.B ..z...>.h..|..c=.2./!S..\F....\...3....@.3.).../.<...F..Y.A.s.9..a......;.m....?.....8..1h..l..3.^^.8..qQ.v".b...t.&.<.$......|..r..=.0.S.}..Rw2p..&.y..9..&....4....U........N/.#...I{;.;&.s...`.a.....[&.X....7..?\'.O%.......Z{..u.C.p.3w..H.....Pb.B..e....W.....B.`.....u.|.L....d{.UR............[><...)..D.Px.K...J..o"r.OJ....O$ta..z.O..|....5%,....Z.#......._....u.0.w..4)m..K....}V.x..I..9T3),p..J......#.C...I.x.S{...d...Dk...H.Lg...)...J.D.a:.xk...]..o...N./..AJ.)q...w........`...z..x.1..a.}^.f.K.\.....x..&..g..Pq^.......M...R...*.+....-.~.|.i.....+w;|6%./%....V5.n.....

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\A8743ACDA513FF27A72604EA39BAAE662138F0B9.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):10608
                            Entropy (8bit):7.982012418476653
                            Encrypted:false
                            SSDEEP:192:ZgUoxpw8wfPK+HG5zR4QJZT1+AZoKiEMvGyJj8Oh/lHSg371IFGzO:ZgrwdPFHgWQJ1gAZoBn9yg6wO
                            MD5:79852871D35A12FA590F996EBA23E378
                            SHA1:6E357FABEC75651F122606687F488817458DAF1D
                            SHA-256:E71247CCF22889EBA40317DE245B9EAF4664BC29766D3947AECCB2AD5DCF8535
                            SHA-512:D41788E8C8C1BDB8360C5A45AA7DAD5F70AA51C79248E1D0596A51F9B9505F4982C428F1F0B4DB47E52D0F717F8887419F8C89FD6B77054896C507E2359FDA90
                            Malicious:false
                            Preview:{......:.\j:..#@.T_..GXG.Ul#V...~...+{...lx..[..M.s....!C.h..V.x.A.n.S..dL....aN2m...S.....Tx.../.e.S...w..M~...&.....\#O...0o.g..]..(.h.G..z.PO...F.M1*~.$...IrM.f.N..@..}..(J...slv.z.......\...=K..;...X'....`_....L.g.VZ.,......>..U.).A......6..........G.\D...".T1..........gl........lL..4p...F....A......N5......qr...O...].z.o.p...b.PVW.>e.{dc....2&..c.Gs.I.v!.G.k}....].m.s..!Rtk.Z...g.3.~h..\.T..]u.....UfY..)u..QQ=.....IB......P@.z...O.:5...vV..tu..Tmd.HuD..N$..(o4...gB%..a..pR9..]/......# ..%.Ok....:.'.......c<..(...+..v..!..!|.B...F..#y.{6^..P?.GW..I..PV.~C.k.V.c...p..S.5..[....<.h...`{I&.-.iF..Y,h5|..L.{.oYWb..|k7..gP."a...K.....t.3..l..$.....<.u....G`G.......*..>t.o;R....T...}@..S..d..{......+b ...". ........P])...'.~.)"..c..&.....e.*..Q.-.2.......0....'.l..Y....,N.S{.BJ./....E...&....2..(... [v....i....g.b...1a.Q @..H?".W.*.9i...$.P......hO.R.GM.....jn...........f.G.B.E..,g.D.8..+. [.........../i.P.@.@..........."m5.3..:Ou....Q4........0.....

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\A8F5B51786B52AA4D75E21BED0B23433A7965AD9.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):15427
                            Entropy (8bit):7.987506671853155
                            Encrypted:false
                            SSDEEP:384:qm2MlwV+DmZlxGtvC+Bbi2lC/mBcSXskWe8mOC3Vb:qmDwV+iMC+Ni2lsMcfXmOs1
                            MD5:7E6332AB46B169E8C50790D18F1D4016
                            SHA1:CD7F6706F8A0EE3DD4B297CBBAB3A60656B91CD8
                            SHA-256:A40FADDC193688775CA5A237CBFA0D988D2D55C2262620C344FE13436D026F89
                            SHA-512:4147138647BAAC2A3FFC9336A923D3B22312034F763AD7991233ED934808E7F5C14991E20C73E1BCCBCA14A992BF2E21BA883E9CAAF12C7F89B34C4AD03FEE5C
                            Malicious:false
                            Preview:Z),OR.H.V.J1....[E.i....Hr/.Qed.{.b[..."..-'m.....*.Z.......C.^r...GI..$Hf...)Rzf...\..r........^.u1_.z5..k........j..W.Q_;..sn.1.v..*.>'..-B.K..<.+.X.O...|.-..Ct..,........=4.e.}a4....5l.. ..@=..n...0nA...........k....an%.'/...\..i......+.c.J.9.*2..zn.m.=.6...SB"..q..K.....&W_......Z..Gw*.5.v.H.k>f.U....,.B..w.S..l@y.b{c...%.V6*.z.r<.nh]?}!...0rU...mj.c...%. .@}cI.}M).-..V..-A.><Yk.e....T5.w.:z.As.2.7.8..#A..-.g....wo........P.H.1....E3...d..2...n....W...]..^U.uU........m.o.r;(....s3.XN.u}.....*.e.!{0O.....G3?u.....h.K..B.X.4........].. ..^..@?.a....FS.......h.'-..B.d.?\.+.....&e...]37a.....d?.1.D...:......U.^....>n>(.o...M.,"x.v1....:...D..c./1..*..;..F`.w..?.,..C.zW....|.y.+.!I.3.W.....m_{8.[..\c..9nQ.M....!...i./.|...;.....e...S..KQ.Gh.*..k...M..9.p..7.#.9.D`......|.E...0.M....q .K5.!.. ..?..8..G9.H.D.:...A...U..hC../."uk.g..o.y..$n.).Q...a^.G0CD..8..QV.$.NVx.a....:....F...Q?.5r....W=la.Sl..4U|.9..V...e.k.....2..'.`..J.x...

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\AA70DA0EA77AF599D16F76E79A98272BA138060D.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):16409
                            Entropy (8bit):7.989720180292574
                            Encrypted:false
                            SSDEEP:192:TID5nPQxHgoP39JrM1wsEaSfqfktZ8U/6/F16dGihCwqdVmhiCLKaR4P62w85Ut0:ctYf/9iK3istt0ow+6sikYO9a2dKsq
                            MD5:4F83EA19EB921B80D8AD182A2C17E809
                            SHA1:A33B7BB194C8FBEB9E4784BC23C7A83D9320AE26
                            SHA-256:7E8DBCCBF1890DA075978325B63E1335A8950B95F1B1CBEC0DAC60BC487FD260
                            SHA-512:171874989A8906BFB71C9ACC903542D1CB7A8B38FDFEDE75277C3843FE1D18FA15A4DB939C1BC092735429E2BA14AB2FB9D76686EC3F1906A0F62D51F501455F
                            Malicious:false
                            Preview:.,...H(.k2$..|........q@.3..._n.-@hGa.Os(.!2K......k.ZX..1..8.W{..&I....b.B.........0zK|.K.. ...........g.z....dv...$n\.4-3O.......@.q...v.>..Jv.5.....f#....o.\\p6...h...o.s..b-..?n-...}1.K...X.@.s*...^.}....Y.....l.+...........Z...T....g.r..2....?...E4.y...w#.n..%ki..d...u..xE...<._9O[..'...d..O.u..m|q|=....e.OQK.P....|.{........d...JB..m.a.Eu.s.;..C`.8s.h j.._...3..Q...@P.wM.!..Q.....u).2T.Gf....8...*."..{.]....B.1....J........._.3...&{...p2'..o..o[.,.\}..O|..N.x..S..9c.]e.3..$...z.C....GoRjy.......U9....wB0..R>*..z}....;.a@.k..($...ue.=......Df6!P)d..-O.C.(...7....iT...j......F..<..\.N"~.{.V.-q......C....~<A....s.y1.$..3Q.........z..IQ*i...b....%B...P.,..(i.5Gm9uf.......Rlz...w.1......=.W.CY..<J.Pz....g._....d...(..<..q.{...T.........ms.G...i $...V(.`.g....Cz........q.b...LV.].of...-d3.o$...[.U..;;....;.2T.I'd%.......3..%*F<!..U..s..!..O..k.9~.qIJ....G....?....,c.../....2A.NJJ.oe.P....[....-....V$.d..u..m.......;.....G...kZ..Rk

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\B688081263A59655451FB4979A60BA5EBF1DAB8D.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):10043
                            Entropy (8bit):7.982467652968386
                            Encrypted:false
                            SSDEEP:192:T//7vfscIqzoMUHDqZkgZvTv5vIQ4I39uzYH9fYpXjVmN5kkTC:T//7vfsDPMgUVB8UdfYpXjVmN5TC
                            MD5:EDDCB2FC027A7C78303B43D224F5A88B
                            SHA1:6D207E85DA67B13E2FED6BB94110F4382DFE0DCD
                            SHA-256:9B415015DB3BDB87849B05BF7CF6B43F0C114AB8DE0B9954B776CCA3D57090F8
                            SHA-512:888BB589F27D6EA2AEA1442B9ADB970515A6170EB775FFB789DEA0DF9DC7EDE7E15BFD5942AA00F36BD1C59F9164DC97D5BAC39CBB9C69AF009E5C56F7AA6354
                            Malicious:false
                            Preview:.N.I<TM^Q.+..;..;Q|.s~......1..+.gg.SP.....O. [_.T.(.:.X(....Ckv!I...}........I=..a.B..YdA...d.c..=q..#*...}.|.|E...7...|..E....@F.*...)M....3@.x....}[....5..d.)h!.....q...Y...o...n...0_.D........ qN....Ne.;W../g..iMy..p6._...vH....u.#.[)...1....,=v.....8..j.g..<.Dw.m0......0go9..>..U.......5.g./.}...]..<.%.B.)w.9...B.....v.<.P...I:...,00Sz+..*........a...a.U...$..[...]........@[Ks.......-.L|....ZH..}..Z.b../].. o.,.H.e...n*.G._...^..X.:.fd4Q2...&=....@. h.`p.$g$.o6M..5.+..OC.+.....5|.K[.o.<0r.T..'d0.........["?,1-.Rk.../Z.fS....mmc.3M............H.T..!....Y..v....syn...w\. .,...7..?..O..6...&.i:..B..U..[..]....F...0....m.."...t'......C..;..."..`7...(`.....}.G.h.......\........h.hd.U=..Y....@.)w...&k.8.|....W..O...W..G......O.X.OJs.9..j...dt...k...v..J4.T\$'...:..t...t....Q.I._.A6..(.Wv.1J.4H@.........o|.]-$....(WJk.m.....C..'FO\..G.".#'."k.va..MZ.+..7.....f.k.`...F...].n3......i.2~h..i&............ ..........v......_:.."d.e.W

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\BB3146D411DD0BA6A6C30A8DD3791529058DD549.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):10048
                            Entropy (8bit):7.982764227485043
                            Encrypted:false
                            SSDEEP:192:24hQ8Bamj2YlUNz94bsV8eWJ3C9XUnXmXhvi0W0eKt/:imqBNzybk8zJS9XUXx0W3g
                            MD5:AC0C955B555EA76E7A62C02D5B832623
                            SHA1:5C23AE428398A5D9F1B2198E4B6BA9A3D45225D9
                            SHA-256:9A1BFF94FABEC15D7C66F4CD3403F0A7AB5E97C92CC776B1A7876E1338BF1D0E
                            SHA-512:2F4310AA12249358D15B81C1ED7E681C2B09DB300A5A16222AED9BB924370CEF176AA3DE0B006AAD409B0C40AC724E9FCC27B0EA4C9084CFA2FA7C9728A98E29
                            Malicious:false
                            Preview:.}...uO5......w(c...A_...co.s(....Mf.Ya...?.w._D..S./+..L..l....L\..?...<.V.~..ZhE.]..I..c.5.}.Q..D..R.N.M.6...R......'....@.....8.M.\T....y...Q.*..u.3....Uy..."oMH.M..#..BzR.......f\...i.]f...a+jl..O..yA.C...6^.t"...8....^^...-..y)d..s.M..,H.L.+......S.&&I.JY...e%..3J.rxt..d.........P_D...v..kX9#.F.2........m[..G..(.Mn..G...TV.T.H....Q.s.TOH.%8.z>...[..QZ)e..{.....kJ..G.#k_IZ...Pm....p-......(.TN.T.....c.sI1..A=.....G.....\M..;\LJ........AE....,..}w.#W(..I.'}!....F1RH...$.uS5.......R....?z.N...7.E.\.X.&&.__+...W..BQ?.....0.....X}......0u..-$..X.G.......G...^4....#p.|-..].s....i.v.....s..~...7.).."x~ %.%3.........W.u.#...0......]DT")+.++<.-.....y......z.....I....Y..EC.Ijs.n..`.e4..Ll...j..f..r/.Q,H.V..v.;7..{<.S\]}..]n...W.2.<...`.0.Er....G......".2....?j.v..4[..Q5.....i..e..~..'.@xn.Q..G7....A.I.....gr.;.v...eM.C..Jz.)......O.9K..6'......1l.a....Hb...*._.....:...L.j.....}..........>..WN.T.}.0.>]....5.(.F.^..q.Q./.!97s...."eL .3`...

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\BE4820D40B48E7D6E96297A9048EAE2279EC43A2.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):12394
                            Entropy (8bit):7.987513444685598
                            Encrypted:false
                            SSDEEP:384:APYSyfyPJyPt+Fm9X7lHoD1hSEZ52Q4Sg2:x2yPHVoD1JZ8z2
                            MD5:9333C4BF4D7E6AC407D85E6B1C296017
                            SHA1:E43E587C9E2939DF5BFEE61826B01554CCD54AAA
                            SHA-256:AF203039EFCB4A90B001061C9DDC1E091E94D9DD4ED1CAD619DB6C86964AE06A
                            SHA-512:CE39E84350FB974EB202F9D312F265B0EFC11EF615A8F01749F59C0968B649B5DA7C5AE48DDC0151B5ACCDCCDFF742F7B005198FE0BACE9C4E2EFB1F3A67B816
                            Malicious:false
                            Preview:.(.../A.}.....@..h...].8....u..`.fK..v..-.[....+l.^....B...\.}PC.....l.!S5...\....*J.iE1"..A...6..j.+L3(.km.....-..{..jm.....|..e....C.3.vF.'..]......P.k......{w..$R...9.a./|".(F.23...........y.^..o.?...\.m~...H..+5.^..0...4G]#.jx..!H.W:.A.....w....H....H>...0.B..b.qm.\..)?!.V...s.v2\.l.K.e....&........4..a&../v.....N%`..[...i".........-........8A.h...Gf...;..R...Xl.T...l$etfY...@..B].....<..sI...lB.U.y..zl.QI.$i.|5P........G.,Gj...6.e..d..u.s.W........X$....eY...n..+.@*....%...6.3..B5&.z:.0.{...:......4.{.....+q'.z..\..,+*....xz.M.O..k..3U.....g.D.:.0......N.hJ......x<2.N.... .<.........j6.f.z.s..Q....y.N..!.\<..l..O.,..F.\..wf`..l.fc...N~:K0.9s.c.=....8r"........4.......n..D7p.7...G)L..-&.n6.>|...T....s...j...#%.6.k..n..Nc.iD.!Z7..q.|.1..-....7..).!.6.....{..c.&)....%....}.&....).C\iX..._.Wt vI.?.S2..]..%....O....k..!7.#..!..]....7\V...S....=....*.@f.4.7......3..."...X(.,.. x...,.......S..;.....a..V.J.j.........&.7...#..`G....H.(z4

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\C5FD1F724F49F95970FE8CD30C20519BF4582045.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):126499
                            Entropy (8bit):7.998606885664202
                            Encrypted:true
                            SSDEEP:3072:nDRAfukTkbrWaaJm5C+iLyVxcrYfaY/txTsUY4:nDRALTmlWRLyVyidR
                            MD5:2AD91FD25A3CD2FC6ECD185497713067
                            SHA1:1505FE7090F9B17AB42E4D0E2B491F97B9491F39
                            SHA-256:9ABA91282DC4B4A0781FE1982A2B80EC58CCBB519F0E059E7ADBEFD3AA946D73
                            SHA-512:34AFD53A9151E4FC30761F8E2D0C5508217E98013C2E2B92C530FEB7CB784F87A363855AA326978AF66037406739FC13EEE85383015AC5AC50B956D347179A61
                            Malicious:true
                            Preview:E.[.?M..`l..j.5..g.j7@j...2..&.......:.......l.u.[K=.O%...3...A.t.Hp.....u.6..n......D..U...Xc.D..6(..E$$..6Z.I|..J.b.S.].......2n,..q.mE6......$W......8.u`..#q.tR...+`...]H...N.m...~...........lt.W.?. ..5......]b...lx#.7|s..7.u..6Hto6.:-..$...YOW.7...i..z.a..f.$..,.....|..z.D>...'s.L:.EzM.r.$.........}..?..r..GW.Ow.g..sP0..vig..e.]u.6..l.A....-.}&..2.._D.F.Q=..F...s.._.3..1.D.....'.(#..N....'....<..V.............;.........%.IK.&[.b..?.m...Q..y......-..........}j..sd.......&a....S....+.fC.......l....%......h.W..R.........gj..l.&.Z\."!....v0..?a....P....j.C.N/....RM.].[.C..K.....$.p...Z..uJ^.z..j}X_.*..P.xg,O.G.. ...M...2............++f.K.]...3.K)".......~z......o.8..o.f...{...5..tZ..1t...'^..6.....?....^..J...Z.>M.vXW..l.vL.gC.. ..:.A1........My.....al.s(f...=i..Y.U.g.\.w.u..b.....t...c....#B..+..x...6.u.Qf.#.E..+....{.V......F.!.........d....b#.(.O.5.C..HNyVS.(o=t..f.W.v.0..^E?.T....|..i .....v.^..<...5".^..E.m1S-.1..,.0%1i.

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\CDA62003B1B987A64F1FAC75D1484DBFF94F08FB.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):9636
                            Entropy (8bit):7.982306253762614
                            Encrypted:false
                            SSDEEP:192:FCjgqHt63dfmUQwvSxkDk/orKMO9ESyWRyiSb6wP6AX+rmiu:F+DtYfmUJKxkDk/tMMyWRSGTr6
                            MD5:9CD3CDFBB2E2D6038728D24338860BBC
                            SHA1:9A9969695033A9250386474969A47DFD6C022CA5
                            SHA-256:EB7DE89C0DF803AEE7B090CF7E22A71B34F4EC1545D25B2D8BFB60D12AB0BEE0
                            SHA-512:7789CD961F4AD79781F83ED089C788A4A84D909F7E2ACA8CF1024E678C60B59C6159DF0DD4D993BD7F2BBA4618BC5C21BA001B7B123ACA19F91BBF21FA818201
                            Malicious:false
                            Preview:.U..P..-:..*W....4|1.C...U.~...t4s..]...:.3a..5.44.T.9F...*..... :...T%.7.F.nX..z._UAN{z..?.e.zc.,.......o.&..c.h10.............]..{......./.e`{jS.....\.`.@...i.44[D.6N..&t.M.`..+.&...j...q^*..Qt.9<..^.Q.!m..h7.k.IY..am.......C.O....,$kW...f%.1.cR......0...../.L.I....d.J...}....}D.6M....."....(%C..k.../..=...b1. ..a..@$@.N>f-J{.M.n...q..`...9..}/wtz.psK......G...8.-...)...].3PWR.....=..L.g.e)[..y...D...I...ea..N.0.|.aLr......O...:.=j.x.sS.......Y....5D...5...Nr....^@.YQ..,....z...M..J!9R.h.Kfd.....X..z..A"... ./._aW.I.{.7...;. ;.5.<fA...j...x~.LA..'....evG.tR3..c'.....}w.&...h.....:.....u`......\..?...$.m..]..!...C? ED..W7.%..C{.J...4........7R4L.I>}.......2......T....Xt.,q./......zequ...?..2'>......bU_.E.........h.,F.`Ro.G8...S..J.v..z..aK.B....%,...=e...5.)I.\.'[..je$.0.f...'.....+I...Dg..&....sZ.|u..V0}...d.....).Q.Q..D....\t-..S.lhp.x....""r..fy.l......................w..S..E5...Q..%....3.1O..lJ.HE.do.b`....O.b..~~'.....Z'...i...k:.[..J+..

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\D0F48A0632B6C451791F4257697E861961F06A6F.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):39045
                            Entropy (8bit):7.99553673579561
                            Encrypted:true
                            SSDEEP:768:djcF/PtvERosx5hrK2qJeN1t1mcPaXBmuPTGBfLVPLEGCSGQlVmGoJZsIKoV:d4F/PtvSzrZCWH1mcPavAfLPb6GMsIN
                            MD5:0818D500C4551CA0533A1AE8EC32280A
                            SHA1:A29AC97DC22EBF6E8057C34E1E2925EE2E6FB06F
                            SHA-256:9BCEB20DBDB83D2C8ECC8D248AA09FED8C889F655BB2EC2D1A4D3383EC49E5C0
                            SHA-512:FD0DA03E7B7B60479CCC969807F7A1EAE3E8703B9FBB49E439FEFC5389F040A3BE91B4F0E3B64B0BC89CCB4B193B9D6BF399C650EECDD471EA08F284B9345A9D
                            Malicious:true
                            Preview:b..o+..YKY..t....f...0.Wk..w....(u.S..q.]*.Ljc.....W..0.{f.b.V....7.j.bx'y..v...:LU-....9....j.`7.C)m...;.K..~&.I?TY7....Q..}.Z....g..'...o.GDr.?.....-A.T.....4.........'.;vE.g.d..M......_3....|.X....k.......*....;...a.Y.F.b...9'......Le.B...k.2.e.w....}o.M..7fR..T.....`..$t.S.0.n.a(..3o|#.......b`5.f.......j.Z.&...0..W0.`w..\..&l.r#...q.......v.[c.............M.;...N,....D<..D..[$/.q.hg.b...M.?~`..jlP"1c...9.......[..v-..._.^....v.e..q......../...........@.P"...Hd=..]U8.eL`.~I.........Y......[....TQzq..O.%.F...d.(.......&mD(....Y.|........`..8.,..F,H.=..&.....].+.bP..-z......>ko#..p......&.+."..8...<....X..<f.wNa.....<~gA.$.......s....jK..]J[e.......5...~Z...6M.@=..._...7.%.....U.&..Rb,..jS.r.Sv..X.0.).D..5... .Y...F%..::.`.R:d.#Jg...z.u....}.{Mt.R..-...KO.W.x0..3Q......H...X.P.n.........{..Y..-t.l.O.ay.`..P.4..[......=.:hc.$b.......%.B.o..K...c.wb.M..)...Y..nC.......zYI~.~........ g.*...].....Wv.jO...o.VQo.Dn...v.....U.d..0

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\D23F7952044A1A6016B80DED46FC563716A295DF.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:OpenPGP Secret Key
                            Category:dropped
                            Size (bytes):9658
                            Entropy (8bit):7.981743017678136
                            Encrypted:false
                            SSDEEP:192:+563gzNEwSyoLepI8e4BG4GZpQ1hCLva6XAv66g/o/JlMMeqADUJ:+UyNEvHLs64BzGZ+hWaHj/JlVIUJ
                            MD5:729192727452295959E595461B82846B
                            SHA1:8F69E3EDD8C7A77A8B19F086053BBF2ECD2DAF31
                            SHA-256:D01B41231342273548F8E49DE94B23D3C7029746B5BBDEB3E349CA958441794C
                            SHA-512:015E539D4A4AB178B8565BF59BA2B6820B27EF1F2EE96C608A7D9A2F328A4EC9487E1239805004CB1A02B3F882D73502C677387ACA0BEC17472C8056CB6A16FF
                            Malicious:false
                            Preview:....%fLPA$..iN.9.lm......N...c..dm>>..pm.w#C_.kB.Aq..@q..Qt....Pp.......9.c?E.Ddh.}..8S..0.^b"..........ucG[..!.<..........i3-!..nc.Ro.........4.g........"..@..?......4.Pj......N...$V..:I\..J..QC.L}GR.c.,.^.....S...Em..v..*.i.Y...s.q....t.7.!/.:..D..Q?3(..H.W.....4.......I......1...o.".....i../.3tv..xw.u.6KSD/C)..\...?..R..$y...0.=.#a{..O*...lJ.Y.[q......s..V...u.Lj...QV.y.W.R.I....hl%.......".>7..d..v3!..I..S..d....2R.q.....n.>.$..}.u.XUf..2N.o...)..A............Z..:.N8...)..|Tr....E./~..K..*._4.w-..Mm..........A.W..V<.'.{...Ts.....:|_~Z.....3T[.qJ...f.h..\....v.'Iv.."...c..Q.~7.(..........z.X..c...g......]...,>T.\#h...N...P..a....kY...r.0%..!1..q.._..D&.N.F.d...m..p..[..W...E+.e.T.b..AS..j.....J4.M...Ul....59.b.}...3..(.b..}.V..0....M..:.mM...O...^.....l.4........w..m.#....:e....T......@....g.z,.O..Dk.-s....O...P.e..f......lV.\"U.."S(.Z..K+.....:.KI.7Q~.'.....#=.v.e.e...^..]H\.`..R$:..@...)...)Z..j.,..c.o[....L...../`Q.....nxG^

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\D2EC61E8A6DC6F6B45A8D35DBEE8A2EFC553F32A.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):11546
                            Entropy (8bit):7.9832050651668105
                            Encrypted:false
                            SSDEEP:192:fPCDsgMqsv+2vwleLfzhkymbcNz7AU/YUSCnGqGCD9XiGH2VkZmCIyFdDwR56VF:fesJP4leLbhkuz0UnGA9XiGH2VKVIIii
                            MD5:C96421FB268B4A98B21839899EAED8F4
                            SHA1:548C5C9F468ED57149A6F91F97D0CC3D687F3604
                            SHA-256:C38D436810CD64E02BBB9FB5C0F5CAE68D0B93B2B7F892AAD275BA7C2147F461
                            SHA-512:64EF8996B10A87C4EFBC62BD0522018B4987B8518204DF8E1A719B00D730DCF8673916B3BD3CFCF09DE0FBA87F5BCB1C5A96655538A7083096D55498911B8252
                            Malicious:false
                            Preview:WLU-i.....rK.gU..u.../.....w....T (...[..&.|j1tb..d...j#[8;SC...O|)..Z."....?.J....O....I.&<....jN......"uB.{s..Z.@.....oO..C.ZW..5...8.}..9ewE..|.;....1j....%[L.-@.&...F..g..7../h/.O'...C...P+.....,..P.W&X.n.b...G.r..L..'.YP....../....d.a\.L..B.Kh.l......CJn.?...........T.v....g....*c. ..........j....P..}r...?.'......$n_..hA..|.}..O1.!..3c=...>...{1H...+..<...Bh...%...9Kn.W...M.zIxPoU).s...:}..d......~@....6....)'....y..X..}.],K. ..XeMt6..2."......T..A.g.]=Rkk..qy; 0z.2.D.Z..r6.6.......(S.....Nyp..Z..e.<. . ..&.@.l.O.}..6..Zo...D....y[.&i._b.%.....O2bF.Y3.5F...H..Mt0t.g../x.X.(..,$.G7..;.....F.....lk.[.C{.i...."g Yq'l.K.;.u7...c8v....(#c....2.*..3....Z#Y....v`..zG.nP....V...C.^' Y..^.Fk..A......<.d..07...d`....V..EXs..p..*..[..1.O..;...I..Sp.\.j~@z..4.....ED9..~XI..1Y&8.......f..lL.a.n...Q,^.9....cb.-..8.....[T....rAKYk...eH..k.^w.M)....cTo2........9y.A.<.!...'...f.P?....m...P,.@Ha.;......I7...KDG*..{.9....F../...g.c...$@J..q.NHs...

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\D53FFABBCD34BAB1B8392BFC14FF7AAF9ED8C220.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8349
                            Entropy (8bit):7.974924917408276
                            Encrypted:false
                            SSDEEP:96:4Xtu3bVMjhrU/lGE6GcezB6yfLZJWQ7kRYf9coyskKYJB+Y1MqCeK/zNO6wuCnWx:OQSrr4LVi5/fK/zN1wtWGviGBO
                            MD5:FB917F05AC863DDEE0EB52AED7454329
                            SHA1:EB6CA3F662D4B8D20F8EBD1D0FDF950481886D47
                            SHA-256:9B2D38176CF3D6F0FC2F32BA7B831D94E5C211289953B924C0062B28372981BA
                            SHA-512:353FF18E2177222D7825D908488D0C5057693BE17041B049BB9C90AF6EF9D24DB1B944355B7FB486E44C296AB4D74FB4EEC508A2DE365FAF491D6622AEDFA0C5
                            Malicious:false
                            Preview:....~..T..N..........z..2..'..9i.-...#oC.98Y.v."....K9.M.#...hZ..9.....#.W.x.q?. ..k..;3..4....V1\....t..u......0..Q.`*.bjLwx.._.<.s..8..q.......d..F.=&.B7Q....zz..gm..-.Mn..-.|5KL..........A..v.K.R,d..d....J..q...?...E.u...J.^.a.I...~`.cS6.......d.y.%..z..I<Y.[.$..?...8.2fA....2..Y..1..+U..%l....e.h.p#'....h..b..zB.Ut3..^....!D.. ......vC.......!Da....t6..........M.....I..7.=o.?.:"Y.ah.. .......w..o9.DP.6.VT..q#.Gj..m...K........7).z..<...5...je2A.H..BC..w.a["./...........hZ..<.............e.-'..!.y.JX..1\p...~..pJ+.;..V.w3.i..xx....A-ISm...2...a.%.%&P%.~a...V2.....1..W........~..D......,`./...Q/~1.E...P......z..at+.f........[. ....Y..T...'......!.&Q.....W6....~.&..'p.s.5...NB...{..P.....5...vZ..CA%.'.....A.....M>R..z....'I.......OR..........F.......A.Y8....}82.W.B.O]..HM. .M.{e%.cp.......O..._.....(..~J./..;9.../W......O.V.)I.[..5..d..M.R"...Z.._.b...f..@.....%s.........9...@..Vt..6p.J..S&r.:.j{.v..?...1....U'_._.U...z].8..C.d*@...O.t.A.

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\D6B0ADD0DAEA00708CBB4290B85CCA0E0FA79061.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:TTComp archive data, binary, 4K dictionary
                            Category:dropped
                            Size (bytes):9633
                            Entropy (8bit):7.979338404142721
                            Encrypted:false
                            SSDEEP:192:Xps/q4xN4/OL5Yy54CVYCo7Eu/dbq8FLSdUP0PSr04BOUXBlyQrO9mz:ZsXfX6UVno7EEbhLSrPu/A8lRrOY
                            MD5:8E10A6A68A8A06B4A87ED422D216262D
                            SHA1:F72D14AE53B13EFF2A1E591747A879A1AFFED4D1
                            SHA-256:6552796D41D13D9862B2345F545E8F1BD07C7E15904C2376FD28D476CE74A414
                            SHA-512:F26352A6A7FE0EC1B3861F4347E9AB4F04145A751A0E2F813EC5E36090E5C7998158ABED4CE09943D0D8A46846EA4C8B8D3642C0DCDDCFE6ECC15AC54FC3A983
                            Malicious:false
                            Preview:....=.au,.r....s:.j/=....-u..y...an..FO{[..c..WD.sY..T..&...'.s..84...(...[P.XK.h....1[..MXW.4...^..)9{H>..[i.dz$5q.1w.+.......:&#..{`.2>.....J.8...^j.8.h..d..........!..!...0.....^...sf.....b.Qm......@).S...avB..*.hF6.B....$..'Gz....9.......v....yh\D.s...>.v..&...........W\.zm.#....9.......i.olDm...>.k;tq...&b...-.S..6........'..x99I..>].sp.....W...y..(\...F.]..}5....Y"..(....3F.NV*....y[-.......*.,..Y.t.........IK".$.....%.....J.D..w...U...G.........a6....qxX../^b..F.l..ls....[..{3....b.?...:.~...._...0.t.~...|3.O[....d...,...V..@....:Y2....L.h............f.K....8.3;..nJY.a......'D..D..|.....[._...Zn...2.9MR9Y..~...B..z ..N.t.&j....D7jY.5.....m..{f.m...W..G....)..#.,.S..E.?7.'3.."V......:..-u..*..I"....1o...s...O...x&x.....(....-.....oO,....B.I._)...<Ra'V...;..../z.:....%`..n1.../.b. ..jC2q3QZ!nI..J...q....K.D.C...w.%......O..$....r.:.P.V ..n.u$!sj<,.y.<..C.P.......V...B#3G.j.'0..7. "!;...Y.J.......:.m.g%u$........R.g1..Ww...P*.1z}....G..{.y

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\D6F6B44E073736BF2B86AA4BA39CFF727305C0FA.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):10048
                            Entropy (8bit):7.979934735284368
                            Encrypted:false
                            SSDEEP:192:90nf+8DIS1BRhEKXa+3khDOf005LKU5bapOwJG2v99mbwCd4E6dVEOZw72U:90f5LrnE7505LKybPwJG2/YwHEKEOZaH
                            MD5:1D6AF7347A7EC83918C9D7B9A2B8748C
                            SHA1:919796CCB40C594FD49B859196199A0BE1BAC408
                            SHA-256:4BAA978BA4DB8145065A30EF94F5053BA6EC635F10FEC527044474D1261118F0
                            SHA-512:1BB37435AFC5361BA438F6CA0D2443758D7F254BF2D7F74DE3CBC3697782AECF4B7E02CC57D8B74EDA9676114003F021B463B3931B554C89BDBFE46150A3FB7D
                            Malicious:false
                            Preview:..Y..;y.e.}..nh..M.n.....:...0..C..Y,[sD.K.j..P....Q):....$Y..2..n.`...uW|.......Q....1.;...B..!..^.X..(...7...4..C.....3..M.#t-...f..e..i>)XI|.V.p...l......T....tME...gNJ.....z.C..<.2....Z$.c.S.y^...."<..U.....R.zep.,}.g.~........g.H...............<J.D..t...D.H.d.3.r...SAu..>2....`.Z.V.....#~.(B.X..)p.XtK.B.mkj.N.:V.....X.o.....?.'M.A..\.hB.u..g..:c.ng..D.t.....x.....)...Z).......v}...6."..i..Ct......_~.F.....}.....`.EkE..f.M2....F..~.S.......... ....Y...!?1.....gr.f.4.6...-.q....Y..6.9...QC..2%......7".."..|.....R._...t6&..a...m...A.(F..m.@A.....QYz.*........,.M.bm.<.Z\..M...K>_.%X..9.?L1t5DM....<..tM..8.....I.1T...E.....S.wOJ:P....".G^PO.'....B:..b@'6.q.V.s........[....FA.o.&.$.[:+.$=....m[.*{FX..f.|..D...7..D..c......L..@'.Bv%....8.....!{......8#&.so.w.3...R..?..pwD....W...4c?.H3k:[.n..D.N.WRM=..laH#...k^.@A..B...8...aD..:.J..s..w..D2.QR...Q.D..R.T.9z)......>.......`..+.h..t.........3.}=..8.....^..s..p.f.}.Bs.sW@.~_JBN.......C.wu.y

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\D7BEEC8C1D80E7AC7310130DB5854DFB79191F44.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):13043
                            Entropy (8bit):7.985728029338243
                            Encrypted:false
                            SSDEEP:384:+b9GAs2EXxZynNSj/D21U3QITGVmb1Ywft:+b1AfyNSjmU3TYmb1Yqt
                            MD5:5245628C3E29A7300EE94E0072A1A181
                            SHA1:166BA27D68FFBB5CD730E560D9014B0AC2CFA0E6
                            SHA-256:0B602CA6371BE899B5D2F0AB27E8339758AE7DD148F16A050F9816D09C8E7C39
                            SHA-512:F3DF6A2CC306CB11F1A3599FD6B0C0DA7FC760DBCAE0E6A9EC2C59A83376144358C10E0FBDD2258B7471808DC8D84D788221666AEBC646644AF1A80539968A7B
                            Malicious:false
                            Preview:b...e.....i.....IP..qd....:#.|..3PYP&......BKB.t.X.../...7o#..z....E.g,0.2l.f...0.....%tf<3.x.R....s...=.G6.../. ..9...414... ../..`....emo.;....K.<q...._...vf#T$ZD..._.3..n.M.......:w.x.J...C. ...E..Lt...r....x!xw..JXl...QC...9ck..D..Q#.`/....}..%#...u.....-76....}..B#.t.k........|.H...2.?........[Z........l.xg...$.j<..y.m..yu..../a.L.{..M^...<........>..q...&..[.....Y1.D.&"..kX.s.#+..i.E.a4T..eU.F....c.j.J.b....B.....=s.V..[i8B..T/e...u<.,.+].........D]QJ..b.B.e.b..l..yE..7......J.*..i6.#.]=...-..rw..5.QA.n!....X.L.u].V6._.=.W_.ms.C......./.2.#.}9..% ...5.x..3jO^...Oo...BWa.V.5:.3.\,.....o....]u...?........C..K.....CU..i...?.b95Q...B...L...nX.r~.g,....H.l....xG31...C.0$N|.LKI......+....V...Hi.....n.I...l....:.9z%C..V!..g:..|....3t..E......0=.&......:.BX....M...[Z9........\*.+X.8.Dg.4|m.?.x7...k..Zh...-n;~\2....x.e....c.Y..W...."eZ......o..V.Mm..c...`...K...7...z.vsU.pa...+F....{...[j....8...)}.G.3.`+4......(J...v.ml.>..G,\t.

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\D8EF12DD3F5A0B350AEDF5A0EBB7935D12C12CE3.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):9578
                            Entropy (8bit):7.983120771928108
                            Encrypted:false
                            SSDEEP:192:xor860w4myz0u2+ebtMl5hIswdsv79gdhRlohAL7tbLQcpopuLuvGyCbA1E8:6x0YP7FtddmpichAntbiVvGyCbeE8
                            MD5:28C5630026C4580BB329BC1EB7DE4376
                            SHA1:A065DDD28588A2DA8CA03DBE22127C00175566F6
                            SHA-256:7355EA990E1E630415551BA106E3C4D0A87692C694A490698DB0693B32ECF242
                            SHA-512:4C19F5437754A22AB79393F977CBD48A0E904FB139A58F6183C8FAA9B5E8A26637D197D896B4D07F4FFCCD171730DAD760DBB56B89F7890C126EA37C65C862B8
                            Malicious:false
                            Preview:.D...'..I.$..}?.Q.=@~6.g..........f...ky~q5.y.T..r..%....@ a...o......6}.L.d....T.V.......vm.S.@;......I$.[.tV....C..8..K.....'..S.h.|.K .q.....LGgfF......?..7.....<...'.<~.e..f..a.<.m25...d....M.(.":E`..W.x....CPr?sN5..(..&pf...R;......6.....F.mJ.....j.......w..LQ.9P...=....h.......H..."..F.......uu.`.\...*..<.![......0.....D8.k.6"..-.aw.zv.."..PYC..q..[..G=Z3.M.d@..rX.@E.hs....K..T/.........w0...1Z-..@i.........qR,...K..rc...hE.\{.S..s..mI.z...)...I*w..M...&...R.[.T.u...Lvx.x.}.B]R...n..\.4<a......#..r.wV=.v8.Y...0.X....R.=Tj]. ..t..xH.6Q...w...\.5.R..{x.........-}....6R.m3|... ._.>.C(.P.....Xm.E...1......1~...P........2..|7..#.......'c....B.!.^..xr[..c....B...'Ma..@.)].b.<&.M......"p...[.L.....##.u.G4...P...X1...n.<.....?.....-...)dHW...V...~P.sH#...:.........I...Z......!IA....4j...n...(..R!a..c....['....p..g........L......I=....E.N=.c.L.W>4........>.N3N...S..m...1..-C....L....;.*....!.~..lf.D..s.P..T.'.W...H..eruQ.^.x..nb.v`N.K4.NvnR"..A..,..

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\DED23BB33EA3C88FAD1C0A1CD53916E0D8C424D3.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):17208
                            Entropy (8bit):7.990172819475797
                            Encrypted:true
                            SSDEEP:384:omUT6cDMf8kMLiMkseWy9aZizRhLstFZgBEGYblu6Lou:omUT6cI8xLzeWAki8tFKOI6r
                            MD5:110B7CD14E6470A8BF67B530E77F8031
                            SHA1:2BCBB1BF2D72503DFFF2014A18FBF7DC253A90FE
                            SHA-256:9C16F8348CBE698EEBDB24C2B8078C3A870982EB10504A4B53F2A33A1ACE50DF
                            SHA-512:BFBA905014E513CF7D4647F97EA66D46222989F02854C5A6B15339CCF68C5E82072A4B65E41C9315C360D9CF6E5B69C9CE499DD56E1742C4A30D9AE30D8EC91A
                            Malicious:true
                            Preview:....w.pN...q..K!u.\.%.0.u...7-e*.P5.(.{.M0.}...J2....Q.....q.C.z......[. .........O..u.}2...1$.|.#..!.Dc...Z..UM...[=..d....U3[A..3.............RJ.|~..ZX{z....gaQ.%{.@...w.-.w.g...O....d..I;"..S.,.....c.8g..].....TZ.sj....z.%..*.<..).h>..s.%j....k.6..;.Kh.[.. ,._p%B......)n.l....D..._.b'!.J.f.t...Z............@C..x.Py.FUO....G..l..w. .4..%..v..z...k...);'...%..5i^8.pps1B.../.f.,....H,...j...CUD...r.Y.6.>.........+..oqt....kS...yK;...`.....j..-[?D.X'..Uf..d:W1...w. .o.:....W.......%.yRD1yH...."{....ry...KC$.B(...B.....L.pP......D....D#........... ....bx.'w...B..s...p..y.k..d.Z.........9.......Q..\.^.'.G%.....$7.....h=..G.{......'...^.G....(...In.5....#....o.......Z.^s]_...E&4j:.a.jH..]7.W..G..?9.nl.c.....q].0.....)......!@.}..<RP7....7....B.t.h.j.Vx8.....E./..g..F....D.j.it..'5......d1.#1=....`...B.9.{....2l...Xj..kg.B....F.2..W.j#..0..U.t.>4.<....I....H.....K....6..V.....Na@#.4D{.ZG$v.E.{X.E.n.. .....;...7....?o...9..6...z.R7..s....

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\DF0CDE23AA0F44779E78EFEDFBAED16DB1B4DF40.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):12424
                            Entropy (8bit):7.9855424236631665
                            Encrypted:false
                            SSDEEP:384:UatDVFB0OlH1NZg+sgt5aDcsHLIeZr3DED7:RDx0O91NS+Fm7swf67
                            MD5:75B91F89A59338BCCB997D82298A3B30
                            SHA1:6104C9ACFAE05C1618AD8E2B635A154A2D0E230E
                            SHA-256:E4CF0765767CCB50A7567862A8AC9C659A85162AACA0FE998C5012B9B59E9B6A
                            SHA-512:32ECE2D12351F180A41EAA2879F57140704257975839F0205EBD64618F02AC1C9C7F97F72C3FD5C3855828B42921534975E5250B3140173A3F2FBC4830D91C3A
                            Malicious:false
                            Preview:8....&.O......j...d.^.Ho.Vn.4.Z)..[.:q.Dh0:...%.7.(.K.{...;.M(....{z\.L!-...w._..6-R.>.L..?...O...b..OYZ.....Q.7..IkrlO.O.($..<.(. k.}......{.@!..........I...*...."...S..No?...V........Y.=..4...P4#.....X.}.ko...+w.*1I..e.......|#......\.....#..X..]..B.....m...?..G..O........-.~ d}.I......r.lv...../.v.;#.).?...z........\......-3.A..7..5c.H...;...Q..-...."q*....-.v...)..`.DBa....a.h^wP!...d.Sq..-..j5..f....r..j.Iy..v.l.,.Bb%_......eK....60.@.&...jkH..d......`..l.y.".......M..i..+N...>A.Zs...Ov.XMd.....NI...W...x.1>..j...+..8.Op....C..D7..h.../4.LXKx].3h.4.j...c..J>o:p.....cY./v.o...+c.z.Y.9..VB..e..$@..;...C.;^...c../6..c:.<.h....;..WK..,.}YD.j7..4x.u..~.$.V.~.....| .z....6...y..rH..P......V8.r.4.J.....=x..FO...o..,'z...o#D...X..x.b8.`hU.q...a.+_...Y.;...dhr....+.h6.F.^eG..EC.....%P.W..{..n...J...V.K.....!..d.0..<5.\|........e9>.u.... .8......?....Gv...g.f....|.........U...#y{..P9...\..a.....5=.D.....wK...4.........1.......S..g%wF.<.!k...54..-E..R..

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\E1F00A1F83D7AF444023D3806F8834DFF40A8E32.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):10046
                            Entropy (8bit):7.982646190337211
                            Encrypted:false
                            SSDEEP:192:P63qaL+YoU5cLpd6UWNPKET8pYGpPxTuXK6zRJ++ZAX9uhq6ha:P6aaUfp4tNPKt7xEK6NJ+Z+q6ha
                            MD5:059F3A653C8260964EF5DDD5836DCC17
                            SHA1:33509B3530659267B59D153A092BC6EC53DD2BD2
                            SHA-256:3BE0D2C5CF5FFEC9EABA099371FD072F134F5AB9BED93EF600853A6873A32B0B
                            SHA-512:95511A2113F5A337E4AEDAFAE12F5891A1F38151172C7889C7112FCB77400D7952BE62E602C77AD24D2402C01199D4FFD80071395A584147B4B7867831A25AD3
                            Malicious:false
                            Preview:...'...'?......G...s....".....nt[......b...!'>.<.8cv...h..T.j....*..c.G......P.-d5B.l....k...VYaA.f.7W~0FPl.....c.e&....9(vs..z.n....fq.e.mn.z.?Qd..U.T...,jt<...H..~`.(.sw^0......n.........B.*.:7'.-.T.7.0-.\..R.{z...!.....".....0u$:..j.....8.Q7.W..h2K.W...2.....s.o.4S...........]9.jUe.}..QnR.M......pT.D....@N.n.2..U._.W..~.?....[..WC.l.}.....x>...Ll8..UF...uq.+.Z.j..h.x.....#/m.j......xN....:7o..P..|V..qs}..x.s.%..+wX.c.N.6.@Q.....s.3......o.....(.<nM.qb:...t>.%*VX..k....W.J\.WO...Y.${..1.z.)t.[v.o.|3..4.~.S+M8Q.z5[.........Ve.......O;`..yn?...."Z..r..<.qZi..Z...d...j....1......>p........h..X'i!W^a...$;|.g.....@...b...Y...U!..q.m.S.11...Y..+....R.._...x..bB;...L...U.....lp.F..P.R1..........*2.f.=_f.iH.cr..(....s...Co. .-8u......2.....1...V.+K...P.S..lTw..#.s$ *o..V..5w.b..5.V.ax. \!..s../@.t.....\.:....s.(..A.oBp.....#S..i=6..4H....l..k......m\1.b6$..[.[.- .#..b..0>.|BQ.=..-....N.."P.A...7.S..9.Q.V.)...,K..u*.G.^30.nw...0D.....g...x&/X.......r.,

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\E557A7C6ADAC24EDE9B88CACC662B8A371C1931D.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):46910
                            Entropy (8bit):7.9967388011099985
                            Encrypted:true
                            SSDEEP:768:QLw9yc0TB4vM5GnVuBe+GPNyYAnMsEPQIxgZWNXTlFxzlU3ytmny+sV:QIyc06VBerVNgBF5ymmk
                            MD5:C24E0F5AB88B8D1B3A417AA0CCAA982A
                            SHA1:740752A28407107C361300D10F667BFBC7651343
                            SHA-256:D5363EA34D8B9DF7D5425088EFC5A1921241A3E1A19660D4292FB4A39E3EF004
                            SHA-512:43428D649A3AE457087D2220DF35FCBD4D2801002BB566EA2F361406547026EC9280C8044649158BCAF1B48C1F22CF15737C78680E67FBAF39316D4F8FD991D8
                            Malicious:true
                            Preview:...J.a.M.c..rk%.Q.N....Gb...xB.....H.On.-`...t....=.%..n.V."r...q...>..*.....l.9md.......(.<(....`..YU...~1....S.3,.?......O.3. ....3..y.P .r..$..^...=+..V.....g..r.0(.4...vx..u9.!.1....,6_C#..8.iQ.@...q..?....%)..n..+..:......N.L.....A..E...$^.WV.'...E...P...Z.;j.,9g..R^.1.9%>.....g..b......~..T.j..B......:..gRU.4.K.An.....J.N+...j.!9.zp...f..I.RDL..]z.h.~.xRC.V.....VR.d|%TZ..p.IM..5..x.)..C.<.....V....,......T.Z.*...4..&..F...SG...u..H....e........6w..1...._&y..A......C..0......QS..T.5..0...dQN....l.~.....m.-EC+.....Y....... .h..k..HSD.......|..$.A\"..Z<........GABIv...8D...hw....\.....A.....{<2.a:.".....'>v.rm.`...C]....5W..A......4.]%.}..:.p..Y..?[...h...K}<..M.^.3u>.._.........~.I..r...H{..w.O.O. '....H=|Q.......4..e.4.....!|.E(..4...z.....L..r...5?.50........~^.!H........I.q`.h...>".....!......".h7.G.9\m..^....S>?k..{....b...E.j...U*M....,..(...]p..Kr.:G,w$.5C.e..{.Y....W..5En.X..qPw..\..w..;.o_.g...7.k....Zd.bZ..$......k.

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\E707EC8A256322E87908664A49F800B7B48E0961.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):22171
                            Entropy (8bit):7.990739203484769
                            Encrypted:true
                            SSDEEP:384:rdn5/JPoS77FgwXSZ4xPOPPKTi20XbH7sgRMRCDgErXP4d/ARX:rd5/J/77BXSZDOgb3MRCH/AARX
                            MD5:EFD0658B61B2492F7D6E95D61142F4D4
                            SHA1:A969CFA469052B8AB57F09856D4119CD91787CAF
                            SHA-256:CD816CB6BB0DF4900E6900EEF3E345DB9972AFA9B9022BFF64D6F23480BB7FAF
                            SHA-512:6BE98AB368E24547FFCCFF80240E7C9925E1A74A3ED6DD7E4ACA19FA0F8E69D2974B08A1E87C4A705C988EBBC808ADAE0D0091EF2CEA89E57F9BFD530B20AECD
                            Malicious:true
                            Preview:...*.)..2.....RoRB.f....}QB[^...(72.1.SB.Wa..5.x..Xe.t..4...&.S|$....-.2....*.....h+.0..&...R.p.....(..Gc...j...c.B`....]n..d$.)..|..x..0g..>..|.. G....w].O_PR57B.........!.b.v.2.......F.=.......P..^t.+..-.=..J......6.@.i[.....e...q..J}~.+..6..6.-Y.688G.{3..l.@........-..z.t{.l....a............C.B..k...sW.2.%.6y.J..4i..@.K.....>..e.I..t....+o(##...6..$.Q+......UhoH.$:ep..;+....*V`.y.pY...[.....`..x.P.z.s[Fg)gB.`.j..fI.p..>b} .i.u..8..F.R...i..P"./...*P@+..OQ.*....R@GK...$RJ..0.:..e<..i...m....^......(.........6........%#q.y8...u.....m..Uf)...#.#........i...|.l.~cu.z.}.&{..&....K.3.=.@.>.?)....,...J.x8.......N...P.....W]......v.....uGs....H^)>.B...R....l@..)B...h|..9J..($_.....t.'&..#..i...d.s..&..H6,#..Y-....1..t..\.+.u....|%.~....5^.U..[..l.C./..p9..._.e.k.`.mb....3.s...t.w...cN...b~.Y./.q.2;.5..`...8..x...*...W:.9r.........Z..T..#$....Vg.n&lp.N.H89O..k.3.*...2.1.m...Y..W~...,..&.........K.....2;Ri\.....*..........3!B.L...d|...>..K2..

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\EA1E3132006CB34CB9058E6891C35B731B9C4D9B.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):10586
                            Entropy (8bit):7.98101549010649
                            Encrypted:false
                            SSDEEP:192:87lf2f3i/5t3QQZFHTs42I6IU+DM3bfnf3zvnnXyuxvpBoDTFCOU6ozB:8pfO3i/7QQTA8Hg3jnf3zfnXrkxCdB
                            MD5:2CAC82DCC390AA09A6982EA94E35E43A
                            SHA1:367776811AC7788740D62846E1266F58ED6047C8
                            SHA-256:F4164ACA68A6235195E49B498438A54120AD43EB6F7A6550268B98974D9FE112
                            SHA-512:2FF82F72A1AC2B4C956EC7E854FC33329A8B4CE59787E66E8E4E18D59D86BE6980757AAA892302066B0C6816934E405D3051D489F346F20A2CD6A6858A928F53
                            Malicious:false
                            Preview:......s..C.`;....n.3..".s..i.......}..|..D..x.R.-..d}.....Y.}}.....*.C. .A..$..n2.S.&P.N.AW.U....l..\....h..xs(....G|....}.o.9.........o..b..=....m.....|B........!.s.....#....=....^.....`.|u..k;N..?.T|....D..W.y....Y..R...Q..x...Vi..+p..#....#._....BO@q..!].P.F../..3.aJ?c.....g.....).-.|....w...7tbw...8....K9.D..7R..F...~..q..B9~.F.W..X'...6.......%5...W.....y2O.{.f?N#.....X...'.....a...{..d.4..'.).>.@..Y.(>lF..r.....p........K`.....j....K...O_.O~.....72.......'M- X.....I. ..Y.......^,...ix.(....L...x.i...7.x...9...A?.2...,.....Z.......OV.A|0...5..{r[C6O.M].Kn..j=z....a.R.....X.........m.V.@..=.Y..AI7.8.5......h..s....(.].s,.A/....n.\./.M.\........&...Py.E..}/.^F4%..F3nb....%...."...;..x...0m....iS~.T".R...|....U...n.Z^\?yZEJ.7...~mp..K.R.1.n.*..{...]...sY.^.X.9u2.~..X.$..&{.5..M.X...d5~qK.kw-..~......l.(.Wde....a..}....n#.h....~g`.).l.....{g)..R..&Xd7...|._n...H(...fL...kK.Dw{?...lm8..!...B../@.".f..!.....K.............=..Ti..^.

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\EDE675BC5BD66B9EEBD8A46A4C06CC47C388FD92.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):9910
                            Entropy (8bit):7.982491856386886
                            Encrypted:false
                            SSDEEP:192:jAH2KK8bCnBfxfl8Vq8o3B0c7lqKJmMO5Uq41MgW8dgZwfC5kjOUSf:jWO8Mxfl8Vq8VElq8m15U1gy+l53UW
                            MD5:1A154EB292781DC47613D77BD8A41352
                            SHA1:A3E3260DAE769017066B45E704E34FA75D6DEFEB
                            SHA-256:6F04B3502F033A116A4AF7EA36891A85436011F10230170E0D41C8093145295A
                            SHA-512:CAEB9C7125ECC9F039FAFD4D2BB15141A9636F213A671F621EDF1015AEC6289DA305A98474A030D69C7D1C2D01122223C4ABBF2DAFC01BC0F8A53F3CA1D3E3AF
                            Malicious:false
                            Preview:Q..l.[..5......E..QL...s....W .ix!..=.H..ZF.}c..R..7.P.0\......"V.>...._^c..{.q....5{O...^.I5.x+......0Q...b.(a....a...* .:w...Q..>../.S..........U.s:..nKN..ht.R..(.....7E2.>g.?..h.cw.C.....;.g.......}........e.Ln...Da.}....;...7.)..q.Y.>........Sm.."6"6.......E-."=;.{..vG.t.f.N$G=....E.c..U[.]F(...\_)g'X.....?...v..._h...Wj.L.%.v....).<.b.....}@Q...73b..P......H.3.........E..7tK9..x..~|"T.<.fj..c..$...6.....GK.m...$..c(~...0^.........(}...?.3.8...C.~1.;V.ei.7!?{. Bq....x..S.3.-.]./.Io..N...l..0.....y#..q.Y~.#''..M.T.$8..q}'.....I..m+.n"..m..?.w...zc.....$r...%..l.*.\.....7...;.3..q.......K.../....xF..B..!...L+.."..T.A.4..5P+iv....<.W....M_.wZ...5.8D.._......UX..r..O.6.?..9.....NN...A6#.m...KE.h.o...k.4.2.......j.R.....-.-..c..sZ1^...z.V.De.5.....5.G6\.........m0.A.M..DT..cA.!....A`...m.6U..X.7E.:.tO#...S....O..%..._ .d......=..G.......V..@......E...*!?6W.c.j.8-..wtb..~i|...nBNo..mrr..'.....J....i.b&=....i..x.q.Ou.i"............r,RC.5.........V.+

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\F8CBD54DDA10F4286A41EC6A537240712D6C2308.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):10166
                            Entropy (8bit):7.980471944243701
                            Encrypted:false
                            SSDEEP:192:OFdeXn/Lcxn2TT3Ze3XqloSqDzNu2+hclXk2wMSVvp8x8Dnn2P6zx+L0f:bX/oniGqloBM/qU2wrVvp8xoBz5f
                            MD5:3025D596567B4A30D29E2C4251AD7A33
                            SHA1:0877AB0477F1EEDDAB959AAA86DC7D3DF5B20C46
                            SHA-256:C76CEA0F92F838FEA42ED0FE9DA0780B3CD881CC9A84CA1881377D75D76BCEA1
                            SHA-512:090DA4A8D717174C24C0C25C24F9C30C550B40B01E52FAF91976B2BB059B25AB0DCBA13691AB48BEC40607BE238DB3D8B0C7E40A6D4A9DB95FEB0836A19B4EAE
                            Malicious:false
                            Preview:5.`.;.I..6I#............w.F1.S.d.k.&...d..".0..>.>..*m~.[......\Lyn.%..[... .h*.B......6.....M........9.(_.......%].r.ko}'..T>..DV2...X...og.1.Db..Fv.MT#"..#_*.e/..Xs.Vw.....ts.....P......;l_.M.z.qys...;.b.!W$..#K..05.)&..*'.%.....^.`...&....4..v..KU.s.........f.eI@.7S.......g..W..>6.g...Dd^.;...zOa.....u.........AF\`88........0......A..r(,a.x..J[..'.r..+..Y%.(....L......>.....O<.1..Q..p........^Xr......K.....>.-..)b......Vl.X....F3...iO..$.%.o....l..\.......Z.....1.,.~V...."......B,.$rv.A..C^..<3.Hg.q(.]]..O.^j&|y..dMMq}....@..j.y.......#.....9.R.\.On.G..o...U...x?..c#.].........yD6........xq.Tj_..m.g3".F_.4&.......w..$1..u,e5.7.........d..X.S......u..e.N...u9..}.tw..K...{~/_.v...DN.........Tj..??1..{...g.vD.6T;.[$...........`...L.8.%.i.FR.....>.....5v`..y)...4......A..Lr.../...=.d M.<p.y.t...Z.]....B.1Uk..`.0...*u.T.....yk.G....t........o*.k.AF^...../.9...X...z.%.H...br/H>`.E....7.....N.C._.>]...L....h....d.u<.oR...r.}^......0...X...I.

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\F8D5B76A1EF679D7E128B67E60239325BF22714D.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):9463
                            Entropy (8bit):7.978562058465531
                            Encrypted:false
                            SSDEEP:192:neS4r/IDeKIoWDIezRhIugPxCcnfWSXrBGvVpoeaelZ3kypD1I:neX6MvZzR/gPYcnOSXrIvv3kGDS
                            MD5:C2991BFEB0DE3A32EFB45EBE363DB272
                            SHA1:666B63407BD51AC57D632E5D95BAE50B09E397CA
                            SHA-256:7072929E152BC7F1196DE91E79B93C5E12434A09778C41FC24992531E2F93CD9
                            SHA-512:5602FCEFB5612EA45B081916CE66D7FDCAB49E1B0E2C45BE7DA4D9DE511BF3618A0127548863AA338D585D1854BDFA1A04ED41BAAB236B507AEAB0421ADBECD0
                            Malicious:false
                            Preview:x.8.z.z.r..*..k4..z......h.D..K.....io.......S{Y.........b=.t.iB.... O.{...3|.R.t/..Y...M+..<J.C._M...hs..l5\y..]...p..s...V...4v.J............b...7..aw.q.!.D.I};(...@.l.........2....v4.....a7)....^;.IJMA.B..........p....h{.A.~@..P.tOT{lD. C0......^N...~...ZI...v.. .n.n...n.'."q.....J.?[G...gKu?d)f.C.....y..J..1.h4.BT`.*LDY....V;..@|.8....#Ki...fC...pO./UO...\g'k1p..H..28.:.)...!M@.f.em..W.zZ../{... ..9..|.t.~_......U.....,&.8...C..S.pYj...W.N.E...AA.....Z.....ja..bU..@W......P/.....[sY4_3=...j....*g...w.......X.P$(.... ..Ec..Z...X@..CB'.t.....:...1..[.A[..%..7.p..%{.....A..&o.2....s..b.B...5..v<z!...=....\4.k."g:.&...].M..~..`...L.ao.8V..N. .8....yyjE.l.E..f..@z.....y......F..J3....l......Tc.}.B..>.-!h.r..3~7...{..qH.F2..Q.$.W....:Y.f..:2[...6}.K....!;.|...3.. <...*/f...=.^..~..w2v.b.7.....S.O.V.....U.z..~...3...(....r..?.v..2..VO(...dw..P.u.......Ss..o6.._.Z..jN|;....[.C.(.n.U^..o... yt.;..Q.....w..g...A.4.W.:...3.XG..Tc6.....'o]?..

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\FD7F0971C49B05DB70F2C587B10FA81DE9E34937.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):10039
                            Entropy (8bit):7.981430867480797
                            Encrypted:false
                            SSDEEP:192:wZjCAHq5e2dLI+fr1Mwc3qCEQbUGZETLa2HuV4yoVTK9hNuGl4KYjXwtjqXK:wt85e2WzKCEQbUGuflu4ysK1Dl4/jXJK
                            MD5:D83E45ECC0D22D42C9B1EE33BA0E32E7
                            SHA1:B6204738F601127F7C41DC9FDA33D855BAB404FA
                            SHA-256:BE46FC37192A181DDC0F6FAD1A04BBDEB76BCF2F2602E0AF686B5E5882384ADF
                            SHA-512:F86D639087418713413F88D89C9CB097349476DD4E51B96466C19D40F482290394172735E71AB22D69819544429FC74911DBDD6E769272C94BAA0C6C4B49BE77
                            Malicious:false
                            Preview:..@..0.N.`..:...|o..C....'..HyWIZ..]. 8..'..R.6......an...a9E..w..y.....E\#....F...O3..-....L=.k\...G>......E@N....`.%.@...........$..i.k..R .;f..#&.....V,....o'.:.C..s.......FP.m..?.{.,.F...+..z.$.....#..R...{5y.7c...l.%.3.<@.G.9.....Lj.7....C,.....`.O(UBA.V..tH.`.~.....j.L{T..B.$S..n.<!..3S.E.\.........D..V)...$..j...e...yV..c...hZ.7...ReV.&~;.n.I#.......7..Q...2)....,:2.....f.....DZ..1.m}...r.O....>l..^%...Tm..f..z)h.2..............h...F..%........L..4..<.............f...=Hi.O..e..B?.d..p.sg.Z.......#.Z=...@.Z..R.d.}..r.jj.......I...F..>..G.N...~D`J.{.&.;....I ......'X.~..:..IT...}.{.p../....A...m.s..1.*=... ..^...z81.sp.M1.Hps.X.~....|Yd....&".pz.U#....V.e.E...{EGC.]....&..px=.........;.;........&....'.".x[0..-..K..T........!.x.}.UW.B../.X.k.^.^t3.a.q.b.8}E.h...qz ........t....eLT^..7...$+ne....ts6,.h.SG.;...qIL..\f...`.........G..T.a.b\.@$.z..$....,<|..s...%..."..AK..n........E./*#......%ji.wE(....Si~G.2,.....v...Ncm......&"..M)

                            C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cache2\entries\FF63A96CB0EE05C4E8600CAFADA617EBA0BAB35D.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):10053
                            Entropy (8bit):7.984257612159324
                            Encrypted:false
                            SSDEEP:192:60i4G1DJ/rtua3nj0kWTkee91/9WROOxcmQQiBYk1J6tbdSrrq4c:7YDZzjE+v9SOO/QGk1JIbdUG4c
                            MD5:24AEBB6F7EC85E6E213DD01D6B2DEB7E
                            SHA1:269C613CBF372FA3BCA560D985F01C4EDD7CFFF7
                            SHA-256:75D2EEB41AA83DFC89586EC307C0D6C592430BC325FF50A8EA312EBFC6ED8DEC
                            SHA-512:95F82AA83EFF604F37BA51885637D692F26AE91E0B191168F565F4CFB8BFE2892D71B6C0E78792F3D6064F3D128827B339230031E9535DEF3874B6586EFF0EB0
                            Malicious:false
                            Preview:......2].D........G..;.:.I../.....'..N.k.n..b.n.....Mt&..]0mI../t...S...:.hS.K.<}p.{}_Z/\....R.k...s.m..f.uU/}..l...K^...R..........6....\&....E......x.A...9*.(.....g._.p.7.7;.#.}....)h....l...:.8<.v.##`1.Pj7q.T.o..._-.M..|.~.I~oP.../......"....L..)............N.Z........z....U.....a>....p....]........... ..........4].._../..]cQ/.?E.m\.v}.|Im.......?..O..r%...~.r.$...h......I.a...z..../.v..B"..e..T1...#.\..%6.....}|...B......#...tK....)..{..QtC{".#.3.a..f.yN..%.0~w....6....../>...y#.V...-...%'..F......Y....`.aW...B:..Qj`J [..=*,...~.[KMIU..9..:/....../.}.D.E.....h.Q.n.....8A...*K..-.....~..$...u..W.}%^..qb${M.....[....V..Z..t../...H..f.....O.N..&....'.......cA.c....U4.............XW..H...X.E...U8[..#..s..W'p.\.!..:..so...R'..M..c.......ws...2.FX...@7k.B.........e..yG.?.U.......b.z.V......c..z......O?...H..z........E.......B7..J6d...4..S..K.....E2.!.4....I..ES.N.?..n..&.-n..$...<..Lh.......#..*d5.`w'.H.4..x..1....d..&.?..f.Q....c=e...:.).Z

                            C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.980674135184979
                            Encrypted:false
                            SSDEEP:192:mAp1j4BVUFB8CX0pfNdO9Tdy7RVjuEEf/PO9QvJC2CZu3/:mAp1UBVUFdudowLQnThCZu3/
                            MD5:1A0066C1A5D0DBD1607677C824C332F5
                            SHA1:52A8C72C398FABFF21BC162361140286E9FBCB22
                            SHA-256:1BD3C344B710D1995AB4670BB0E3A22455C6BC6E44E6A9CA71B82F268CAEA3E7
                            SHA-512:D92C9F0E3B64DE00E057135AC14182C17DCE2785ADE2E6532FE5373EDCDB65B6E6F54D428C26A9734D4FCED8121CB75FF8531A219602C6CA54EBE6C9EFAA9695
                            Malicious:false
                            Preview:....0C.W.....A".2....c%.$...z?....u_.(tb.......o$Q....i..........U.e....5.y...<D..-y2.....*.E!.h.s...N3D.O?.c.L.r.ta}.SR...N2...r$..z....V.4+.G.Bwp.r.....;.l...{LI...;.}.....$...GdV.np...5x_..<W4.........X.'hz....K?.Rr..U..lB...c..*.[.|..P:X`.b/..L...=..f.tVE...Xm.....T.F.N.(.DR.Oju..}.h2.p>.i.>F.x.K.f......i.g...|5......a+1.1...*Mu...0.tW~..4...{.o...f...Vp.......=.o.U.U... l.mK..FV<..C.....(;f.)2|.?..}.I.~.../...,7.#.X..8.)...4O.....zc... ....1K|.Q.......O.P.f..1.U[s..A....u.5$.B.8..E2..9."G..(....a.0..V{m ...Si_X...3..|e)&.Y.6..Yc..Q.l..Kj...<m.D....,Z.N/e\..B.../.5GE.r...p(j....r....ya x.....Sg..Z...y<.......Z.Y]~l...1xx...VRux~.5q.n....|f.W..w.^AK.u.fJ#0...M.^.5..#.>P..+.T.8.N_.^...Q....%.q..h.c..*.&...fj....OD..%u...F_.......R...U....o._.C....S."....H+b....W.pM...a.q......,.*.?.......o.............!.$&.7e.j.0.U5Kq.:...Z..Z`..eO...{pm..X.+\...).[.<HF.G.....J...j<.......0(.....F....X.....!w.e].."J..sz.@1.T%zJw.;B....2:G,...4q3.g.@.f;.V...wi|

                            C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1695
                            Entropy (8bit):7.881689076691747
                            Encrypted:false
                            SSDEEP:48:isc1s9r9IL7MDmQkTE/BWLEWrwg00ElzNJcHGMSTk:9c11MDmtTosEpf06ZcR
                            MD5:D3357CB6FE0F30A47D123D767E4F9D05
                            SHA1:FB19BBB1DD8ACCE7750745E06F4416925F31C907
                            SHA-256:999C38E6804F91A183994D082B03B2C8F6C3AC2E14B75DAC9795CA8BA98754BC
                            SHA-512:19664ED2120FC75590E9632CBD2E9774C927D70A16FCC5935B52EC28E1E5B2C49FAD78008CDC6FC0D9B364501D34BFC303C8C5BFCAFD21652AAB7445A22AC70E
                            Malicious:false
                            Preview:e.Uq_^.2...`..T.."]65..^....._<..Gn..?b,.+q..0t.#..kMp#.-{..........M......0i...j.\_..}].n....@r.A8...j.g...{B}.#..to.+q.,..`.K..y.....v(M.....S! ....5....q..1zAR.l... ....(k....!<.....^q...j....z.irK*0........z....M.....8.B.n. ...]{.9".It......E...Ie\..U.......Z....]Q...xM.p)..A../b..73......F?.8.x...,..;..4>..X.7.S.......U,..7.<..7?6..^..,yM3.y21..G/..a.Y...M_...O....u....Q.eh...W....\.(<....XxW..H1....*..ASy.. H.....F...5..l~....r..-.,H..m.za..P.........V.M.P.m...]....T..;.G..H................a.........i..|.....}.I.;]..]"B...E....C....@..uu........P%E.....Av...E...PL#..SK&@f.&....6.f.......`QE..(4#...0+-..W(..t4.K..2..x.......n..9$...ot....L......[..........b....q}.~........Vg..o....._x......Yo...D...?......:...n.e.tb.5....\..T.^..=.f.....%!...L.:..6......m.$.P.L,........y.$...;.....n0.......X+...P...9.0..........E3hO.R.6.aJ.,.,.]f.9.rS~O.......L.L(..L... ....A[%....(9}...z.c{mt.5[.../}t.rP.-C6 0...?.D..q..5Y.+E..72T.@6c..c....3..

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1299
                            Entropy (8bit):7.813291084803024
                            Encrypted:false
                            SSDEEP:24:ZR9xtnG7NTaeYa7LQybGmrSowZziC6p+UiO1JCoqjVYTT9TRg:pxNG717LQOGmrPCeV3JCoqjeTk
                            MD5:589E70F5C1F07ABD3B9A4DEC31CBD224
                            SHA1:F68F4679E9370080B11DE0BD7F9D0314157056D6
                            SHA-256:07BFD43A81083E16337C08E7FCC2D72F71608A566D26F6878D562800BA2CEF87
                            SHA-512:56D6326E4C349746A668B3B0E33079330F2BF0C24E66E6B0C3D480FA06E3476AD281063025969D2D4F4E5B8EA6938DE6B99AC2CEEEA7E68DB6CAC348FA5C9297
                            Malicious:false
                            Preview:l*`.,..H.i...~g...RT.......1..C5.......y....C{B.....c..w_1#3).P..v.Ic.A;.!........3....~.9o%*.2.....+u=.w9M.kJq}...'.wD..Fs<.....O.Dz.K9.........Q.C.5....A.G.6.;...(.B.!.XnB<=h#F........=^1...........M.q....uD..@2.]4.o...(V.?.hW*#.yv..m...s..8....Q....S.8.~D.T.|\..$7.F..X;.2\.n.He...L..E..q.l.wvbyd.......e%$......G6I7.T3....N..NB..l.P...`.....9..KX..:.)@.....x:.,...(.w).]p.@y...`.3....;........./......,.H...w......~.#.E.^~a.e....<..f..7X...9.O.u...|'.B.(........#Z...J.12.-...<}>}.z.T...........7.c.mR......|.B..P._..7.m..J...SV_..oOz..']D....@....@....V...v....1..w..e......oe..._..9..0..:..D..5....S...^D[11...RE'.....s.7.(.p....N..L..../.q.7..c.:..mG...P...*..@s{-...."....9E:.y.vD.7B..K_.H.}..8.w...5...F4D..y.uS-...v....x.B.........M.N."...?...^.E..XN7#.i......?dd.?....{.......F.).D........z6_.QzRy!...O.:....-.:9.&Q.......w.~...cbYR.x.)..gW..).X.)...\...`$.S.....x..$..=2U.mx..+....U|.......X../...}.8..D...a{G./\.t...H.<?.Q5.../...R

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.97898634500891
                            Encrypted:false
                            SSDEEP:192:bmngGEqTeC1PbwWl+qXWdrf5ca+Uzvm5gjYpHSzlwLNd:CGyeC1Pbw6vWrX+ICgjCHIli/
                            MD5:4EC876CB28B7CFCED9727264A3DBA265
                            SHA1:BDCDC28758861178130ADF2484B3636138551098
                            SHA-256:A9C9429C5A07B9E5ED697C421AFF1EFFD45564CDA7CB5B5AE779F9E5074DF0EB
                            SHA-512:CBD5E6C5A80B1C64F575955197CC5E6A9C5AF060771F55822D0B7B1C6806328697A462741AE069647553533A49635F6BA6268C6F5DD001AEDAB8282F7B57BABE
                            Malicious:false
                            Preview:.....W.'O....r;.\.^.pq........|.=).g\Oz..QQ7.K.(..UuVj%....04.6..v...z...BOZF.wMe...z.+..:t.....>f...3..].,Wd...n0....V..;.!q3.)....-...x>@u.^-*...Tx.l^.p..............`.)~.0rH.".4...F..[7I.)....1..x.<.._..{.t........)..|....9+.....m.).H.8kY.o.m.mg.M....]..7..f.e<wj4K.d.x}p5y..F.J!E..'..-.. ....Z'..0.N..`..ggH$(6.$z...3...]S}...A....../...|vv..5..l.p...0.x.^....KY.._5.4...R.............A.6...Pi.~..#6....X.c._.6..RzYCD..o...h.....D.[<.XUTv.|K.....jp<.$Z....W..;./b.=!w.71.Pe'..^!fZ..."l....2.!..N..r..4"t.{.hX.:3....V.8..sx..7ZJ....`S.M...4.z~.3.1M.b......*..+G{I.}b..m8^...4....k/;....N...l.Q...<<.,.+..rV.A;.S.....3...._.......~8@@..zw..c.....j%^..jy..wpf.R.ys...w.....jY[F|.........)s4N....o..:....X...d-$.+......z...[....&...l.Crg.PB$z.S.G..].......bW..J".0(>.Nr...`."0.G'...a...I.V.A....e..ta..G...n>U.N....-..P.*.......W.B..A.w......>)k.........t{...T.n{.E.\.FS..;...7.,.^...g6m.............].F./....P..7Ni~.C...T.3>uGj....*.Pd.ZQ..v..

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1573111
                            Entropy (8bit):3.620020039229466
                            Encrypted:false
                            SSDEEP:12288:cgPMXF7C2cgKBlSp2HH2f5VXLqZ4a6xYRkp5NTFmh:j0VJXysp2UqZFRK5NTFmh
                            MD5:D081BEBB65E8767307F5A688DE4FB1E5
                            SHA1:FAF2C7E353E7840C23DB8F6799890C00BBBB6B3D
                            SHA-256:A68090A7EE23F9E84CD22F2D249EF895E4E68811763E858A2A15ADD04A856465
                            SHA-512:5AEEE21E9862DCE0DF922410716EFE9D2BDA6E62E68B7E9C6925CE9F86CCD5D4914A0204CC5C0EF8293CFCFD88C0D30A9046135A9B31CF686C0BCEDDF06384B9
                            Malicious:false
                            Preview:Ud.n.y).=R8....n.z...+....%..>A.......8{...>.N.em..P9....8j}..m......]....Y....|....?x.x.7#,....p-..9.g.."U......U..{.......4v.HT.?`.{.z.S ...C.ogovv..G.e/>Q....8({..O.......).V...j..O.@.G^.V..R.X.O...<2...R..z'.m...G.|.>......>"`B..D&cU.........J.Q..@+.S{.1....^.6b.p.=.y.2...7#ORn.kV.....db/3....' Ar`..fJ ./.im..c.J....)...`.s..0.b....d.B54.l...y..o..U.....M.~.._..u@@E.+.g..0.1<.......Tf..@.x.,.........pc.-....l...,...hK1..=.u.U..MW*.m.U=.d.U...|V.....M...<.9...Z. b...6..7..O.G.o.P...{_t.T..f.:.\..........\4...*.jVO2s......{.da.d.\s...A-.b..q;..=.p..C.G-F.W......*b..H&;.XA6`...d.c...pI.bF."G.d.@.....Wo..I.A.A.....9.A..U....(i.8.qbC...........x.G....N'h..:4T..4;..+.Y...O.........T .Q.a...D..N./3.=...[*..s[.~....m.....\V..a...b.Q...i...R.V.g(...QtO.n.).S.u...T^0...B..........<..y..5..tC.)........m...`%..[.z..M2...l..> .i.b.?@.K._....p..".MU_....W.Kv...Q..-Wk.o.../8e~.....B...o...H...g0...d[.....?.~..f....~.4.f.}.IO/G5...od.Y.a.c.R..7..g.....

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.jfm.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):16632
                            Entropy (8bit):7.989026178143459
                            Encrypted:false
                            SSDEEP:384:N2+ZJCmZTd8RdFZbS/z2whYcHOzjE/K54DOpgV:k+ZD+PbSr0iDO4
                            MD5:4238A30AB5FBAAD74C4CC506323F1B10
                            SHA1:EA5C99AE41A4ED52759B6D8003F4B920101AD99C
                            SHA-256:DC2869003A5254F30401F3C65D90AB497EAD66415B0E21BEDAABB9A91A114E56
                            SHA-512:DA1DCB1E5C67FE8C3115F32892E55A0E99A8436B4D432AE16BBDA314A6AF911EA15B928454146557E60A54B3194B97BB4650EBC9E37A038B3B82D7D6F12E6087
                            Malicious:false
                            Preview:..;.d........D.7..g.^.. ......p...j.^.p...O._3.T..F`O[../.m.S.a.ya.I=D..t.l...(Q....xnr........`..!..P.<O.\..,..G.\.....+..4=.N.K.Q...........Ba..,b.P......k@{..{.....$...~bB.....j.....Pn...qm1.3u.p.[x.....B.f.u......X...A...j...l........-.., ......Lu.j.B.K...O..DJ..;..4...{z..>.j..@B.....n.z!@`....e~.... .....H.$D&.^?.Y.B@.(.3.0.s....r..u..K6...)T.A....`.U..B^..............!...*.).GQ..?n.).. .C........K....2$..0....7W.g..1.A..........j....x.F...=....S.......k.N...._g.pR.`-..p`K.M.......U_QB]/..7.Z.%n....B....(91..8SUW.....]r...t. .g7..LU.R..-......7..%WW.kS......FN.h.?.+.K.......7..nz.=)..1.Q..t.28.y........ep...r..1x.a.1A..%Z.....A..) ...I.....i....`o...BJz......G.*.2.....K....R.z.S.j....s.b{..#H.:..sYT{.g..^......9....2...P$.Q,W....J.o.=.x..q.Ww7.5K...NY]i.lT...f.aS.{.g.Lj..+S./j.D...!...<..}.+.5..}zQ'd^1...Yx<rt.....+.A...sy.....y...k0&..=@Dm..HU;zI..G....la...nPv.&`.gL..O..].......K...Dio....^.M..>...1....j.g2..op..i

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache\Local\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache\Roaming\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\ThirdPartyNotice.html.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):107444
                            Entropy (8bit):7.998531027068833
                            Encrypted:true
                            SSDEEP:3072:yvkd0dHwKB7LbZchPtny9IjVbC9bnXzFtT75AZuYJ:ZdiHn7cNty9oQjPyJ
                            MD5:A45B027E6F320D8AE029A1F019499B24
                            SHA1:15A5F93AEFBC53DAA3AE9CA7CAC05E86975A9A1B
                            SHA-256:054320BBEE355935376C1C9CF3B21975048A8589E866AC0C1F89029CE7A8D0EA
                            SHA-512:036960BC7501489E9DD423B93DCEF44740CB9324E9F4B235EF2A3F271900101D665C5290F933839835DDD316E58A21E0CB67F61F358225BD34A6AEA37C5EB25E
                            Malicious:true
                            Preview:.......N......rWt.w9..{....E...w.%q.V....c.....$.d.s.N.!U.B......A..k..SLq.II.?.........w.s@....h^..~.W.O...M..t.KL?._..j....g$tX+N.....4..a6.....y..Qu.../L..l.b...{....<.)..su..I..ki.d.L..=...H.....^.3..D.f.....c..j..\....m.fT...j.`,..h...jD.C..jN.B..4r^|....$#\...g.K....u1....,.Uo..x.......X.).c...v#.98.G.K...0T..>...)l.....U...<..:..n..E.<.i..z6.....`.|..m.={.5..t.Z...h)*.......F......@....L._&.l..r..(.f.....th#...X@.s.k...fN.....O]8..z$.[ii........7&T.<...?.T.......<.gG......>U./.OB...w....M..z.E.<'Q\l0....{....Ue1...+.@.o...k..T..1L..n.....y..ASP!T.].v.Q.L.U.......p...o9......./c....%%......Y(- N8+.+..,...T.KiN.ut.4m....$w....3........L..<Y.9..A..N...PhR..... ......wz.<*\..>.GX?.LB-<.....l...! ...-W.MmX`>....sH..>.o\.B1..../...e{.y...J..x.F..._.:...2.Up"..2ZX.C.....yr...t.t..r..I.>..&.&...&.I.4.{.....?:./.m......F+...'u..EBY...."...U.E[......$..ZS..:)....55...&.~...iW.T.Bb.N....~...._...%..c..{...n~%o.._.mi....;U.... ...5{...p.._...Z..)

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.976104681183022
                            Encrypted:false
                            SSDEEP:192:vOI+7UXN0+m2XJkomqJqXEW15QkR8fsE2Ent/Q:f+YXN+OmUqXEW15TV4dQ
                            MD5:444A3951D2F070AD83F38241018CAE9A
                            SHA1:E0FD4D95550EE03922E794387380E525A82004D2
                            SHA-256:66E082F9879FC774D11E65F3FB9F2012CAFC4A978F55276E6D492ED5EF967370
                            SHA-512:4CDB0E833D48F4FF6BEFB6626AD5244D319AFF70E6A21DEC101EE7A6F818CCC45513F43049576F1891776224ACA00B6EAF95AC96CFEC6E4200A24D9ABFAE470B
                            Malicious:false
                            Preview:.F.`..<&..te.qZ.jRx...@^..WU....A.H...u.U.B._..(..f./.x.x.2..o-..V{.gm.n2..`..F...oP"`h.^....6.]BF .\......!...T.7`.......9......h.9..3.(..|NN4..2...6Q...Vd..0.C...ay.....3.......h^..E.f4a*.y..A....\.4..."%.>?.?.[.F....U".../Y{...HW....$...&'.0...E.>q.@k?....|....8K..P.......D....u........P.L...w.q:.co....N.:.p*..O.*XO..m.UO..=.W..K.N. d..4.../..u.&.'..!...w..O...4IT....Y..U0#...Y....,{@..%S.f.......8^.Y. ...'.......).vl....dX....$ .%GF .L>..]...$,.X..Fi......Gn.o._q..*4.?P......&P..I.."...HQ.b_#5.?}O...Y..1i'...KK{..|)....Ej...[h..&W..|...,.."....oa..P~.om .....M}!..t..CS.0/..{....]3.....(.&M.c....U..}.B..OW..j..3.B...E8x.2@....*.)?l...AP#..Y.7.L.HF,....SQ..Q...T..A.z....L..0.=.......ySgT.7e....|wJc..P....*B..)....0....DEU.....j....'I.\.......RptN....H.....W.u.>"4....'...#5<....z.].Y..s.@1w6o.gu....hN.9...{..1..}...o.B.|.x....I......b.3.i.......T ..}c.P..\kju.".qLI.7+Q.Op(;....u..\.<...9.n..t.#m_.Xa&...R.d...?..f.!...]..\.!.[2+....\#

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8427
                            Entropy (8bit):7.980649427909667
                            Encrypted:false
                            SSDEEP:192:+jNg+mqxSoNVrYSw8d0zfFt3LFlQls1loUmPnm7UXPBRddRi3:+jG+mCzYSG7FJrQUeUmPnmqrY3
                            MD5:FCB5476D6E5628AFA78AA84CDD2F4FE2
                            SHA1:9551923F6C2F57C21F820AB661C176C4C6249109
                            SHA-256:C63EAA6193B3E85A3DC7BD27DA5530AA2B278D5ACF1B93AF838FF35C4822EC3E
                            SHA-512:D1593AB3C0871CCFED0AFD4D4B43A0C8E61CB2AC9FD63CD10B16D54FB2301D9BE324C3D31CE9A5D9ACFA0E0C57E3347A961875C3DA0BE8767841716DF89C06C8
                            Malicious:false
                            Preview:.MH.+..u...ryr.^.OD3.|.c...u.M.|O[-..[.B-.[......{*..M..T3U5J/.8.f.[.`V.iZ'Z.J.6..,..C6.....Fm.N >...y0.+....0"....a...T...= ....@=!.f)y.....".<.n..9V..3_....{i.]....F...Gp.K...w...P..g...#...o/9#.Mv.....C.0rYd=.<.....?0.&.k.N...z.Ly%{...':HI^..X.....l.h6......g.S.%.i.C/..Y..k' 8k..x...fz&..`.....eAA$.#./&.d.I.'...kz.O.Su-u5^.q..L&....'vm.d..PWp..q.e.Hmr..........`.2wN............d.1....N.K.=..k.&;%..w..m........[iZx..?\...tFB+......^...-..N.&>..-..M.......*...F......X..A...yt..g.....T..:.....D.g~c....H.X.w.X}..-t..j.G...R..:.).......V.....R.!..6p...%.K...q.....aV..0.......y1..Y...........>......-?..C.r..4;..o.. .....y ...%.....h.....k..=.Wl../rLC....eR.J......E.|.....:.[.....O$c.8.j7?i.........k5...p.......B_.2e$......."T.7.F..B.4....s...E.....{...0...$...H.G.......j.Z$q.......:.|.}K.9.."..%....C.,....0..x..a........\....V.f....;......ZM..n (l.!.U..`E.....-.c\...7<.0...r.+...l...u._^.-D..e....H....e.W2..B..;..w..c.L....A..kXW.....k_..]

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8435
                            Entropy (8bit):7.97547229714925
                            Encrypted:false
                            SSDEEP:192:vUpQBOvvxC6rrv0ESQGrbsuYXIL3YJKJe37/P00g9GwGUWhE:cLZC6rrnGrICLnJS7XK9G1I
                            MD5:52873B6B1B3D2FAE47CF414D8B305ECA
                            SHA1:C35915DA77E5FD82A0CCE295671C64F91F89481A
                            SHA-256:BD1950DD0A99C2DB59ABA655B87AD1173FA87978CCE02979F685F5AD8777C5AD
                            SHA-512:CC4FB77B2282C59F7E9AD8710D89832BF8C2B3BE42F38FE3865BE6CD4A496F51CDB1F3B409D244457F0BFFF09C58C942063BE7B17F9C11D5D1F3B77413C726FC
                            Malicious:false
                            Preview:.....<..?.n..B.V......~1.i..}.5Z(...R.H.........X@'M......n...|..2....^.a,kFSIR...M..xc.......&.....1...7..7.mEgu.B.9..#.>...X:..w._..s..+_I.U`.......W&...H.s..r....].z...-P...Q..2...<......(....#d.R?....!.k1.wnJbVZT....VD.24...?.`.B..U..!.~uM.P..q...K(-J@JY.R.{.o....\.8nGPE......*._...Z.?...'........}W5. ..Re....P..-..S.A....%q7.#T.%.u*w..bZ.+.J...^s].L..f......SG..b..../li....?......@a..0A...V...^.\.T.G.#.<.1...+3..6u..A=...........}..o|A..r.:P(...rU..G...u<X..!...D...h....8."{Y0....{........1..K6.g.......te...6.......'..s.0.....p.s..w..*.4..g..].3..L..5....I/..2.Y...-e..DNO?f......qm>..g.NY6..2.a..mun2{Ax2.B.){`U..2qJ.s.1..M._.......o....6..?xOp1..p........... ...m%...@=}A|.........v..y.r..r[......0...i.&...*.i...3..'..~w......n...}....Z.......a.=..g?2.c....;..|.q..D.54Yg..._...o*m....q+....{..._.B.......p.:.#........^....&b'|l.!}`....d,.R@....`((..@....GM.9..$n.o..M6o.".||...\p.v=..%IZ..)5I.."...c.X...SBu.\.Q.[.i.D.t.5Lx<.m...y.?[.

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.975880215326478
                            Encrypted:false
                            SSDEEP:192:lLOdrcwQjh0X3F7bk2qGXFT2faixxHb6a37:lLOKB69TMaoX37
                            MD5:0A78F2436C7250D962E2AC7A479FE571
                            SHA1:4D3479F21B4CA97BE8AAC4D620927EAE761EC655
                            SHA-256:C2C8120181C7B156448F7E235C5F1BFB00F7FBCF45F71EF3C5A804604C8FC3F2
                            SHA-512:5A59E94F8BA3AFD92CF46DC1F059D6F409E2F7C12F596FD834F0C347CB3F0268D2ED105BB173B14580535391A4E7E5CACBE08481E4B4466931C3A3C78228D5EF
                            Malicious:false
                            Preview:i..j?......K..u...i...}Qi........RN..-.l@.....7.6K...mAEK...'F....y?v.0.>..Hvi}$(............6...Q.W...d...r....B7.aJr..1...u.{.m.Efp'..-.e6k..{..]..]:....".Y.ez.H.1v-7.V.`........}........c.=6;..ut0.7....8.?....Zb.zu0....Y......S..9..0/".Iz....m..B....$.....;8.....h........j/.L..&....|.WmB...k.7<.....$..6..A@............@.n.._..-.El.I.</.9!,.....x..zj..b..[Z.i3...;CPE..WH.,![.}=..U....?N.m]....d#G.^m.e.-...*...xn5.P.2tD.?..<k&..+.<.{.,^...k....aQ.^..T.wmk.Sp...4.....>;*7...U.m.ojtM&...\.oN..R...U..T>.f<.:.9....`$.....>x&.L._.-....Rb........0W...V....8.v.7%j..u.`....LI......~k..S=...Ck{..-.{.}...}..l[.t.rdE..+....P*..1..kV.!:.Y.....,J0..!.%.$..{P.j....@p..s9Q.E...T. d..&..>.*m...S. gth.Z.........".}.{.3@..`.[....K..|+..;...qR6.~l.0..F...vt..J=.J....-.jE...F.F..>G'8...~..pb..b...V6.i.M+.dc..3....7}%.n.K....?.a.9..7T.y......]..j....b../...?.)Y...3..*_.-..U.m83..~.l..t".....%|j....L^dW.W(...zr.;;0............PeW}..J....>.OWa.\X...F.o

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.975436454848716
                            Encrypted:false
                            SSDEEP:96:42iM2U6p9iO6xHKzlvEEF0B8wv2UWono8XEVl6uA37LvQcawOs8TrZjzhTErQZGP:42eU6pn6xq9EAg8wvSG4kXCFVZGn1x
                            MD5:2A5FCF038EAC8DE746133C410BE5DE5B
                            SHA1:1FAFD42572C97C3FA0D97676B5DA9D0EA5FFBF97
                            SHA-256:2A9FC3BDBC17A5272A4BECB458984C27248058932016C15E8E66A39221FB7074
                            SHA-512:54C18252D315983D52E00D3186A9C1270A6BAD1E94F574AF831FE427C585859E91A17473A2A24A3E07695DBD75C8009D832815A0ADEFE5E42E9E302B8F63FEE4
                            Malicious:false
                            Preview:F8j..y5.e4.,t. ...lo.........f.....B.....-h..6...s..].&}./.x.&JF_.1....@..z1q.ISX...y...A....L......8].FQ..)2... .2$...G......a.?o......4..=...;....1..........r2..u.. .Rt...=.vf8..}......&...t.<KEaK.....r......Z(1H.5..2...R.N..(.....5...g....e.'P;..&.g8..>.K#..).z+.v.#.,...P..3...xn.!sZ|.k}...T....K.W.klX...Q...j....%.)..B.~..z=`..b.aj.Iq.M..4....x...?.sL..z.h"..b.2...~5.;.T......+.i......y.7.l!.).)..8.s.N......7....}..D.X....s......G..B[...F...3........-.z....X.^....]......}......k....s..1..9....`....s:8u.........r...{.P-[R......_O.P.....%o.=]q8...&.Qo.........j.q.C4.7.........Vxk.."O.........Q\.CKx3.H~..5.%y.].w.\.~...."...<..!C...P.w..$....]....ug%...\...Xc..g..\}..}...^..<;^y.o..e.K.p{.g.(`WU..q$..P..U+.Y..3...}O...'.M*".....eg.-f..Z@..)....J..W.[..KI............bf.x..fD.J&.+....t..\&.).i..$.27]%........:4...j.:1..R|4'..^...P......9C.....Q.~4.Xb..w....$@...o.D..Vy....*..Q2..Q.....m.g...>$..f3...I.X.#..=}.H....I..22_..SJSH..[.. 4.%[.k

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.977944901543313
                            Encrypted:false
                            SSDEEP:192:NWYVX9TIb5NkDGIrCGtbIsH39Qoi16QXRlHfOp4TENpU:UYdR45NwSoIMtQokRVOML
                            MD5:9DD62584B05D60202480CE3790B2CDED
                            SHA1:CC8B9C91EE5FC2049A6ED55CC497FAA7229F7892
                            SHA-256:07AB7351B76DFAE543242D0D9E67FF0CD0C5BFF0DAE65426E9ED0D64AA8F472F
                            SHA-512:E96447E8E3C7232070B0944679E53030B8DB30043C3860F0035FCE77D5D8FD1A142E6660B82C6650320DE8697D4162758E0092712ED69AA3D3E04644B571D7D3
                            Malicious:false
                            Preview: iD...}...#..iq.]...l 6$:..^7.....l.P.gs.a.{...H.[.a..9.SW.K|.."...VjI"..y^x.Y....1|e.X.7..y}.o...\...9%.....c.......q%.....$J.A...^.{..J3..\....m._p...f-.0...b2....4.&......WIC..p.....a...p...~.....4..&|.......ED...0.5,...._;...O.g%...F....i:.99y...HA....e_...9W.@....q. .ASmNL.<...PiS.[q........,........\U..z..DF.`.(.N..>.4$..U..{......Dgd.......)h.N}?7.hK...U..."..[.Vh..?.bY....7.l...KOw....+.o...M.UA.&..h-....#xA.@.........I...L....g.".f...b.6|6..s.u|."....\Z..|.`DC.b.....p.U.."....j.w'P.e..t......Q...p..n...X.w....z........P^K..XD..0.......f.....~..............9.X..._.I...R;..Gfb*<.....y.r..*N....[?o1../..e......m|.... .....X.....6.]z.Q.8...w....f.(9.........;........E....)..V.z....R.......-A.mL.e.l.....jd%.......RF..;Z.".K.^.G)..\E....K..7....M}G.I.I.e.....1.\G(.iM.Q......t..../..]U.mR.pAh.34..L.X..}.Oj..zv...I...j.VyI....[........3.<[tS.}........|.......;.^..Q.....g...........b.,.}^~l..ud.&.R.].zq5..M...l...4-...&BS....B.YEM.........

                            C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.MixedReality.Portal_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.1.7_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.1.7_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.1.7_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.2.2_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.2.2_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Framework.2.2_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.1.7_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.1.7_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.1.7_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.2.2_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.2.2_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.NET.Native.Runtime.2.2_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:COM executable for DOS
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.976999324573294
                            Encrypted:false
                            SSDEEP:192:ieZWcqKPO5kDjIsvMTh1MiNJtzVhcK98W73M:N+VkDWQiVLR73M
                            MD5:76AB7259532918B8D4A92C7788AE6C85
                            SHA1:A5D963EAFDC559DA13A312F37B4441D1CE5A2BDA
                            SHA-256:5827465ED12BB7B07876D7C0DF2FCE9D80090C0FF0C1FE5566889A87DFE9A580
                            SHA-512:DD8F8C2CA6348C873756E02D75D147670349CFC6A8E3078AA13A1AE841108DD3C71AFFCF1CA6B5453F665CF95F822FD3B9841A36B84123FBEF795B1536FF8706
                            Malicious:false
                            Preview:.lg,.0.C.jq........Qn.T.K.)....e).{.I...*.....n..Q.}...p...Y+......*q.0.....~..n93..%0?y.K. .....y.ht.}.w..o=.*....9V..?..@......w..p!w.,!..<.=.L.vC........E."y.....>l......'VX...../XT..r1A...r.....U^..V..z.O.....A}....$B..V.[..3.=Yo.,.q.f...34>9.{....<....&.K......g. ...:'....7...z.a...y.".4."..b..q.b/.n4.....:..0~..v.G...JOZ......P.z..F.E..Z...o.......B........N.n..&&t't.$.O..MI. .gp`Q......3Ru....x..SNw..opZ.].4O..rEA..{F@W..7..J...i.x^.)...C.o....7.b.;....}{.....u.dI.3.)`...6x..Os....u..`eS..h...5A../.h.../P.Z..&.nx.:c.n.B_..[.%.U1.).Nx.<.Tf..@.hQ..Qx.+Ff./.RS.Kt]..%...z.j..k......V...W.B..:.)..GD.h...-+E.i.....#...np...P....;........ .........Y.!1.............D1..=....y........`$q8..[.+.@A.B.~LvvV.9^..fxb..Q..2....*....[..g.4Y;.(..&Oo"..e.s.....oI{.!nT..s..0j.Nau..Y....Q.4..A...F>..:.U.;X.e/.R9#.......6..&L.]L.7..E...o.....P.Q>.....&k.... x......X..X..........;<*......2a.......U.....L.4...kEJ...eR...=M..O......<;..&....#??2N..-

                            C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Office.OneNote_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.980316310367378
                            Encrypted:false
                            SSDEEP:192:w1yY9c5XXCJkGIBpk1mw/TTtBrY2kBcnXPUs2Yu1vylq9cQLyT9ummX:4AXokGIIzyB5Xd1RuUUoX
                            MD5:A885ACE92948ECEDEE53190101110907
                            SHA1:8D444A94E4437648FCE994FCF2918AAE373AE4F3
                            SHA-256:E8B3AD1DB6D008817E69FC54CA4376F9D9092C7C13F241A7E5815BDA9A94404A
                            SHA-512:E52BB87EF86C0812722B5F5BF18D213E8A4B3CAE124E5A8EED1B4EF0CF74CB7FA9DEAF5F2BAF818B3BC37A3BA207E2AF0963400EA8CED2B169C6EB5F2CB645DE
                            Malicious:false
                            Preview:kkg..c.g.0...._t.C.J8.6..%.?...#.D.'..W.7.c@....b6z'.S...W.E.g.D.-# ..U.2.|4B~..0.t4...&.%S.C...^....hg...o..swE..]........A....U.Ms-...B..(.`...BRn..>T#..z..R.J.....R.;hr./.]....B.R2.../.Y~......D$...g...O...p..C..b.H/K.#..{.f.P.......6.-.4...v.V...:.<...........D..ql...$.bWP.M<,..N...55S2...l6V).....w.x.Z.4?h.z#%...6.=].><...H....K*...B.i....).t.f.>.l:.2.....HZ.It.....mWt../.|.*q...8..6n...O.V....m.v#...@...,z....gk.."mj..mn71.o...,.K.....3e}'E...PX.......1_...i..<=.^N..[C.....>i...0.b.DM+Q...o..)(*.....Y.QC...........Z.^(...1..q..>M<.k....u..~.+..;.....'....".....K.y! ....V/..0@.......&_m...............[s....y.c>Q.."...xI..=q......t.dAx..l.s.1....H.. .(......c.g/.R+,......;J..P...r...v]..W.#.E...N.[...e.^..z..VC.=-+F..EH.......88.;....^^q../-Y..J.7.^Ea.!I>'.Djfb..lz.>....U....m._..%...@.]...#..*w5...z.f.%..h.F!C.2u{PF.P.3..HZs.....j........z...D1...6.{../.LUR.L&.......Q.\...-eE..FG..8....M.....<:.`.p..6V.....0.1...-..$7k.

                            C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.People_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.97660617912311
                            Encrypted:false
                            SSDEEP:192:2ExJTQbDuv0Iz7hGQaf9iz+GNTJ9aMYrN/idrjFYYNJ:2EH0bDxIJGQak+eJ4Zad99L
                            MD5:ABB37A8FD39D16BAEECD659513D43099
                            SHA1:DC1D4F94DAA657E225DE1EEEED10D1B9C9658285
                            SHA-256:369460C03960128820BFA2AFF32C6A59760851B11B9CBB05963852FE333D3209
                            SHA-512:547366CF563551DF7EA7DF4716612338081E682EAF255EBA4A70B6F45D6A0B55C06B46A25A86ACEBB4F63483C77730C5F0FC390BB7835EB58DD00F8DD5B0ACF9
                            Malicious:false
                            Preview:...V....M%..5...}L.1.%..7.Z....&~..ol.$.0..d3..a..+P..X.....e.V...).yb....B.....U.....y.L...o..04...8.`L...Ps..../.f.X.z......n..W.....f.]n..h..i&.[]....|Y...7.{.6.*.>k..D.M..(D......S..>.W..&.6.[E..,..|.Sj...~.=BI=...........{Q.|.-..-*...W.pY{........!u+>!...I.j...a.x..kR#....5.U.....+z..j)]N/..je>d.....~|......}1.=.fK..(.m7._q..s.L..w.DN..F......`.m...B i....R...FMCvw[...OI..nv......d.G(..j.../...[.2....e%2U...=.......|.~I....m....\......@.o.t.b..Z2P.f.u......Qu^...H....B....I...?..-.n..3....U3.CE....]z#:..n'p.....v....+.l[.L.^.Ei.Zv.ihc..9....g.^'%b .~..)D:F.%...N.......>.J.[i.1.."...l:.[..y.e*_.)...v.D....../Z{.!......A...O. ....].`.u..w..U."v|....)PiXpn.e..}K'.,...,U...l..K`?..=.R.0.....P.~...W..u{.f..g........t.....M.7.......\t.f..B...I.....w..m2...Ph..s..vc.o.(.. .J..e......uy.#2..G.....)S....$w.D.y.7.#{.f.. Y4... ..?......a.Q.N..k.MkS}..|kj..f.R..v.h.]C.[.:<..?..7.+t......4...z!...+.~...N.1..G...........,.C....E....Ru.ZRMQ.^. M

                            C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Services.Store.Engagement_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.978314201617273
                            Encrypted:false
                            SSDEEP:192:mNrLK2oj6UPkVOoPQmFYVOePS5v9XcbwhgKUm:mNr3SPkKmFYQVLXBhgKn
                            MD5:14DBEE217E3F22DFE00F2060014ED471
                            SHA1:3C34F85DB40C637ED16F8D38187E10FB8A1FA614
                            SHA-256:EDD93606646992667267232DCB845F7F422E8E71C4730AB5ACBB5FA339AACED7
                            SHA-512:17D9E010E0D61718CA2CF47BDFA09A168E7835F89406FEBDEF0480B41BEFB7604DE0FA933B7C566025EC168BD74B9041BAF391226C6AB4A2616BC3BCF3CA3521
                            Malicious:false
                            Preview:...Q..2...i.Z(..%.^....p...]..r..........Jq.B.G..n,.q...n.B.q.=n...*.gf.$`.`.f.=..5.......N..u.h...N.d..o.@...zo..&v.#e]1.t.v...A./.!.....;.1\c.$:.*......L.{.;.....J.Is...<..u....g5.Z..../..\..%....N......)..Py?.=.D.ci<..IvM...Y.h...xAY.^.....T.1rG.9.-zXR...K.Z.2...<RGC#..}&9.m..b.-.m..I\9M....[.`.l.Ja(...?U.........]ZV...BR.5....T......u..,.r.Z.x....=.b.lT..]O$..U.C..t..,EM.2g...M..T..x...8UO.Z...{1|..=.J.MQn...K...nJ...C...T..&...K=..k%.),6 ..p.V.X......w.V[.R:..N..k..D"....~.]6e........lO.h.n........&o#............,Mx.. .%S..C.>.B@..mg.....&.z.....=P..e..[?X..?...d...2~Z^.m.p.F.Hrs9N...'..,*.)..L...I<.._y..a.$.*5.zK]_.2......3T+m.........Pq.L........l...Y.rV..m.1.F{..#_.O..[._..R..4.4S.0X..c^....Z..k.....Y.PDQ.m<j..7th9.+..}<..HG.Tt)d.F.....2R.M....t.^FBDr..!.q....E.Ih..z.A.......C.i/.d!..".^z.r.R..~..Mo..w.....F<b{...{...J......mm...I..*<:...;u..7..l.80m.[..w.{<.2..x....W.y.v.{;>.~.{ebi.c(...0.#.z.Aay.S..r|..7.xDE....g{ZJaYC

                            C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.StorePurchaseApp_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.UI.Xaml.2.0_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.UI.Xaml.2.0_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.UI.Xaml.2.0_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.VCLibs.140.00.UWPDesktop_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.VCLibs.140.00_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.VP9VideoExtensions_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.980059205779792
                            Encrypted:false
                            SSDEEP:192:ApnE2pV2akfxBhXYiplgCgfkBxTpl/JrZ11wdihNRKON16l+:89pVefDFYipHg01T11wdirRrDc+
                            MD5:F2754B76B5A3F1C62AD743DA95594AFE
                            SHA1:3296023799EB5516752460920B852CF3AEE039A7
                            SHA-256:745BA390B1A5B0BFFE02E4C41438690B24558C3543F27179BDF599AC0E670E1F
                            SHA-512:EB79E6381BC5E13C575F5912518A0184B1247C07DE06EFC542F890733F7380691A4960DF67D4EAB18B20F91C2025132E99B138AE2BD9FD0D5A45333AFC91396F
                            Malicious:false
                            Preview:...i;y..C9~s....P..oP`...6...k..R)..-|.d.U.a.X..z..x..Z$...|...5......I..v;.....ux.c....]..S.F.....B.....:.W.lX.x..y.Jp$Uu.f~A@..;j.....(..HM.i..zz..xS0....u..Ce.B...&.......`. .;..D.3O..u.D%.9Z...M....>v.}.,9..?......B..y8d.r .>.....^...Tp...?..:..4..<..D"{l.>..3nbic!os..N..........a.^..n .....6....~...MB.(.4...G...,d6J..fZ0P9..j..O8.c.....<.a.e)..j`.......E.V.?BE..mz.\.d.,0..r.......U......C..g.@.o.A6......I..z..Y%...!....;.:V,.c^..1.P.w..1.z.n....].NlM....^{...-l..3.....R_...W1...4{'...:....nI......"..i..'h.-...x..%...-.".....0.`.y....1.t..:.v....6e.d.m.Hy..].t+^.S....Z J.w..d.bb...~{.....M.1.*1dZ.C..H.}5n&p.N..Opv.u..L.....KF86LP.....^...p....oF..^,S.....V..".....C......Pi......L......h......c.d.....&..sP....>.f...W....3.w.6I.....Sd.....].3I(.8..g. S..Y~q..."f.q2|.e.....';..{g.2..dz._..|....{....'....s.....q./.q}...B.~o..+y..=Vn.G...._q,...tep.F.D..\t.7qj..o.)..L.g.:(S.8..x.........]7.r.D.Xd.5...Iq[*...3......j.)..{....zj..

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.978126184950161
                            Encrypted:false
                            SSDEEP:192:evuY5sq01I000Il2f8539teyH6qVz0Qy7hudG/Ufo0gC1NKPf:ev321IJsEVnZaaoQL+UQa1NKn
                            MD5:C6B7BDEA213EF92A881C308F5A2332A2
                            SHA1:1BB081A6944433E96EC8DC765C56BB6ECA9CD471
                            SHA-256:10A0D7F8D843B62985322D4A8A26806065BC3190E697444FAED4B07B022FD788
                            SHA-512:DCD373328A2DEAD0281F4AD65BB8CF6C3967998D5D5B44392376FBBD8E498B66E1DCF7FB3C9F51D55966BDC0D10F04C186F81FC7AA327603C85336BA5577A180
                            Malicious:false
                            Preview:..b.BF..m..\F.x./.W....S...i.T_...@.........8:J2T...E.?..3{......[...Y}.{.b.U...2mm..=8W.|...K..=*....I.>...U>{.p.Y....q.C....Aj..L.O6.Y.b..l.h.....L.n.?.?..]......O}...`..N.-.V..\.[.u.R....v.....?.....!........j.l.4.........l........R..J.".......8....5..#..=.Z..].......v.....<..'....%..;Gk..%"..o..o.bp[...<.k;.1-........O..m.P..|...;{s^..+;..Cw..{..Y.{T.`f+.V&,.-.(..._..)L.../....3.+..Q{..2x........!2.E...h.\..M8...>.o_.Q...7c........}...@*e.g.jp.{9b3.P.i.mK\...f.\(K..m-,..%...-...&.;V..;..>2q.>.,....0.M.......L.:.|..D.<..l..S...m<.v'....`p.'.j...!.O}...w...q....Y`.@.>..(k7+..D,1e.^5.'....S]..D..L..Bi...R..t.c#=...\.)C..X.?.p..2.(h....)..g.....p.v..R....+...C..S.t..,......Z4....J.@.Gz...{.A.w.,:J....~n..<wPv|....6.5s0..6...~..)d.K.%uT#...V{..M..w..G5|..D31....[J....H..$.8..2m^.......@`...v..4u...10..#...KX...dN-_..$.*.o.at.F..a.......!..Ov.Z#.6.?....:<...... ..+....m.U....x.R...v...u......fD...;.n...S(....g..D.wQe..l.......z..D...d.......

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ParentalControls_cw5n1h2txyewy\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.980579998603765
                            Encrypted:false
                            SSDEEP:192:vLayfqoaHQxfWmqMxbvT0C8UnB2nG58Os61LtRnMu:vkolqMxbvTnc7OBLDnMu
                            MD5:202C7B978B538EFA09C64E233ED40F58
                            SHA1:2B4128B175F55C362F6CB69AF03EEC3D4FFA45CF
                            SHA-256:F5EBC2C6EDB41D14F08F6965853652E7C60FAA85564919D8160B17BD43829809
                            SHA-512:EA9D2DD123E00DAF5D4D14DC3E836A742E13AA2EA2FDB367D6CD9F5E5AE5F5BF14E2B92426407CF235A54779A381237D3AB0236753FE5A542FD683EE1BD1B532
                            Malicious:false
                            Preview:K.........l....)..S.....E.n.4.x4.?2#...X...y.......\......g\]...k&O..E....m...K%.}[.3.lo!,@6.w^....=o7..0.Q.}..4.....p ..5.g8!.!..!S..__.|.9.....h..........+...RH.p%>...E....?.....fLx.#....t.b.b.m..>9g .iZ...s..J../.....t.B..K.2..U..5.z.Z8.@...(.2.i.C='N.....S?$6.s..%.JE.`...#......6Q.w..F:.uD,4....({V......8*.%..~.]..*k~~..~..gc._.y..].+.>...K.r...=.x...$5...:u.H..`Q....H%...j...B..9.4N.......}... .\.Kj.....Z.L'.].=l...].6..s.[).....T..........~.,c..o..y|.V..:.o..I..y.3{>:I.j...\r.z....Y.....e{%.......z.....x)m......%..+....3.c.[Muk./...b...KvK....U...p....c...;..o.b.'......N.T..2U.?.;.p.7...P..E..";P..o..s..~.v.x.fF..+...8R.HU..C..=~=..+..XB.~..~;..z.._..Y..&b...!F..?..d..[.ym....8..?.:"Jb(.Fp.wQ..=....an7j....P..<z....f..J..5... d.-X...,.Q..gE...|..`]c...ygx..(..l.m.9..8'L...L.D."H...x9!.m..... .2.L.R. ....A....>*.H.t...1..6|u....]a[.....&Z.O>...x..g.B...M.....xb.=.."..s$V...]XoSKi...)Mo>.UbX<...q...2.x1.U<S..QmW.[.R..f

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-shm.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):33023
                            Entropy (8bit):7.994574518214327
                            Encrypted:true
                            SSDEEP:768:DJ7Oy4qOA7eZmdPP4MX19uOsStHi2m0B3SteKwzWJ:DJq7qzhNFdRHmCCrwzS
                            MD5:DA9FED24A7B95747FB464F18C938F9D6
                            SHA1:77AB7726CC4F323DDCD52754BF5533D3A8099F11
                            SHA-256:95008CBC7F5762A8D3B3D741DE484F6C214D19082F2C717553BFBA8AD986C0AE
                            SHA-512:53709D99831DFA7925E614D182BAD27D783A04D6757B68DCCB6D9D0DFAD6B5B388AFC78EC55C6E54B7E16B90FB45F72F1F852EB3A9DFB7ACCA7E0EF2B1ED60FC
                            Malicious:true
                            Preview:A....c.lB#.#v.a...C..v%....=..hz_..9....UZN..I....".r..}.T.m.....+...)....+Gd.[.#.f.?U..n..(....B'...(....s\...\.@.........cB%..4.B=v".~./.T......S....S...CpD.b.........3...h.50.qgu.p ..g$....z....v...C.H..V..v;.4.0..Y&4X....xh..(.......f...9c..c.[.....H...hh>.5[.GYj{..;..j..BS....#...<a.`.$y%..-.o..V..R[..!.....^..").f@..XPN..C..}.6.....-.Dm.......O\....hI..{..A.u:.<...K.....w.fL`T.O..^[C...A.j.....G....9o.\.1..3.y..C..|Gj..".\. ...QL.p...<.IjM!.a.:..3..V.Z..q.]..3+..$...+.M..7.>ZLP.p.F$f...({.ms).3.[.M.......2.-.[I..$.8.lr..m..K.[....R..a.....#.....!...[.+....Y.....j.{N.,20..!.[.C..)+6...K._:...+.k.C.>..g;.;=6.>..F....Z..#<..jy5.....TR..oWJ=70.eeL...t.Xz.{..v.TgIy....%A..."..7.%....M.i....j@.}l`..j..YG.#....~..e..R.a.U..Vp.....@t_.....'}.z...\.F...k..5A.-.4...et<y........ ..`S....."...C.s...\..e........%O..6h..F8..~ ......F...T..!..^2."/..c3\.]k....SiM..._BFQ..@.#B......8b.(..a_.Pg.....:..0Ye."...:(.}.1h......\c.Kn......r...>(...='...`.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite-wal.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1384606
                            Entropy (8bit):4.284914477050806
                            Encrypted:false
                            SSDEEP:12288:rDRvsW6kffcDPaO1HdBDekcf/4p8HKm16o7SHBz8:PRvsYff309Nrcf/vh16oAy
                            MD5:0A1F980BEF06CB2A862CF04E9A22EB3E
                            SHA1:63625FC78B406ABD547145A0B434CCD384FF566A
                            SHA-256:3D4BB578D361879DB23B83DAA144D5D8D25E15BF58EA55C7989638C4BE1FD7D1
                            SHA-512:D2317CB3632383CA3F74B9320540F84E8D2234C4CFDC3A4D3B8A4337884A9C2460C12EE96BFB4EC880D2495AD2407366ACFD95396999C45AB81FEB61AB3DE5AB
                            Malicious:false
                            Preview:.o...h....JY8.9......,....>]Bm!...'..$.t.u)gg.f,.H...&...\2.j..Ta...r......4.>...@....t...D..m....F.0,7..y.l..L.J'.]lP..^...4FK.XMC.&U.[L.E.q.:...2=R.s.}...;..K.. .Eo.P;H6..,o...is..b.....^.e.;......sJ.....v.I&.N:~.......Z.[O..?...*4.D..)<....K..X.!.....`.4...e..#..d..'....0.7y.xs-g..HH..`.aJ.`^..P...yiz.....y.<S.Bx.oP#. <C.Mb.j.....<.._.~.O....v.<^z.....[..J)h.O:..5..!.."J..y..|L.QO.g....V.SV........$.),.v..........b.@.T.T..).l....yi..gj.F:ucUI.:...A....u...z...4......q..~.m.{.........0...>...X.w./p.D6........t.M....E.gWMox..%.po!jJh's.f.,...r%x...$E.T.q.l.m..s....q..~.....(uNVA.).;LZ8...|[(`!N........".[.<...c..L..-.....N..I....UTX....h....j5.%7..2.q<.@.E..V.YDk.....D.B.....0...0X.,..8Z5......ce...w?.. ...kd.B.)...Re.M..v..xT.3.<..r*9..6..=.P.ZS.o..Fs.9D.z.....\.....dv.G....E_.Q.....t_&..e.\o,IFr.y. ..w][...i...F.V......X.....L].=...>..z.V..H...!(}..]..P..K^G....<h..u%....h.A..2.G.R.HH..oR....{#.K...... .L.4.....p.....Q.._....TKO=WD...2.B{T

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\MediaDb.v1.sqlite.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):4345
                            Entropy (8bit):7.9566622382203365
                            Encrypted:false
                            SSDEEP:96:pkO/zYl88382NXq5YjephR4VQtRH+6tT9h6DvACmgEwKdwZeIm:68cl8c82NaLRZTNtj6fmgEwAGm
                            MD5:36BF4A77B5CF45212353C9E827B4960B
                            SHA1:5CD2977FDD483BEDF0F599BE06E939A34253E8D0
                            SHA-256:E2A4786691BB785D593F43C09E26D9053B86B547ACD35A8A3B0328987FCBAB01
                            SHA-512:9952EF2A2136EB8E5D1A5D0FEB250A1E798A07065CF85823059E8E8037146887FF1C0D06E1F60B9EBD4F3FC2812EAC589B52F18FEDB274A277BE291903C220F4
                            Malicious:false
                            Preview:.Ef&...J..YM.GS`$i.i.D<.QW.o..\.bm9....W. w'7y.n...d./F.U....~._{cs........Iy....fMy....;.+@...b..S..........o.y.0i..1S../.......v.`...@..{g.go.a..v.+....4...}...t9J.a.....i.....#.`.)..~.e8.j.2l.mR....u...6.......!...a..:O..~..uXw.....G.O.h.....j.(.>d..8.xL.....~..r.0.:....-..58.`B..]Qg..S.F..q.k.s.r._..........0c...(.sH)vA9.\.*.Q:..=...Fqr.$.]Ok.)..L.y%wf(+.0#G.".7...^.n.L.4..d....... .V..=u5]m.G! .....\.-5[W#...Qk...t...|..d.W...Rd=Af]....1..|+\.......V.B..z.Oh.=.\]5....eK.hEd./A..j..#|AY+....\~....0...)...Z......)eq.....Bo....TUL.9;.0C..>.-..pf...w.c..9...].J1)..Ia..y.2........*..7......I^.y`j.(f7.E..1oS.:.`....z.97..8+3.....{.hJf....{a.B.a5......e.P..._..4.....Q..Ct....T:..../'...A.8@.q..V.'...|_w..w....d...@].$....(./...z~.Ox..k.".:I|.+.2.....<>.C.o...!...,.,5.....H.F!sf$.FE....(7...~%...=3h..^+4.$..k..K.}{.t..x...i. ..:.M...W..?w..[ .l.......&.......j<..... . .y.aWG.o.(....)_O.H].4d.......g{.@,....j..d.>.........NA...........

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppTracing_startedInBGMode.etl.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):65813
                            Entropy (8bit):7.997139424663794
                            Encrypted:true
                            SSDEEP:768:1TgMqzUIOCsSn4kImyMH6rTgR2GfMY64/FmApfBwWRAnTFhlph5MaEQL1YufgIfz:FbgMG0MHfR2g64YmhAnTFrREQFgGj/
                            MD5:115B7B510E732FE9EA4B94CBDA5ADEC8
                            SHA1:66BA473D5B84D8736DE3182FE67A6C52640D4C33
                            SHA-256:12DF0DFBB24F1D7779FFECEB3F63DDE5AD00DB15D8B1182971501A6524E9797D
                            SHA-512:934218A3EB70058336C41E5332E53113EAE385FAE436559D05BD9DC62FCE262E5A87A1F0E6153466A13E71790D8DDD406FCDA18B25B26ECFB66A63A35B2251E1
                            Malicious:true
                            Preview:.......bd:M~.><P...!5x.....O.AE..x..D.R..L.V|.L.`.(...~..I.....Y..k...o..8k.U..&...t9.Q........[<..n........3.F.R._...}G......!.m..J..w..&ls..#..:.E..=51;...u...2fe...he .D..r..".j].R..w.t.+++..R....\...~.O.9I6...%l...f;bf..,............?*C?.\...dW-.wWZ-.....Z......9K(.d:..c9U......?..C`..(....;.e..q...h.Ie...t.G?..q..(1E.+..(f.S.`_.....h2].Y..N_..*.A...7.z..e...f..t.U...n..P....SQ1%.f..=.I.r.A.'.Q~.z`..1...p........:.2f...eG..M....7.....&.....y..O~.$.;..!..y..CO...F...f.."..:.p[Q.\...c*.. .i..}.*....u.%a H7y.?...yA....W..Y.n.@.m.D&.q........,\.......D....u.`?4*..,. .$...1.x.d..lf\{....'.n.6 .%.F.@....3....(q....J.2.kX......6..Q).."....$.z....,z....k..|..&.....e#x.......n.Vt_......../s..R..]..ze..m...Z1u.Z..%.K4.{8XP.\......."..=l,..d....z.\.>.[P.2.$2.BQ..S...lN^|[c..."'P22q.>......m_u.>+|9..........rS6.....\!T.P.9...yn.d.!.:..O....g...)$......*.D.0.W..[B..Jv...v.....U?.&R.b..K.Mz...n..d....|....&.S.Qr-J...3...2y ..cz.2..}....3.,.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.9775180422548
                            Encrypted:false
                            SSDEEP:192:yA4szVlerp/eip2DBGc8183/4BZpl5OUn0slSysAIuIfpNx:vdeln4BGD183gbMS/Syyn
                            MD5:040F3455AF1FD91CC7ED13EAF5C2EEEA
                            SHA1:296825FF8104792F608F6F31E7056A3B0B02B13D
                            SHA-256:CB9083094C78E7D694272ADEDE67714E711982D02C2F81F585608191F99FAE00
                            SHA-512:81167A34D68EE7428014EADD1BBD87507904511775D78BA1BB6815DB83804FCF49FCF9F0F548CDF0D7E298831A950C2AADCE4472381A2FDDC110BAACECA04943
                            Malicious:false
                            Preview:...]..*.~tJ...EOL..~.$..|.+~+..x5.....U_r..%...<3...Tl.........e...4"..l.P......n.........@..T +5@Q.{"l..........oo..[.^..|.R......Y..U/4ig.[...q.=.?B.Z%_....c.po'...&....z\.Q@.k<1}.l.D...S.R~2H.....5...k...~...9#wu..z0r...~..i?.N.B0....~......e.-..u...m.Bk....@^}.....S.`.S.vT=.....!.....f......:.q......=.....d_..Y|.}..e........6......@......8.1......@....#_6......!WfvI...k..g0.t....'.T...!D4.....y ..C....^.&#...uS...e.[.|wr.z*on.V...........)..V......'3.-.K .6,.K.g`...d..X..u.*\.../.u...E......Tr.c.#j.Q4n...)........~.n..*Y......O..P....e..D._9..#....Z..y.'D.:....)uO<..X...`..*rU.j.7.........R...(...'.pmD..@.C....[CTa66,.....a.d....G.fn.3'....Ck{Q..z.FW.....%..U.2...{.........PR>...g.}....i<...a.b5Z,.x`........F.a~..j...T.u..R.?..D$y.......5#....hr..9..x.F../..6..=."..,.....o*[..3.l..0.n.E......A?.+o...4....vV$....|...<q..$Rh`.D.S+~u......u..i-....LU@..e.o.u.......y....0.U..lR.X.qQ.._[.$....lTW%3.x!....o.v.|.k....P_....L

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.9809090350239265
                            Encrypted:false
                            SSDEEP:192:GuuvYrhJViJt4dtpgTen4EjR3tns+h0H9APS:GuuvYrhmJt4dYT64KR9n1h0H9APS
                            MD5:C17BEA77BFE195C371E4DED04BF89C40
                            SHA1:48FB7AA4E066288847FC54A8A9F7D921B5FC657B
                            SHA-256:2FD5A6EF7ACBBCCB1A32CCB9EBBF76094E94553CCA739C976B6BCD4FEB5109F0
                            SHA-512:90BD215CBEBE5713F40CAB7B3B95B7F0067D4C31E535A71DCF73890A8F1F82F4284FC91BE1906F7881B39ED31A31F01C431F832D7E38C459CB67CA19054C80F0
                            Malicious:false
                            Preview:0[.Te.s.'t.LMI.~+...I.y.."....s....".,, .)...~.@.@.....mS.).....T.N.;K..#..p.*...S...S...4EH...6I.$9.s.l.#.v..=.,/.>-...\..{.....o.-.../....d+....}...ac.F5....q.\.ec....C:...,o..R...t.ap(.....'..Ap.IU...Q^.iq>..^$D....*.L/rH.N.....%.nJ...O.b:i...'.#..6..>..X.>..SS~..7e.....:P.4....|Eb.Z.Y...B|.....H..Z.9...J..o..q...O..`q....9.....!&.X.)j..Q.z..g.....h..+.d...mi.#.7..S.P.j....E.!Z....<......V.}.........a....+..00.;.Z.....=....Y2.=..\..n}C...V/D4."v=...<......G......xjF.....>..@k.......,.m\M.~...XT#.~]`/.:-]...>..b.{...C.k=..v.)K..C...J>......W-..[!.+.2 ..f.7..%...Gv..O.eW!..g.[.~...O.L,...x.B...1..&..."+...v.,.....1I3f.7..W.4...3+.U.~z....3.......o$.....v_.3.Uf7\~NH.0.I~CN.....`@..7.jM...3.At..9..K...,....r@.,....8..h......:%..4..,K.....E.W...........%JN...p..W6*v.gf......K..O.rk...)...c..;..`....yA.C.'8...8...b..#.I6A5m.....z..c*.'F.v..w.#.8....... ...B....t....#.y....JX[.G.VW..e..V/(.P..1...Du....g.r9...>4......8...mEvSH.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.PinningConfirmationDialog_cw5n1h2txyewy\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1573111
                            Entropy (8bit):3.599907642552559
                            Encrypted:false
                            SSDEEP:12288:MkIu4uO87tk+RyzyPYwK1Ep8K5G3PQ+jZhGk7O2Rt7pMS:Mk14utVgyPtpp95G34wv1z
                            MD5:60456FA95BEF6BD77D2FBC2926CF84C9
                            SHA1:4FAE5ECAC03B97C09ADEAF6B72B1DBBF64F9B3A3
                            SHA-256:06C3F518AAF47323DFAD73EE78DBA809657B2BC711517B10ED78A0E1561F1D13
                            SHA-512:36FAE17FC3811B5B5A3CFF14690D7C376AA0F9E2DCC2347F33C36946CCFA25A38FB018947609A254B86EEB1FEFAD401A0295FC00BB179E24CF21CC40297AF3AA
                            Malicious:false
                            Preview:..4.......Ye.$...B.....B3v ]R.....S. ..#../pu.u.^..6.W2.*....>....I-..i../.ijK.i.....'=7.*S..m!..1.......#l...pZ...yd..(.L.".ob..jO..-..'..Bz...^...?u. ..}.a>3G=..d>,....JQ*1.}'....3..m...XN...AX.B..-.A'.OWp.b~5.=..<.*... .Zf..e._A.........l\.......xO.~..O.A...4.....|}.M.S.R_a.N...Gh...>2.`\n..c.{F..#.k..-....w.c.......o./....hT.......T..+...`o.M...ie...."....;....Y.B.k..Y......4..Cg....~#.{..W......p.+.$.....[tV..>/-../"h....y.t...r.za?R..(e\..)T..........<..@.U..vB.......}.a...`.\.4..D.._7.7y...z#)....K.=....^N......6.8.....3....P~lr..n.@c.s..yY.%..*_.....^hy-...u..._.0...~......,K.!.S@..2..To./T..p.|...f.eO..p./.I.D../Sj.......o..0.}w..bq..:.zP...!.!...;......)......t..#...u[...T54w. 3#KHg,@.I.....t..s/.....F.t...i.W.N..z{..Fak#.......4.........A......)..@@`].p....V]b..0..y.:-R{2$.1%_.p.{........K...i,...]6ZI`T...\.cu.*ok.4.A....o^...B.?...|.D.gr{.D...qy.8...D..P.wv...h.ZW.b.....D.9......G..'..p@.0...l....e\..._.&....*..........^Z...

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):16632
                            Entropy (8bit):7.988334484184506
                            Encrypted:false
                            SSDEEP:384:ZvBmUhFmUj1T/myibDz3oTzAK6Rewg2iBZTVZCt9rHFnHcIxTwSBm7S:/bnmUZmyo/3AzAJg2i3TVZGjFn8WTwSB
                            MD5:FAAA3D307C04EE12B73F37B8C030752A
                            SHA1:FF736A0204C0D3B85A6C9DEAE177741EFFFE3C73
                            SHA-256:FCC777B64B1D8DBC2B1CBF01DF96BA0526E3A5D4AA0BA3B0585C39CF63C62A30
                            SHA-512:92B2BA93EE068A4067128FB181ACF297FE2006F8CB5258024A49969657B351916FC405E720E970A9DE26DE70E2D5F6754C0B61DE8C78286B27918941DD98E7FD
                            Malicious:false
                            Preview:j..........F3mpUH....*.....S...P.|.VD.R.U..WUd.._X.....c.'..;S..S....w.\"o.4..@...+......O...a....U..8i.T^..(~.ZUh..F.Hti....'..g:.o...w...P.....J...w..y+...l....R._...R..ei......g.@?.A...2P....,..+...l.h.bL...9.o........OJ.CZ............Z.xI...R...A...D!..>..P.k`Z......!.W..E.X......~c....z[=.....@D.o$A.fnv?.e6..Rc..LD....]NB'L.n...H.X.Fnv.'....C....Lq......E...L...b".G;..z...%"..,...W..4'...]Y.L...?.L.}g2.6....'...ir.D..%...O.YSN*..]..j>...w.>.^..O.^gySy.o....#K.'...~N.u6..0!i.2..d.B..AoJ[E.7....KJI....U.<....xzh..Z.NS..*.og...,bw......b.....6....T..W.a......n....W......~.z...whb...G3..9.i;|X.7..B...=..m..Yx.0...}...&.g?<2J%.}$."T2=..w.....~J.6.....!{..!.}/W.(..n.xN..b......x.C5I$_._...`Ik.Vj....^6..&..PA.....^_YVV.i...pQ..<.]...H....I#h...T ..-.$q/...}l..0Z......y.@*. .cX".,\.L..Y...Wh.s.1.X....K...E2W...M. .<.g....5t.P..%.sAe{..1..L......-] .W"oY)>.aa......j..d......!]R..%..QX?K...5...T8 .i~..6..g.j....i...j....%.V......p....9.F.p.p+.-Y...2{

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):2097392
                            Entropy (8bit):2.8404038627247554
                            Encrypted:false
                            SSDEEP:12288:UrsqBTvsafY/vipuphiZXBZxNgPg6Sx1274VZJUlzqucMLbq:rqBT1fUipJ1B/ND/dWcr
                            MD5:23C334B183EB5AEB543427CC71860144
                            SHA1:C01A7BADFDD1244C93940B2D4EDBACF8D450D85B
                            SHA-256:B783884A310985A1E3C49E8741F8E10DDA422E33EA21BD97CB140ED6A1DB90CD
                            SHA-512:134B1EABEDE3F164085580E934DFB248571B82A189E9FDF2342E870FE79F20539BDCFECF8B945A12A7BFE5E122CBA5806B5366C6D55A382499A0E4E3DC1FFC3C
                            Malicious:false
                            Preview:}..'...S.........Z.....G!....n..B..........|2.8.j.|n.c!%4.4C%.Z3.@.FER.;.$.}.pk..!.AE...K.... K7...4..r.......:p.`..o..*...[~...]"..N..t9_..%.y..0.ZX../.:.'<0...7...G.....I..6..`.gz.. E..r.v4Z.. A....e..=.....9z..K[xJ....}.O...}).${[>.;.>.".....o+.o.9F.n.V...................@...Gp....rK...4M%.....4.... ..\.%.}!|...B..O..C..!......&...?....n.....I.........R..g{26C.....y{......qbX9.\...}x...'.......g..9z.....I$(..4.K.....v,dK.t.|3..6...=.5........Y-.....3.....dRv.zAB..1yd......y0sV..t...B.P.h...B1...].:y*[|...(.T#9.BU4N...aY.-.J#.f........yg.QB.(,<.....Q.,WL.....C......4...y.......{r.#....q({...N&>.|...6L(..c....a.."V......v.k61'..4.7%..vL......L.C...Z....o....,0.%....d.qsh...'.3Z0...;..]._..i.Z...VjMcG.,.@w.....S.8... /N)..c...._....=E.?.s...c.......G..%.. E>...(.z.v..U.....S]xC3-q..L<..[...w..FfJ.0..C.~.[..b...B.v...:.&.R.:.t...=V.t9.g...9.).......,Z."l.....7..Q;H.7u.`.....!...mn..Js..$Q.f..R..."._F?.,...8.$.Q.\.[.7..89Zd..@.)"...".*.r

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.jfm.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):16627
                            Entropy (8bit):7.987082337457017
                            Encrypted:false
                            SSDEEP:384:qCqNmHSALH/cVR2aLjf4oOF/oOotHqmF/:qsHSAbUR4oCVotHqA/
                            MD5:FA9200B2F63ACA67385CDAEDE641A014
                            SHA1:37753736915F63C62C8B55F77859C270DABBC4A1
                            SHA-256:BEEC1D6501122E5BE330DB2FAB6281B39DB03B2BA5E36CFD7C9A43F78051C8F0
                            SHA-512:B9F94C1B03504D6D3F411FB85B933E5C8F23CA69315FE47351FF2BEA0B2D538A76C5ECDE9E4A0140D981D3955970A738BB6B77AC73E556A1139BD6D111C43F48
                            Malicious:false
                            Preview:M.c.......x;.1....|H..u..z..,..h:j...9.....B...b.H#..(..a$bR*.X.........k.. 5!...AH(.U.es..o+..0..<,.7t..8r...v~....Li.=....>A%dsB{.......HuJc~.$O..a..*bQI...L<Uqzn.yxP....NG.+u..@...k3.....{.h.M.f......(....C.s.y}Z6.Z.Fmn.L'....L..*...4i'y.E.a~..=l*..)..LHF"N...k.E..UwX.....J0....B.....N.+..?.763@.9.....r.As..-D........j.......d#..+........W...CI..q.&...n`7JF...w..V.}...'#....`...,..C..$U!?\....:WC..tG.g....P.....0.@.......1;....y..ao..D^....W....|...8....s".9(......g...,>y.v2[..C..m..`..i.........Nsx..1g...hpF&1C.h].r..vY*...M(....i........C!T..dPM;.$+..hy..NN*16'.$A..P]....B_)..WpP,b7H.....]....G.n..a..".y%'.../.XM.D(*1....G.h.'/.Qd1,.}.l.#.,.Y....)..v..(...Sb..BUF...%..};+..~...P..O.....[./Z^Z.7b.K.{...M..34.i.."!>.../....@3..........z.3....=.vJ..Q,.<....7..._Tz..Q...."..i,..nj...;&S...W.$.n.._......xw.]...|q._S.Hn.....6...T..Cp..G.........r'K....Sc.!v...@PR....s+...Cf".=F.M6Vb.r.C~......o.......8.q`.l....C[...Y.P.Uo|c6H...u...?..L........

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8425
                            Entropy (8bit):7.977916621441893
                            Encrypted:false
                            SSDEEP:192:rC5GalGnd0mMt9tzJnRk0nlPIInX3NKKG9E2+M4Qyyn5OWOH:rCQa8nToVnq0lAIX3NKWJVy8P
                            MD5:3A56DF5EE28F21A58758146C806DA831
                            SHA1:DBF1862C38F8D92409221B37025999812E6F49F2
                            SHA-256:430F93F8BC32502307DCD091EB2E07E6C9E6717BB73166F7A825F2837A31764A
                            SHA-512:688B5F907D08F106E9DC445005E7F8EB8A7324201FA57BCB7F21615E01B1677CB9BF1F8F0BAE5743BF9ECE47AAEAA135F159C1DBEBD76CBDA61B74C5DB934409
                            Malicious:false
                            Preview:.H.R...\Bw..f.....i.,.4_..Kk]....g...%..F.3.e..W.W....d~.op.$..L,;........3C..*.........?6..g.. .....5d.>.k.4....f+uL_T.. .R:.....0}..[.&.<4._8......p..6vJ..O'...;..*...0.C.N.X..,..@W.AU.....T`@.!....|....j...Y4.$/....o%.3AVu..4h......%..N....M}fW;...72Co.h.2.{...:.V.b...J...f.b...G\..}=.W.m..S.......(../..3..xlw....9.Aa..........,._.Z'.. .JN.3...tc.......].).>.F...6.?V..7......S..FB.[..9.t...?.......4.g.1.tgQ...M...g.....z.....o.....5*s.(.QI.$..._.VB.x'.a....^e...=.&..w5.)Zz..-7.....~F.K.N....Zr.....S../.y&..........q.....;..U'.?.2.yvVz.W.~.U.s.D.d.FE..:..2..Z..EyI...i......:...........o.[0.d.#Z..~...c.........>..W.0-..=p.....Smi8Q..-f.1b.g.p.-..]Q....x,..../.c.c2.....N.l)..:N.G..6.N.....g....q...\..!.P.B.Z...../r+d.a......p.LE}.}...w....q.........2....4...........?*..c...$. ....Ywx5....I.2'....f..+...no....5....m.=|....^.E.=.g..D.P..*.k...G0.6.d.JP..F.--.X...A.n.....`....K6..M...9.0......?.E}9...2......U.vu.l..\.2m...F.BfC.^..h.]

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):524521
                            Entropy (8bit):7.999638971003658
                            Encrypted:true
                            SSDEEP:12288:DuTns311CZqhDGAMb/gk6p3pHMGXH3cglJRFMXCpoiac:DuTns11C31/y7XMeRCXO9
                            MD5:981D04A645E4CEFE20D7EEEFE249BECD
                            SHA1:960B03330027110C1CBE1C0C70C9E2A755D473ED
                            SHA-256:F2AD06747F1DBEC6BF02139849403BCD6EBA1E40BE0CB81A0A7B3F659D0EF169
                            SHA-512:C3F509905A8708D1E9FE50D5BB3462461FE248EA3B88744202E7EC2C9FC0AF1E0560EA869141E4145CB6BF07ADACF45154A641A705C2287757FA4E5FDF4933E1
                            Malicious:true
                            Preview:.dt..pZR$..N....o..]._j..5i.8.....=P.N.DW.....e...&..;....J..Y.+....'.,.X....h>.:.uI....mN3+kr.*`...$....e.'.v?. .....m..|.....5[9...ao...I....&uW.cbQd..>......T......LM.T.....u........^.H.3..=...0.....G.Z..ro).7....39..*.U....L.mb.'.......s.....V6........[...rU.V.V......w..%.................I...5..*.ZA..t..,.u....9q.....j_<n..&........4...o8F.....y..e4....j.l.*.|my...co.NP&....e....s])...#v.i.A~.&.1$....F../.V.... 2..M..7..@dNu....rg...Y....V1G.......4~.3....m..d.S2-}.T=UM.LA.$D{z.F.:N.n%....c....Z.T_.....q!fT#.Vu..(..N3..+......}......._D.GK.;_i,h.-.hE.q .c.hT.F}8.V..O../.....f>...3.&.(k9......FQ*w..*...d..Y.A(....RM.....i..........m.a.!J...s...D..+..c.Fa...=.}.E..m.e...(5.J...9......c/...%..`.f.~..K..`...}(.dd....f#..b.R,....?......'.e..X.H......a.C..:F....6k.wH!....-2..6&.."..S...').9...7\...E...S..N..BF.23.p......H....$.FY.u9S~onl|.C.u.d.R......&Ly.>..B..~.......p...../....O.U.#..n.../...OE.....8..A...(..OW....,.>....VQ.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):524529
                            Entropy (8bit):7.999637216539291
                            Encrypted:true
                            SSDEEP:12288:ISmzg6orMsoc9vp97dsOKFZhTkwz8T4qp9guXejHHC:JmEVYsoUHdmzhTkpX4uXejC
                            MD5:55FAD751E78D1EFC30E27C3BD26CB8C6
                            SHA1:E73D0C1E46CC413D5DFC12F84EAAE22C7FCAB0F9
                            SHA-256:BD92095B2B557997BD23930D1A4485D8317A77E1733EA7C8147436432A3BE758
                            SHA-512:710F91D007AEF114F6D181218CADEA70DC3952796CCC7FBE4DCE301BCAB6D29A0C83FF5A752A1B127F7BFEDBF85620F6E28AF2C5C101804EE9EFC683094D7709
                            Malicious:true
                            Preview:k..c..%0.z.^I..6.n..........p.d.nc~.'C..oW.....ytc9.*/S.GGbv..B}..}..Y.hz.C`.W....0.....:....?}....).t{...z.q..8."..o...a.e-?..%).{..O .&...:c.L.;...D.l..u|.]Y.}......m..r.b..J.........:.....T'..[.l.I..5.b....6........!...z;P..$...I...0..w....kA.M....1..?...._.....|.,vC.....y8......b.r....k8Q.0..K.;.T.azjc..,.!=.L.|N.4......g......,C..90..E;.../.TBmf...)n.V..;..k.]..+.....O....O.".<...1......[..Y8u.D(.k%...L....S...x.o>+.....y......k.......%'..s[.U[..G(a.....D.'..pw..........*O]4...x.L..R0....&.|.S2......l..,[...K...-T~\.T......u.fFX6.._..*...wY..Y.|.6... v..tM....x.//..j...j.'.@....X"/.vhf.eN..k...g{`. ....A.a.<.q...W5.J..Jp]..-.y.uc}.F.#...<"!6.'..B&....h..H....i.b....R.Z.E..x.<].i.HB........>.D..A..F...`.........2R-..N....:wQk.#.s.|{.0uQe.....#.H.h.Y)..!j.W.g..h..W......i.F.....IOC...}w}N/;k....WD....0.o....D....`A)k..H.i.j.....p..G..l..R.z...w.Nri..~...j....N...S*...Z._....;..........(..b....W/....-...qu.n.q...6#.c&'....r...........N.O.c85.B

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):524529
                            Entropy (8bit):7.999670972625459
                            Encrypted:true
                            SSDEEP:12288:DadeJg2dtZ2ubyHXiSwuwlehFHhULfYKfYCULyYQCrlPvNGuGVL:Wdezf1rZktUsKALyNCBvNqVL
                            MD5:35950F7596E4EBBEEB1D9FFF71394448
                            SHA1:37E446897E54A13B7CB7E1E7397ABE1556A8C02F
                            SHA-256:0317E625F15CB68C89F8214DE62D943323DFF1778BE89F647EDCE8BFD61CB290
                            SHA-512:30FECEF37B586E6DB6680BCA2CF313C9C1F7A86EB8893C508D188A76166F7A3A1AD0B7EE2D483BC3AC291CCD73BA229BE130CA35A5C8538C2F076D5E5E27196D
                            Malicious:true
                            Preview:...[.E.z.G..A.,..............z.....Nh.7Q...M.1.............@...(K.$..q....a......*t....%.C..].Vr?.)....l.4...A..`.....I.r.|..:H..j..Tn*XL.q!?..<&t-.W.>j....I.S....i.TUF".J>......3L.K......\r..O.TT...q..BQ.hpF.<.@.b..`......3..,.[c.B...x..rn....Ad.. ..BA.Bx....b...s..OB.L..$....'...~HI..b$.....Y$^H_..|...gv6y%.G....F]r.`o...UD.9-.....j^...9....!6.,...m89.L..<.*".y.c.#M.Ep!~rD; g?A....A2..w...........2.#3l.......).Pm......!xU;a...F._.M..=..y@...lQ.#.\4u.......Br6,.m.*F..uZM.....=.)...-.S~.....5.=rk..}...%...(.. ..N...c5&....C.\T...x6c......t......3J...g4....}b........?KY.52R......wx-`...)...^...v..{..=..+...@..J.B...=&:G.F...."..d.$.............?V.IN.P.}..........zh.%c....E...[T..X.....[.2......,....MM:..OutS..n>l...i%R..A..g1.:.@..>n...V.pC....}....n..]...QK.)v..iq3.\S.$.8......,.WYf.....(\.I...+c...a.)..RW...Q.....".......jT...{..).u.,..w%..I....?8..Hv......U..f...P....O.%.lf......./.UN...VC3...c.O8zO,..7G..E.7E;....\.Yy)..1.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):524527
                            Entropy (8bit):7.999672390477709
                            Encrypted:true
                            SSDEEP:12288:O0++SYd+5Jcl3X6E3SB2j7xKo3ZBxatn1F:PIY85Jc133SB2j9t3ZBx+n1F
                            MD5:D4504F2BE969544A2DE314769F07B91E
                            SHA1:833C02396854BBA5CBD2D2AAFCE95415B099601C
                            SHA-256:00C275C3A6EE42E090717EF5D6CF58C7CB7D330C15D12ADFD0BF5DEC5F1FFD06
                            SHA-512:1F692D54ECF99B0B67A89311C357D1BE1E7C5920B4BC112FC3EE99A7124A4EC51C5DA5AF28A13404DA033F1F13A0456AF57F6027BC5A5B8BC9B869F64B05DC81
                            Malicious:true
                            Preview:......U!}./........d.'..?...^y...."1.rRd*......R...(.....<.&..Y.^Y.....).Qh.I..GF.~4Q.9,OU.)S1oP.B.._.Q/.a.F.s.....t.c.. ....$|Y>...e..nn_....N..}._../X.MAyY..*.....GLh../4f....]...0#...[A...=g.....f..R9..nho.o.~%.....t.&5=i+.4.v'.I..j....e.:.Z...c..U@.....E;....W..P:G~...3...oP......>.l...k..9/.A.\..h..v....K0..j1..&>.[.....$..X...yc..=..V.........;...?.\....(.pU..p2;....w..:.KY...y....x.....2..J.....+Hw.......i.w.o1G.!....{_..)7......O.{cr..FI...^.K$......02..NOH._L.:....?$s..z^..l..Q6n...y{..l.~S.d#....+.~E..[.~D.......+..".l.F.yv.7..R..1l.a.`...."...x\\..z..^?.NkT..... ..N2...`.#g&+\`.\q...l.P.K..f.r......\?5.O-.>.@X..F.zs9..}..b310>.U..|i......!Z.`....d...s.../hHK.q-Y..l6.~.M..-.K}.)..?.d....O.nk..=..0..q...$V...K;.[........9.ur%(.S.&h....?...+On..i..G....,....D,cR;i..P.Q....[..Z.v.7..x......l.o....._g...'.Q0$7.nB_*.....G.D9.b..K.jnj....._.6..2.x,.$....J..?_t/..6.h.-.......J.2\.<P.zW...W../xG...B..lPcT.....X......x...3.e..p

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\308046B0AF4A39CB.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37258
                            Entropy (8bit):7.995669243461669
                            Encrypted:true
                            SSDEEP:768:O56Rpthbl1YLvDiJnYDPQ/bFf6tyzEZ/f7bB0kD1Z1MOeNaqPJL:O0RfhavZaBigz6KSiOexPJL
                            MD5:D6DBE4A702FC0D1D255998ABF8FEFD49
                            SHA1:6432E2885C93B69B95BA2830AD71F0BD875EE729
                            SHA-256:F54BC6FE3F79D56956DF2C1D562828C041A7696976947579BA9715124B8F0EB0
                            SHA-512:1AD418D1A7F493072B9DE1DF825C7E2238E6C1543B61FFAEC8671AB2CBADD70D6D68A982D7EE944AFD33507AB2E3BD4F91ACC490E215737A9B53288AD72AC28E
                            Malicious:true
                            Preview:DR......{.\.&I..(......O...]*.N@qu.$..:..r... b.......%-O..?7x?..>)^Z....u...j..yS.dQW...i.r.5.....LJ.R..x.Z........B.x..YPv...3....ZR....[.-7A.).T..P\...y.D:......@..oT#.i.4..JE..<uu.....[..a..*F.9.r+yg....a......%.N..k2t.]).{5]X........,.o.iw....P.zQs......xzJ$.goo}|F...$....c..b...qY}.<.*d..&..Wz.t...q..-........)...^.O.....'.~.^fg;..:.Q.R.#.1...l...PQEc(.zT2.r...1...B.r_e..x.(.5.|f\^..-...h.\G.g.g..Y."..QGA.n...=U.r.!a...+...C..Q.E.._VSG.c_.*...=.......B...U.$...@VE...EI.q#.C.q.Lsi.n>%...R...h.....\B.z...O........c....s...a.)9ms..!.c.N.t......r.(P.'.......x.A...n...........xT.......h.e.5...J!v(..a*...{.4....6$.x.k....A.}...,....)7>.z(.gx..=..Z.(.........{(1.V.*.1o.5.O...8.......]....2......^~u)..W|..#J.1.T8........".&.kq.a+o.+..U..Q... ...r.....P...p|{f..&+..Q.r8Ov:t.M.*..*..6.+.)...a|.OV....U....^..l.....g.Yo.f.^.. .Z........op..U../.~.Dp}M.*X.-..."8....M94..RRz~5.+..k.......v.?J.E.../.g0.5..x..`0.........U.....R..ti...9.9...9.WO.W..

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\308046B0AF4A39CB;PrivateBrowsingAUMID.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37294
                            Entropy (8bit):7.994016582434239
                            Encrypted:true
                            SSDEEP:768:UdhOGSnLobBfckJxgf4TZlW01MVLlDkU1r69ng1eyLLz952:NG8LobBf+4TZlW08LlQU1rongdLLZU
                            MD5:EABAC3FE80148DC9A0E1D4AF6155A50C
                            SHA1:D66B03AB2A4281E80935EAA62E2E6D5981776583
                            SHA-256:3E92809DF5EBD22CE58FB21D0CC0013027C2DB7C2FA0262CEE51F49D9AB7C3CE
                            SHA-512:513C5F5548E1E1EFE13509F5540957FF3890FEF1C258E476FF015246F10D612DFC63D3BA99F8CD208FA6BB2C5D19F96F46330F916CD4E73E8A95484BB9CB9387
                            Malicious:true
                            Preview:Ju.&....r=.3..[.._...u...0=AR..k~+..d.F.U.....cW...,,.q....<gf,...I|q"m3...\H..z.BX.....h9..,;w.l,....5[/)..c.Ar$n.w.*.Up2{.g..`.c.y.FN.....T....X.L.P'.......n H....R.}....OO..!.NC.h..q.9.K~<...j.zg........1;...\t.{Gm.....p....{y.|.z.....<...:.5.>...h.Vk5..5V..........e.XW..{g.\.x]E:.-.....:...H.L..m...(N.v....D..3.....HJ...[`~.Zn.XU<c.l..aa..nZQ.9sG.1&.L.V....._....GN.a..kv..H....q3......w.ON...q(`y5......r...T...{..s....o....BdWm..[.....C.....C...'..`.......L.$_Oh2jE.&d.&......kP(&.l..gT....../.S.Y.z. V..o.T..L..{.,..{.E...O.p.....j....~...[&h........<..pY`.#0:]['.K.4H..\8|....E".,...>..eX...:."x.1..ux..}R....hc.7..!......i..S.@....y.E.9../,.2a...AM..~.)e.8.>..Z.G~.(..&.r...... () ...Y........c/.........*...;....2.AVr."..'..SYg...y..7.@....;2.v......oP..d. ..}U'6A..U..*=H.a..C...h.t"9.j.P....&4..&.....p#3h....^..}e.j.._..-.w..znx..D..0.....:%.fL.q.r}.W.X.&........|.o..6O....Tl..N{8V...J.........=...`...MQj...zTP.. I...#.F..l[HN..J..z.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Chrome.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37245
                            Entropy (8bit):7.995733690077315
                            Encrypted:true
                            SSDEEP:768:tSu7FONew+ZEz9XMGj6SqxlSbIJMGv+p+cIbfKrH/0rqmXrO/h6ra:ueiz5MkmQIJE+1fO/6L7OL
                            MD5:34CD4E08C7A49644703729BAFAEC009B
                            SHA1:6E101DEDCA79E093A1202E6079B57BC10532E54D
                            SHA-256:FC6069397ABD2E68A38452F7AE47A6710FD184EA6C8E24909D6C72F2FAA23CFC
                            SHA-512:9A08561C50A5CA50FCC20C682EF329FBB34EF3140A2F5748AF92A10053BCF998BD88B21A20066617FF70F57E43449FC59C3BAF3D5E784F24054DCE23BB56DAD3
                            Malicious:true
                            Preview:..."i9J{8..G..[.W.UDr..............q:.....V.lx....R..`m.....^.ZV_0.4......!v.ac.`...O.}..KM....jF.%....#...v..5j.o..6c..... .wV.'...5.`*...Nm;)..#..O..@....&.7pc.n.)........U=...V...D..u.<..l.L>$...Q(.0"L..h.........u..L..'......G.Z8c......!....Po@/..x.$..X;0..AD)^.u.J.+....)....Nj...|BLi.....$...FQUt.gV..Np...M>......&A$.|.<.f((H>:...._V....].6....M"sp._.....c.....=."...DS.......P...]...K..Fs.Ldj.v.\....o..sW.'..`y1S..z..r,..0..}..30..j..G...].8.....]<...b..!.....A%..%D.5K.gh.A...*...G;...fq3(SE..@......`....N..S.....Q..J........m..b.n.1...%3.?st...B;. ..6. ..k...1...;.....KGM.:..5.1.3.k..K0j....Z.....C>...V._|2......xK./....e[.....`....HZ.lD:....*...3.T......>..=..x...*FM.o.Q..YV..A.(n..[6N].....}...x*/.F..8d../...k1.fOUD..9Y..<qvH...r.I.........!..<.|.rB(.S........~|G..4b..Jin].x...` .<...a...A...r..a.mK"..d[.}.3....1.b.....oWY.q...7h...]*.=+n.f.."3k.*...;Xp.V.,...#.^.5.'.j.......eT....[..<.\.j...........R.......u...qR.2,X.6w..

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\MSEdge.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37245
                            Entropy (8bit):7.99481120988605
                            Encrypted:true
                            SSDEEP:768:t45kIy3brSBkj8iw2je2PUrk6ImRwoSdB2DxQx+fmKo4EYEP4ue7/YL:t45ktbr3gL2K4UrDH8cxQoCb0/YL
                            MD5:D3EC8104CF2FB02C5AB0B1B3629D33F3
                            SHA1:C556323856F2FA392736181B6BFFA27810679F96
                            SHA-256:C69418D222DEBB55263CFC2FAE6BCFE7898733C1C9801F50121DBCDB8CD423EC
                            SHA-512:9336BBBF00C7CD3417C2C1C9B4557549CBFFC783B5EBDDEBE65E6DC75C8E7B92868554DC51A32640F770AA0B8DFC93317BE4238F3E5DDBCAE2F46113F114BDAE
                            Malicious:true
                            Preview:...@.:8...>..E7..am:/.........P.Lw.$..7..9w.J..!,.Ln..=.........2.RP#..S-..y...2V......t...3.^yRU...].^J<...0.e..K/..{... ......{+Sm.u...e..M..(M.Ao/P0.E3y....J.y.[f-.c..+j.....l..0N.F}........Uv)%..;3...O,..R...*.;t.poD..8:.#.GY.....>g..$.F..!.........1..:...+...}.l.B..A.n.j.4.o....._.(.@..$.3`..g....aA....u.z.....$l.....x...D.k.'Q:....T.`.^...N..ws...A.-.[..v..h....K.. ............lv.....B^*..J2.`..uY}... .....]..s\....s....3.)...\?.NUo...JO.:g...@.bZ.n.@.d{....^.....+..)..+...`C.*.4\.a..De.".....T.H>M1.].........uE.Ot..}.@.&.....vN.................W.=...+.n..,.Z....O.@M...2..ML...8.u..k.....(.. ..I..>..}b../....[9..^......]..eF)...s...>.b..k..j..r.G>...z|....l..S\-...7.w.,;.+7.....JE....8....<F...R..v;S..I.y..dO.....".H........HJ0..-.......&A.....0.*.....1.,...Dc/&.....%...|...{+O>..6~2......h...&..XY.j.{.?.E*....DD........;b.-WMAP.~.OYbq...I.I.....9v!,1.k..M.,...m...L........n.J.....*k.T.o.5.m.4...f...<u)+.2..1...Hg.d....

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_549981C3F5F10_8wekyb3d8bbwe!App.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8178
                            Entropy (8bit):7.9802302323953
                            Encrypted:false
                            SSDEEP:192:+SO2nWFxXJkJFQa0Jc5vj3q0Jsr8KdyvkqF:/OuWhkHQa0JcR3q6hbF
                            MD5:59109E44ADF861A62629101472669720
                            SHA1:B969B7F65726167845E712FAB094052FF9AC7B35
                            SHA-256:679A6E24C861F16B7D6EF0A063DF76EEE04D26D05C2835137459AA7D0A3B167B
                            SHA-512:682DA47FA7E4CFDACB2B3F962FEC256307BAE4F47977D670E38922010E6253C6CA501E52104D8C1EB8681C886B277AE34DB850239E90876C01CF37E5DD2F0841
                            Malicious:false
                            Preview:..V.M..B.....1S..9?...vy.8W.k.........c!r,/...@,.......A.....s.;....U....a.7.>...U..>f....l}...*M..4c.s...$..{n..........8..<Zo#n..~....&.._v4...}......!ON...,g2kJ.L.{D.U .~WS.Z.)`!A0...X%....U.....*.93.+.....I...N.q.~,.....R`..;.n~..g.j!j....![f......%..u..,Z.......Y[/..aK..Q..=...\{....=Y......RR....n..7.<........./..{.p6.......uS...r\.g.<.2Z. #_BW4..+.,.b.EC......NM.......,.c.j....+D/8.!.....g+. ....q.>+3........&.......z}....=Y6V....dT.'\Y...>^y..e&..3..S1KM`.8.k..4...U..,...".....;F..d.^..b....5.\d.g\.F....}e.....o.q...?.f..0.!.P./H.^'.*.2H....ct..b.T...e.c.....a3#`...%...9.&.tt?.,|..#...c..I.....m...n9.v...).0......5..%.A,.U....k...._.b|.zT...y.30..9.]..k..f.\./fBe].(w.?p~.>....d.}B..oe<......x.WxM.?t..B< ...)`?h.)..I.I..b..$4..*b.....l.l.yLmW....`...A.P..=^...E...i..).x. #...<..ts.....]em "..k5..[Lh. .u....8i....d/..+........i..94I.....8qk..?!Cr..M.S...t...:...Vq2.....j.....Fe#[Y.Z{....k.G..\D..... L.L;..:h...X-...t...b.':.W.......N....e.*..%

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{116229A7-9A3B-2078-DB5F-B5A20811242C}.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37321
                            Entropy (8bit):7.9952318851775726
                            Encrypted:true
                            SSDEEP:768:8DI7GfKgcaj68aMpMfQSOet/Rch6FZ6ir9YrqE8GI+8CXm:8DIaCgcajvzYDZf6aYr58h+8CXm
                            MD5:020A8F26ECC4EF65C7B9645F731B73FE
                            SHA1:562A849DE91BA421C318896C5905294A55469F2D
                            SHA-256:A6B720B019EB6E94530F6AE50F645C9FE5990D2D99412C475F9D11500A9A2B24
                            SHA-512:C6F4D6D55B46EA6FAB325C51190AE8039637FB2B5D1D6FF2FF48A5D71E365C586D01343AE665427E13721B39967CC9C6A99F28B318CEED93FAC2323A6D472F6E
                            Malicious:true
                            Preview:............*..ge....J..I..H\.'F..U4...W..g.#..Q....+..n.G(g.4.sj.... A?.mZ.f.kE....M.PG..j.er.....ME......n...6....6..d..sDe._.M.....;g..3.`9,v...a..A...gP?f...FA...ZE..s..C..m.bb.....e......;.ia.5.&.......F.z............._..........)!.vY_`.t....:M,.v..).M....B.]...xc..x.N.]..!.. .}/.!%G.j..3.@..CW.6j..:Nk..4.Ot...b$.9VT.q.U.p....Z6.....Xk..(..@.B.Y.i0...D......f.-...(.......].l.c...k..f..Db..t........(.*.....>.N.DG@.:D.....S..*6.$>.:......&..V..=<*....n...RO...{j......#S..|u..s.Y...........d.u!].2......O..G...r..,..nf....N{9.v.2.[...Q..."..w.....:..J....$..~.]*....+..5B:..w..._8:...V..........;....e;]......s'.X3.4.5...>.`.kF(...1b..&c5..p~T..&..+6........'...c..>.t...NZ]1Q..|C;.."N.$.1.3...~.h0`.v.H|...CB...[.l=s'9.H4....../..*..15.F@.@.al:R....E>N.....6w>9o....U.n{.D...R..<1.xcm...l.....*O..r.;..G.s.-$....@cq.v.:|1{........Cp...EL...z..$B....w.......k.....!....7c.8|..tc....7...H.:f...TU....E.H....W.....j..g.X.O..u}Y.0..'..z1T..

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{16988324-21C9-05B2-CA60-9B4EC72739D8}.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37325
                            Entropy (8bit):7.995482018319721
                            Encrypted:true
                            SSDEEP:768:q4ML2cJU3m3mSNaAbfhu0UP/6jxsci3ZAlr:q4cJUYZNaI5u0E/6jxscMZA1
                            MD5:B4B54C51447CC055F9815E1193F84B44
                            SHA1:FB5D7B0E30B04287CC556F5EC50F14245FD9BE7D
                            SHA-256:569D1EBF9104C78BCC7082DAB40C28716C9C8A20A9C645683D5962135B208425
                            SHA-512:8EAB273474D48284E3A476AD6C5AEC761FCE1E750F681EEB0832242EEEC5E060674EED7674B624A6608C67FFF7D5612612A8626F0F8FC8616A5F7BB9D703DB0D
                            Malicious:true
                            Preview:\...l..".J.......[.Z.%...f\.)H/...f.X8..@.;...:.o.X.8..$..BZ..4...G;.\....&...G]Im.jq.C..d..C..j.h...K.9.K.ck.1L.!.......(6[.g...?........jzm8v.X............a.8P"O..1...b.....`.+..z:."....`.3..0....t......ryq....O......66T..9......y..3.VS..`."....r.G0#]E.j]..4...7&.V..&..]..Wq.F.@(.~r.s.....`.0..i7.$k.S!....k...4..Hh.;.V?..w.....N.VC.Y..e~..#.#J........;....+E.-.$..u..{.!]....k.0..8.....^..|.!.rq.9..M....7..d.-."ow8...?..z.....'.+7...4.:.X.0.Fi.L.U.J.JWbf.....Epd.&9$.c...w..O/.lW...=...Mzs..8........T.[........W..Nm...<h.'."&....L.N.G*.e......2?...q.3...^.Q".2..2....Xe.L+.=<...#.}....I..S.o.\.5..m:....].]...`t.d.+@.Y.f...F....Q..H.xB.Sb.6...DTCNA|...{geD.o...Y.../....>~...<2/.'..".............w........7.....d....Q..c.S..>.....K.`.#.......=..0.....Hd..{...)B.7g..H..{..L4U..6.I..r<E8xD..<.....51B.]x....s......P....V...4f(=.P.3.Uf.%.a.}r.'.x.!.#W.....ta..._*4..g.>...7...78..5.......WM..o.X.}...1N.=..bS..2OU..r....Tdx.`....m.c~..

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{8AA47365-B2B3-1961-69EB-F866E376B12F}.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37325
                            Entropy (8bit):7.994246441680753
                            Encrypted:true
                            SSDEEP:768:i7reI7q1DuiFduvOhNoV1kIa174Kc7uLMAppeLuUfGPU:i7i22zoV1VLKN3NU
                            MD5:583096A0E92A0192748E3D6CFCE3CF4C
                            SHA1:A5523CB15FA13DB86A21E2F04CB6D1771FA137D0
                            SHA-256:994E17BAD35FC273DD9E9317E6A79226B0E3DC97C49E511748EBC71F4236D4DC
                            SHA-512:334943102534603B4A63D7FE6B8D83A622A2EE2E2EC461954FE5F089D2E566DA9FA6992DBBA656B7BA5FBF5C224FE0C8FDDD9EA7F5B740ADDBB203406184E746
                            Malicious:true
                            Preview:.....6.w..|..A.>X.G.K.l.0.S./......h..?.K.1f4..._...$.<!@....#O.NFf..v.{b.4.o.W..1H..+R....8.D....u.?.B....))j.z.`,Z..z.we....c(..%xy.!.#....B.,..yo......'X.T...E...".OJ#E.........s.W..Tx.../'......p.O.&J.6...A.S..i?..=......<..I...U.c...M..2t..u.L.KG......O...di,..6..S..;.i.Q.1...:L....S.b...ex(.....P-...2.J.\.'.yke.G...f.w..&?....@.b.o.v`..R..WM)........W.....S8z...u.s)!.EP. .."..d.t..$CX.>.6......A....k..[....k.&.Z.-.....:..eXk..>..Q....(.w..:....jB..c...^.D.L.y....p.....F:....=........=.&..NkF.[..6e..{........k..L..."z3..0...$k..g.....M....j......=S.>.]...a$x.....v.4..u......2...6p}c.t,.+.pq<........nr......2.;.}..|.yhfe..h.WZE..aJ.....N/.....d.d..\..o....)#.'..w..tS"T...S.F..)X..|2Za.../.....4i..=...V...7..G....O..l......^..^....9.....X.. ..c+..{&z.,.fakfC...v.A......i..E.>@r..nKrgj..Tq.-..CG...&..O...N..Q...h.R.........]..+...U...6c.T@....L#..w..g...Oiz.../.,hc..}..`g./.tUD81{O....O.......<4f.....Y./...0..^].#.9*T.}...f.0...T4k.:!OM..!

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{8ABD94FB-E7D6-84A6-A997-C918EDDE0AE5}.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37324
                            Entropy (8bit):7.995210200454633
                            Encrypted:true
                            SSDEEP:768:7IG4JylWlHFcezG5PrriZTW/TgdE03OpQ4yXqNjP2GolcPvc4eWNHiu5:7IG4PpFfzUPPiZTW/EdE0e+4yXqhOGoc
                            MD5:74EE21C7DDAE88193ECB8FAF344E3B6D
                            SHA1:C908B25D28D11696F2218B3526F8D3E246C7E31D
                            SHA-256:8A3321FE9B893C3A8113E0BF98339561E2C26B386CF5DE9738C2E52AECD9F571
                            SHA-512:AA0446E4487F53A0A2078ACA18E31420646C56D126D8D9F16D3894199AB2F9311ACEB7FC1A41C00EC2C3512DA0747EA5C2F2B37E1C349C317EA8571D7719AABB
                            Malicious:true
                            Preview:.c.s.u@.Y.,..s..J..q.I....4|.#..<.Ee.1........@!AV.,(...'.*$+.....B.0k4,U9#...Q..x.-4..v.2..4.-.o.=...R.P.2. 4.:7.C7h.|..x"b".u.Vk..8..S..b..we.....iR.++......[.(..|.r.N....7\..._./....==oNT1..#.jt9..u.....}.l...D.H...m..clE.([..m.@...../.....v..3-...7...$.S..G.=.T..-I*.....L.J...n....".I...../..tg.7.........&........1z.Fe...P>Q}..(..:..fP.......I.G?8....LY..K.V.?....".2.G...W..}.......W?.}.r.`,b.[..u.c..&O.^..`....t...k.8...}./.~..`.p.u.Y2fl{S(S...>C92.|.jQ......$..6.>s.S.6....s...c>.-..J.Rp[:.......JK.:(>O..."D+..$..G'...A.......p....N....}&;...8...<.....R...r.+6m.....|..XyH....S..3..R......< .l.N.>g.^.k...3}.s......U.B.i...qn.R........kz.....^C..p.b.36....#....O..0~C...:XV..7.1.J...!^......w....u.....ZR.*zt9.].b..`y%....kE,....F.44iO..q.O....L........Z....,.a.8..m.@...\.I^p..o..z..{..+O..~G..i...>.d.C.....77(T..bgZ...Q...ch.N[..=..%C.%![P..m....0.$..]2nh.R.vM_&D.7q).M..-.X73...f..{......r0.[...F..L.$.s.......qw..p.?....5K!..Z.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{923DD477-5846-686B-A659-0FCCD73851A8}.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37326
                            Entropy (8bit):7.995646668079704
                            Encrypted:true
                            SSDEEP:768:UPFDf1ydHUuHJCgO2VecxbB1G4re36vuhCW5HObommxGKhC8PDz:qDtZuHJCJ25xprew6CueMxGSXn
                            MD5:8423882462EF6719B232A7D162319C55
                            SHA1:6792918EEB86529EC6AFCC085C48E9C47EFE19C7
                            SHA-256:B1A36F5986B8B0CA15D294FF305D65D163A8880823BFF817C1BFED4229444FD9
                            SHA-512:CE775721FBB72DB1F759FD8D46F4E0C4643DE64548F9941CEA9A4146BE5ED0DF122E341258B38DB21C613B01209678C136BCC232EEC625D5836419892A5F8176
                            Malicious:true
                            Preview:.U....8+..e.#.R6....W....a8.....!.h.vl.oc...............X..M..c..oY.....)..<~.KE...,d0..p#$>...&.s.s...Xu..B.7......k.....xHX....}.z._.A4vzuh%.=......j...4.+".3c.c....N....v.N..3..|Q.We..F;.$.....S.-K%..l .......<{.Ml...B ab..d......I.*~...Bq.g..d....;.v.l.I.O..^..s.:s..~P.v.4L....K.6...p.....H?h.Gm.....~1....\4....9%.......A.rmD..........h.B.*(.?y.|).._.a....|"a.I...u..P.q..U.L....{..n.....Zz........_..Bn...u..R.Sr4.u)..T...........M.g.l..z#..h..`.;G.9.......M...ir`>...*@.=.@.....H.5..G5...3..........N.D.i....g..qrK}Y.C.#..k...6..T...U..._......1(..fd..../.J.;.J.....P.S..=.O....'X...,..X.4.....1pC".1}.s...~{..s..]..$j')R....b.../..%.`q}5..$....BH..U])E{........!..9..\K..N..I.....Z....9.\..%...O..y>Ao^".-<...)8~1h.t...Y.%........(......4.....5X.8.b....6....Ouj2-........3./D6.^.u1...@._..i..a....x.lIE~pBL....a....t...v..B.S...t}h......]ja....*!....'.....&..x.K."S..r2{6.t.G....)..\..*~.o..:.....)..4..9..K..={.26..~..k....ob....Q....Z.M.Y

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{BB044BFD-25B7-2FAA-22A8-6371A93E0456}.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37320
                            Entropy (8bit):7.995296525873981
                            Encrypted:true
                            SSDEEP:768:G0LSzhXVqM493aTcZOSIyg4CFmfIlgwjFFDtDvzTzhgH1geLH:7Lezq59KoUdqanDlvzTeVFH
                            MD5:D234FC7300D29B58F3840E6BD1DA665A
                            SHA1:DDE2EDF8AE49AE2FEB455E7A21CCB154BBF59179
                            SHA-256:7EB8C6CBC7C2C39E47809EC9B52F9D51910DF4285B636515FD379413A24FB114
                            SHA-512:CEA45709310975D440F438E8192573FB9770EA93CDD9F3DBEAB59D8367D3F214B2B8D633CB3DE51425F364F0DCD823F34B6DBB74DF185EFBAAF3661A8EDDC63B
                            Malicious:true
                            Preview:...K'..#.U..xMJ..6<.5....Q...E......{V..4&.[.{.g.p..D.kT..{..A..x.z1.G.....(._........l.2.....}-l.`F2.lC.h..G..Z<.E.S..@..z...|.=...e..?.I....({q.H.-....^.>Z1..U3}.........C.I..\ L.!7.6...E...I.9..:.va.q..*.eTG&..@d.lN.$6.\k..:9..H......K....A..x.5El...J......f....f...SF..i.9.r.M.Q.}.....b.....c.lL...Sh....YT...=@..............g......B.e.y.p...H..H.....:..@.4...y.....XG..lXP.U.`.4..~+.bLj..A@.............i.<.}T.;l...YP.$...*..9f.../H.K6...$..|eb{.....9....y..7..WO*.9.v..a.}.....Kv.6..;....%...5I....b.........$ze..7...|....H.&......[.+#R...Rc....}@..(.5.__..'.[2."0.Qt...E.e{0V..B....G?u.V.,....#......z.G......Rz.x?X...................=.......9..Zm.nWU....Io...G.[:..}:v.lr.T.T..".,o.....-Uf...SZi7...t.w.v...+.U.E...U...`z./Ks..V.T.I..d A...."./.es..q.......z..........\y?..B.......j..+.a.J..-...=.7...T..Y..V..W..&s&.B=....D.(Q}:..`...$}'$9..;..9..E.H_.............?...".....O..........gvN..<...[......N.>..R..ozG.|.&.q4`..A.*....Z...........f

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{BD3F924E-55FB-A1BA-9DE6-B50F9F2460AC}.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37326
                            Entropy (8bit):7.994833514842911
                            Encrypted:true
                            SSDEEP:384:X+2TaqbrMskpaPLPV507RPgKzxkPvvQnErm2XrvzQN+9VOFNXrLRuMABqc/R7aq3:gL3xkfAEXv8A94nRuvtJ7aYQQZnxZ0KZ
                            MD5:5D26DBFC61313F148C694760FEACD7A1
                            SHA1:D4CFF4C0D5FF583290EBCCA97F4FE6D673C31156
                            SHA-256:4C93E0BD858542D2AF2B082802CC3EE8791C78EDC7E0FF5D03FFFEBC2100FC5E
                            SHA-512:554BA7EC328866C592037A1707AEF1963F13C200D2E115C7A613183DAE46410AA2725CB188FBBAB557AF6FE593D7129795D6994018F423A77C4D5268FC4D590E
                            Malicious:true
                            Preview:8...P'.<...%.t..#.........}f....|k.I.'H;`..e7DoT......~..........H$.wh`J.Y...1,..o6a.........n]..5\y.V..r.:4.?...GBx.....0.......N.Xz....G..CM...l].C.(../?.#..@.1/.`C.....J.*....h.3,.".?.l.\..U.C....Q.68h....v.j..Zw.MO.n.2.6.)..}.uy....A..#....J..m....6h...!1..3y..eR.......2..:.1'Sn.........Z0.s..sE..J..f..$C%p..V........3T..E..n-6.R.Ve.F..m..".~.r}....u0N.~.4..4.dEg6..s.....n.G/.....&G.K.......E.......fu...D...\..A\$./....A...cj2.7W..MR.. ...s.Y...z.8GG....................9..iS....p./p....{.<g....;...[../.o.......,a.~........!s...zwc..A.5.T.Z.....^WeP6.U6._9hMD...d.vA...H;.bX.5!+..|.......R.r.Kc.....Kd...........3.UM'...%.{@..\...>....L. >;.......p.r.N........A...f..v3......ih."...5...............,"..G...fu....+{ UfI8:...T....t)~GQ.'S:......t...f....[J).F.n......F.3.u.t..ITD:.xi.5..\P.......v.g.....'h.O`.J@B...U...2.8.i.+..;.s..-..Y.v.r.....X....M.9.N(..|.....}J)....).....K0F.S.(#.Z.W........{.-!..s.>.B.2..L...8z.....5..M..Duj(....P.D.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{C1C6F8AC-40A3-0F5C-146F-65A9DC70BBB4}.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37320
                            Entropy (8bit):7.995251853643998
                            Encrypted:true
                            SSDEEP:768:kd5lr7XAi+nPVN01HDRevZNUxt0Xv2QiGKs0yHkgvLRBgiaK/cXH:I5lr7XAxnP01HQg+2QiGH0sVZ0XH
                            MD5:9C9FCB23ED2AF849E9D480014DE8CF73
                            SHA1:8756B144D4654144DBA53A76D02056A719B8AFA0
                            SHA-256:2508E4478C2B2F2F42DF337064FC689BE3114AF7D0AAE63A51158348BCF9D538
                            SHA-512:1398AAFCC6E73353ADBADD71620839503893D93FC131F38E4867A093FD087108422993E0756B2608698F30AD09D3DD7FDA4626CD4F53CCEBD9C7555AE689D3E8
                            Malicious:true
                            Preview:..&.O......!..\....=~...$..yw..w PY..!.../A.I./.....?.pQ..EG.6..(.........6..=P:.MEr.u.b.J4..O.aS....jk..eC.*...T. .J...~.N..s.a..l.0U..+4......"Mmw.t.,^.P].T`..{4.R..2E..*..O.e..o......*.........C&...*..F.9W$.........W...M.yX.^$.?CXz.]r.P]"..O?.&.R^...&..S..i.PC......k...X..._.7....u..7)..h.z....A...Y........1..i.!......U..{.r.5....?$..k.W.GX{3.....\.$....../....^...4;j...N.K/.o.5D...~. ....^\.7X.R5...}.J>1i~.<......Xg...K........Z...*e..=..b..v@..Z..i~.e.At.f(@...`..[K...8..wDn.z..T..u...........a..{..........U...4.....pt.......B....D...=(I..#gn....y..Z.x.A....HM...J.:....x...`.. .+.L.)..Sy....H.\.Tb..l.x.=.fBi...<@~.8]j.._.......}...".;...."F....sXY.{...k.k5...P..U..*..`e....C..pa.J.h.D.pY\.t#4....,..<...v.%.z.R7.6..b-.o....+...... ]Sk'..I"CV...^P....VX.TJ2...b......38R...7Kk.w,8..S......o.o...7}....j..Y..e.v..l.."......J..|....1......!.....]....0..Gw!....>hc.....T3R-E.....Oh..B...$.-...b.8\..~.&F..n?...3.=. ..\}.).Ie...z....._.,......

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{C804BBA7-FA5F-CBF7-8B55-2096E5F972CB}.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37322
                            Entropy (8bit):7.995345319292207
                            Encrypted:true
                            SSDEEP:768:VrXywnWilMhtaGJERR6f+2K8HY8EuBq40o7amWgSszNr0:VrVnWoCta5R4f6cRQ40ozv/K
                            MD5:DAC266E6868BDCA5B94D85A4CD27A830
                            SHA1:7A3C2F04BE815523E5356913004AFA2D12015747
                            SHA-256:AEB2FC5BEE2A3CEBAB2934DE8770A1542CAA3C6676BCB0FD8718B220A445CE43
                            SHA-512:D517B2CF632F2E372674D5BC0DCED7567563BCAA755C3035B18E13FE1AA0E4FBD63D4378DB77C69C84890A2E34DA7B2492CF94615D9D38F9BD4D1B6A386D509C
                            Malicious:true
                            Preview:.vw..*a......c..@.....M.F...e.[.p...#..&2f.0....<].....-.!L.....q.s.D[+b.`..+5..v%.BSl..w.e.@=..kX..j...7`....7%.E<"...?]........_.,..b}...n....$.`*f..;...h.j...Z.!..0-Z..gD....uZ\#.u.m...Mw_....`h..3...SNMA...K.C.......<m....]... F......G^.y.$!....R..\.t".|.!....R=..".yU.......p."..g1v......+k=m...fT!...y,.h../O..$..(u.]..i...sY...r..7&.GI..H.=.{.X.......D."v^eP...#..........]f.....d.?]..]w......X...zD..c{...af.T.`.]p.3..6...b2.M>..V.=x.LN0?..tu....Ba..k....nu.T....M..rr..b. (`..NCm..9./..@..).}1._`..yR......._..S....}B..^..c`..e....`.Kv[.]..."X..N......c.*9j...|.(...f..O....16..T.b.+.V.S.q...&....K..l.M..6#...Y..i.HA..0.;.`C,..0..*......r....Z.}4".l2.5!.x.w..!..n<.ex&.`.Au.....%..R.k$...u.7....r....q...$%..Qb:..(cP]...w....WM!.c.A..........1.AD.oN1.K.{l...Q."...w.9i.u.... ............<F.=...Q0*)>;..@{V...A+...[s.....C...y6UI.4.......8..n..u<at...A..B\...'......bI.$...J...~.l...8...d.Q.o........fq...(..uX........$.\......2.z+g

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{DAA168DE-4306-C8BC-8C11-B596240BDDED}.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37325
                            Entropy (8bit):7.995745081973997
                            Encrypted:true
                            SSDEEP:768:UeSDEoI8kgAX+8uD4lNVsFlywwF01IdQbvAsOyaH:sEo9kA8uEnOPy+IdQbRO7H
                            MD5:182B214300F62C9212C3321790E9CF0E
                            SHA1:D9091E464904A08FE0D77DA8F3853431DD313B6E
                            SHA-256:3AB3D7FC02E5D54EB4721470AE9B5EB95AA6C919EBFAAA8D461B80CB41FDB101
                            SHA-512:BB2E6117E17056CB51C18309B6B4EE0A10AD462DD4AFB459FE3706C7929CB2B5160AFB297884A41189D9A33336284FE068DE997BCDDB264038A3F3532C474A8B
                            Malicious:true
                            Preview:/6.a(CxU...'..kK...e'..yA=z.....~...6.qZ..a..r.M...r.T.CBL.. G..'..a.g.X^E,n.ct..Y.B..........pI.w*..).........K....t.9.......l2i....qbs8..1X.#+...+......M....j...3Z.|$. .3_.u.&-...=."<.ci.~...0.....@....G.Je;=l.6..A7.....@E.CH.......wz.5..@.P;..9...k....Z.j..4..;..M.........c...tCg...P..........b...4U.WT....c...U.2.w.Ki....r....fB|.Bd..R....Cv.Z...q...VGeQrg.....|.@.&..e".. .Z.U4x.{.<...uX..e.H..........o..l......G.q....c.[.'...e.......X@B.H.>L!t ..;t.U..sWp..b.c.K.=>.....9...PY.d.y..B.SkP.;~.....'......S.i!.Gez..y.....TU.Y..5.6B.Z.{..*.....+..L)c.......C4......5=..:..kw..w.u..B..`.2.j...Pw.K7Z;.@.j.L....=.m.6..TC<..lR.G.-$.......05....7.[U.+..5y.@...`.Xzy,.w.....eb.0.K|...."..E...KX...(...=..t..zl.+..^...c),..3N ..L.b.(.L...........G#..1.?....cm.X .......W,....'<.L.......4q,'.=..n{..K.6g..q.}..R.A...i8...C..=<..T.@..Z.....>.K..h5...+..(..p...\.:..].SH._.lq..d....*.r...{....`\k./2..,.2.W{.....S#NH{.#J3.i.u..c7...4.'._...Md%.......

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{E7A33582-E908-3379-5368-5999454DCD83}.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37322
                            Entropy (8bit):7.995336023695519
                            Encrypted:true
                            SSDEEP:768:sYmIS+kG/Fp3nDcEvOmyVAhPD7YUACW5PysKhlDECy2fJ1ilXlyu5xExpaWkX:sYZS+hNp3nDNOmnnYUQaD7y2R1iv5kpW
                            MD5:1FF092CC9FB34EAAAD4B4F1EBA924C54
                            SHA1:B2FC61E78B1E0D44561EE1D5D5F949D07BA31BF1
                            SHA-256:AF4008DEF25A5FE8E7AA5399477C19A9527F5557B440BDB0EEFF9F56F761A43F
                            SHA-512:F2E3579114AB6015421C7B06EA1A3511BB65BE3697894DD83A84BD458443DD1923F03D453B7009DE2A56C90E31D6E93D073B83B6F06D0AB6C4188D87DC8E916A
                            Malicious:true
                            Preview:..m.m.d2...|2..CR.?....A'....Z$mAVj`.VH....s......K....../+...t.Mc../... 1.gqb./Ys.9Y...-2j0.j.0....n.}K.......a..!-[...?.G..W.a# J..(. ~..$]...._2[..e.@.Z&'?...tJ.....fOP...*m]T..p.$.....}..=...=.O8..).C.....U.....~.;...P.@.fV;..NT.....B..K.9yR.,5J.CB...3H...$..A.....v..l'..}.......y..+..(."...v.......jW......8..)VvD._.;.Rb..@...d.g%..G.I.....%..L...P....D3.\.I.:..3AE..KR1Oco..J.$.;r...N.D(.i.h.......~.01>{..a.#...3..0.c.C........X.\....F...W.e./W....1...ln!ej >}*.hj.2........}3..0,..G.T)6...+..z.y..r.[.....vYQ=..$.d...2M.B.W.?Z8zzz.X....@0".5...T.H..Z...**I}_.......x.=.]Ui........k./....gG.x....gQ...3........=....@...X@5...U'...i....#R.m....U.y.m...K..:....n..;.(...by.=2Q:e.@..d..{"+....2O.Z....=./.C...-...^U^4../F.\...E.s.`.......2..UU........{.s`O[.*..`+_......]..g.%U.&.....tn).f1f..O..Z.....~.%09..m..g.%t.X..Z...D;...0.D.,...*.}.{.|..O*nS/.{..VR.~7l....H...L.J.GK ..B{&..5.sc.]K....%.P*....cY..G.u%.>2Q.ve.&2...EyvB*...j.{.._..T...Y.....o.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{E8B84CFB-B069-BC13-F88F-170904F645E5}.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37324
                            Entropy (8bit):7.995015745292554
                            Encrypted:true
                            SSDEEP:768:imjXAgD4SAf0oGr1JeXSYbgN0viFoAcDLQLejHr6ciay7Fi4VGXxe:isQgD4SAc1r3erkivLPCej2cxKE4Vx
                            MD5:1BD95397BAC2A94B3AEA00BFB86F0F21
                            SHA1:F2DA22DF9EFF7E2AF8D8829F293DCE485589540E
                            SHA-256:C5371233DABE5CA277FA723A347BF66B1C450EB3A8DB58683D3FE13509BBF7C5
                            SHA-512:392EE79B1CA51B94D0CC634AD35F100EE3456BDBC5792595A222932E17E9CF0BED382850991149E88461D49F682868FDDCA133C3ABDDD34658904B8958788DF6
                            Malicious:true
                            Preview:........'..{+..>w....7cN.!F1^.L..O.....pTR.X.n._...oF..gLG..58..}..dJg.i.).E.....n...a.B...........t..m.|.Li..._.s)5.g8...wZ0..z%-Q...8;;.....l.~c'6.T..TES..-$...K ..O..9x*...'.K...Hs.HE.....*U....S..-2".....!.._..D...NE-=0...f.X{6z)0i.O.(.1.....E.......z?.0K.M...d.5.KO./.-..h..0.%...W.C..{..e.Vn."..<.mv.7/.g..J.1.u>....."..e..9.@3.L..fT.A..I.o./6!....,...R/v.."@k.....x..u.@....L...-n.!..../..n..W..#..(....1..'.;............=........j....o....)e...ex..Dz.fwM.....h/.......d.[..u....Ky..+z.....E.....~7;.u4.-W..t...:1&3.^.L.%M..0cz.P6.B..I.7..+..i.R....p......"..*=.w.......I.8.(.Z...a|.f.....Y^.r....L..&...LpD)6...............`.o.;G..2IQR.....4......;9~..x...U....b.]......B.....Z,.&3.2..>...+.}=oU..1...$A...1.k.....z)~..M9f.....G..9.5.:b,...Q.....Y^R59..dA.!....,.>..\KH[....b.s.nf.|..ri...>}/..q.P..m.;....c.B..S-n.\\.x...+.r..c.p.d...Le....w`.....3y.....>.....R~.H...S;z.)$..3..u.'.....!.&.,..I..&..F^...w.0..6.Qd.K.........I 4.F#.jI..<<

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{F1118828-A0CC-5FEB-85C9-DBFFDF98434A}.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37322
                            Entropy (8bit):7.994990291746355
                            Encrypted:true
                            SSDEEP:768:irkVN0te9QvpStRGeIca/v4cKRvnkn9k0ECx0olmPCBTzZt+:hVKo9QB0M/vmvnkzFca5zZt+
                            MD5:E6660B804FD9532B92B012723FD68C11
                            SHA1:031AFF94AB02E7A7B34F720C2E4B5969C928AC59
                            SHA-256:D170CB515AAC1E9B33AC120DEC77F1103C3423EC5E3F06F689CE157EC75DD0BA
                            SHA-512:ECB27E270BD235F430B66ECA2E77D1B075F07A02798AB9EA379E88CA6052DE64BFD2B58073A1272B0FE96001C7D02024BD7E0385441976F5B9BF10B04F82F919
                            Malicious:true
                            Preview:..m|..~....K.....{3\.c.....$....Y..S.g.X...Ks..3...."e....?.r.-E.)..h.I&...sT.V..uV..4.?h..$...S.],4..p.{.?.|..?...P.{..#.-.;\..=...$.p.......WD>#.\.C@.`".l.RR.....+..tH....tZi?..F^]....p..>.UY.Z..O@..uIvPo*.F..T*.t.J.SG...9....]7.....C>..v..!.lPd.Qp.@.U.vf^M_.c.~.....1.mc./F...E...|.3.by.n.L...k....2..FN..i>...A.0...e.....7......u.x.._h.D..Z...a..joN....F}......g4KZ.8......2.B...#B...).'..^..5J..':....sf.p...H.xc1.o..=A.......U...(!.....B...\..Z..fq.i..>..^iC>.I{S..N..OD.r..u.&...Z...%.).|..fO..$.e.p.a. (.P....!.. .K&q].2..,.Cq.S.$....'F...Kd.@W........~....3.Ni..q...F.}.z...)9......&.p.....{.......1...h.....l.mP..E...T.T...Z....p..0.5&?H.8r...,?.j2&..(-..4l.........^Es..i*..|........41..j.Y;......@.e.n?N0...qf[...x.]......R.q.{.......XWD......tu......5..h..!..(J..$...1c.E.{....O0(v...8.s>....>.Se..=2D...TT....D.7...)........[.{..I....3..,...;@...e..p4....#...yc"].......l.....xz..Bx..M....ti...}0...!..U(...3..b..^..T..=|l.-.3..9

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_BingWeather_8wekyb3d8bbwe!App.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8175
                            Entropy (8bit):7.976687331988686
                            Encrypted:false
                            SSDEEP:192:JbKU+8efqHoLbxxp6BVx4zTB4PvI1gibWPNTpujFF:JbKU+T3p84f+PAwUjFF
                            MD5:03B3F9997A213415B6B82B2EB9B2DABF
                            SHA1:9020352ECEEC7EC83C1BBD57838A33051B8B713A
                            SHA-256:CB42A5AF19025077EC58D8A9BFB0D669488A12AB2567175F58E14AE429B1626C
                            SHA-512:C83EB297196CD3EACA9FB9AA26459BB5EE809C879E5FE6561B31EF9B06F443132CA3511688961262BD99DD0B9DF1651C8FED23FA0A4A1F01D1047D9EE335A6B8
                            Malicious:false
                            Preview:..m*..<...JBt..B.q.bQ/:...K....\.........%7X..._.&....&..%.....3......_....?..A..l..T...k.M...B.z..-E...I.?...#<1....>%.{..q....oK\4....71l..z.S.e.4.d..;..do....A.%.....V..`.^Z.b..M|wq.......,..v.....u..Z.I..2Xn$.Z.$.x!J.m!.z.....:.Q...tIms(l.Dx..%.6..}.Jh..".~<T..N...b.......z.#.....i......~0.n..@...kq...\_..iNrm[...d.D..}..7..b,..........9"...3..`..*l..L.f..jb...z..d...F...a....wK?_...;..[.utk...".....`~.. ~VHh...;fOqYL...3l,c......(u~g.=.:G.[_..:...{....A...Q.oD..w}.........G...&73..p.9.1.....<.".B....JB...rC....bd.....P.....]. \N.~m..M...N.FMT.d.b..cA....n.{Z^9x..qM..9%.:..%....'..`..8...&..n.|...k3o..E.(..j=..5.V.. .[+|......g.=@....*.S'Z2..N.J.....|....y...hW3...A.yl..6`..T..-.-.>:.....$..E.-.%....a.K....E..........r......7!il....)......h7.......-....a;...1....5J.....U.% \.,..`.I........F.k.y.".....^..Q./O...Ol%-$.L.... ...n..Ti.k.E.i<.....e....6.t3...P.....F...7G.[R.'...H....Nr.n25B.......6.#...H.\.,.o.~..CU..Z@.....42..VY..{K$F..N@..w.MX

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_GetHelp_8wekyb3d8bbwe!App.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8168
                            Entropy (8bit):7.975113021068452
                            Encrypted:false
                            SSDEEP:192:j65s7S12vnFVC9UUTeprsfR1vFRWuCjXqpzyE6:kHa9UCC1vqz8zX6
                            MD5:A79F9BBFFC497648C26E740632DBECB8
                            SHA1:980BE84715D807CF5F68105A68A7B8162947B3B3
                            SHA-256:48ACF1529029B1286FD8DA2547F6CE2D1E3E6B8B583AEC7B679E003DC5AB5C0E
                            SHA-512:40935B6D25BA8A55825C8217E12ECBEF6230506608B9E20BD2973A7B5AC4D9D428F7CDD01189C8FFDE74675EFD0429905739362E4D46347EF329969C64211CFC
                            Malicious:false
                            Preview:".-o.A.....l.p1x..|....d..h........^p1..p.J.v..._.>j......@.w.u.GO..............s..*t.o1.......(.I.......~ ..._W.e{....6....i..]W..Rst...:.f.n.z..7..u....x..7.M....%...<.....%.2.K-...j........U-F.iG9.....z.........DKI(c..W U..0....0;4.w.=....T.:a..V..$g.l!aG.T.B...j...]f..Kh...V.:.9!.j..B.,p.q4...e...|.....E.S._29@Dd4.A....).wa..t......T....h..K...1q.5.9..r..X1.q...v.X]-I:.....=.D>..Bb.>..?........kVzy.Q.S0,.s.T.........l2.u.V...{..3.<l.uLL...N@Vc.......?Vw.6..*.OJ.c#$..HI....;..I....P@.,..=.......!....V.X..e...-.|......(....^.C.}...}.5Zt...z.k......(.Z2&......L..ziR.*.O.p.......5Y.@...#.....9C.U...!>...U!&..l..O..?m.6?...8..9Xb(.......).S)9..y`_.{..._}x...#._#.nJZ..../.t........e)-.......a1.Bbu.../.*....H{..'.*.S_......o..A1..7..g..wX[.nP.....@.h.}.8.)..[XS......=.X.'[`........r........?+...3...a....q..o..\.X.[lu..Wf.......H..}..~..g.....q.|SA.....VY.h...+.%.:p*...b.$.^H....N!=..7I`...OZ....(...24.b99.gL.,.+......7B+X5.c...}

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Getstarted_8wekyb3d8bbwe!App.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8170
                            Entropy (8bit):7.974254855999818
                            Encrypted:false
                            SSDEEP:192:zI9ZiQg34941YH5cfLu6BW+d9ynDQ4beEqlbkA:zQgM41Qu9h9j4VqlkA
                            MD5:33BC189942DF983CEDB05C3300525477
                            SHA1:EE6185903AC781731FFB5A5AB1693AD709E71C4A
                            SHA-256:BC5E56C0C163BEE6D5A9C0E65B79A75C4E82B4F951726141EB19F54E33B7F7CE
                            SHA-512:25B0956C01FE5284BCCA6B394C7079331E81BF46FE93A62C3ED04CBCB62EF7FE623A37B3A3F216F40CFBF440380B2F7F7944E31DFDB5935F02A18C53ADDB93F6
                            Malicious:false
                            Preview:e.........X..R..:..T..zT\-.M.......E7..Z..]..Km....3b.#.0...X...|C..Ok4.G..j...D...v.....}....,....NX..%......i*...'..~...PQ..o..4.......SK'.D..4...?r...+.T...g:6.CGNu.^...H..!..Y"(.N$...2.......[b...S..tB.....].....M...}...=........&-..y#....}.j...7.O0..5z..RX........ .|.&>?f.k...?%]....}........X.x.x-....xtgP.b.(.4@.^..B2.jJ0.>....{N...'...\.:........N..#...X.I......1....k*;Z...U@H..!"N..U..W<0.i,_(;..Z....:.~....J...Y....!|..e...Z.v.?:>..}..w.........H.1..5.h.[.0.Q..[.fn..YQ...e.....2.....W=.@.Z..l..>.... ..O&/..*s... ..}N..O.:Z_....&..n.Ha........8.....JV.J..D..e.OgdT'k.S....8FD.....G=~.$..W_...........$......CfPr+V.V.,..B..~.2.B.UP0.g.T.Z..Vej...?..:......puq......5.....]...c.:.;..i.?..^9..!t..L.J..o.V..vn.Y....0B.D..[..v$...../.6..[..C.d#..;..!.8..!.....|F.P..}....)r.A..?....8....ng..u.m..>0N.. Ot...b.\...P.k.F.rx^9Ul...B.{@..m.Y.......I...(..A.L...z.0....k,..UB.d......E7.XEC...40..(.._.....O..5..c.NA=`.C......v.6/"..#.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_InternetExplorer_Default.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37285
                            Entropy (8bit):7.995332030340505
                            Encrypted:true
                            SSDEEP:768:KXrASKxJPtAUtC9bWPtOuN93pCXile4aFFySYh4DFGmAIwcrJaDyqG:KMSKHPtAUt4KY8JoXilWZIMjwaac
                            MD5:3F74C42AE21F679BC72B125132B6E123
                            SHA1:B36988FE366E6ACD1617AA54878315E19BF9B275
                            SHA-256:0B92DA9222B9BDEEBA828F4B6712681B1E2BDC6502458DBD6C3F2C0EA3AEA69E
                            SHA-512:890CE85918DA5998DB4EC8162EF9C0F6930E32BD597695F407CF78A68B6F4D6E31F16469FFF58D19875199D296239B1DDB7C2ED48174DF45A61430B7332B73A5
                            Malicious:true
                            Preview:..SZFjU....9.}..Q....F.q+$... ..=......,./....+O.....s.6....z)...A....3)l!...m.K....j..:./F/..Ej./u...g'-#.X.b..."....K...2....d...#.|ht4^....WK......Y.`O.x.2..<.Uz..[........o..l.R.^5....p ...QO..^.oS.=M.._..Q;'.#.{..&..K.......]......o.....qF..n..F......t.{X.t..v.DHJ.}..Lf.v...'N..Yx......=.cy......Z^z...2..D..0..0D]..kh...PyX..Gq.#s.....I.....~o.......P......~ ..q?.......w....`....LZ..WF..Ex.y;..`Jj......Y.l...j..Z.!{.Q.!zkkqdR.w.yK..#.3.m.7.i..bE.aL.,....Ak~4K{.. .;}wr.]th&.l....G.+.'f....WGJd..::*......D ..W..0Y........m.....O..~S........._W={@t.w.......... .4D.E2.M.v.#.s..;/.....:.G.``v.+."y...@...3.s.i..w.a{....f.(.xRy....j..l'....L..s}..k.L.i........>..x.4..=-....JY..)..LlCa...Z.].....J...)..9$...L.@..{....K.q+..R.....(D|..m....K.G....F..#l.R.%.^6..+....(.O.4A.....E.f]r..S......Yz....4k....Z...Vj..+p.X..K.c.9..b.B.qI ..C..o....B..>...Q....J...... .4....#....>p}_....qSfLc....!@ ......W.9......%S...[....V1..#..k.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_MSPaint_8wekyb3d8bbwe!Microsoft_MSPaint.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8167
                            Entropy (8bit):7.978728593675273
                            Encrypted:false
                            SSDEEP:192:pkwlSfQMzbdv3ch9hh+FOVeziJa34OnLQ5j+jAhgfMcJlmw:p8Lc7GOVz6ygN/
                            MD5:CC79E9A5414D0780DD09988E081C7B6C
                            SHA1:6A796D80B5ADA0A129462EF6FFF7EE2865008DAA
                            SHA-256:7E9B287B913E8F15FEB2B10A91E36A0F4119C512AF278EDC32E3525F263FB855
                            SHA-512:158EA1569E65374F87218670179B0CC8C04D22CAC3EA82E14D3840C5B2D76446C3B1B7A6835A679379A1540F90060E4A28F1F89BAFE2F3E018B7376AEFCDDEF3
                            Malicious:false
                            Preview:._|._3. ...fG4.r....K..G.}.+/$..L.'..E.....O}$)..B..9... z.../..C}..bJ..JO/.!..R....W;...u@4.......i.B.|K.....&....~0...<8.e.Np....CW?..K._m..8..\...:.z.P..K.9x....PI...1.Kk..@.ErA..AE..3.rM.M..PX..UN.Vl.......'...Rp....l.U...N....9..". =..@.s.X....I..O..4k=&.Z)..2.^..,...1.afu._....P/.e;....b..f-..T.F.Kb...l...........I..B..".iR....Xja)~.O..6..'.v...99...=,..i.z?...{..a..>fO....>.i.t.k.E._I..Z..'............8..'.....|......).....n.d.....7...o&Q).....v.*0..&Ea...%v....g.w...2+D.r..j!..Sbq.`....].b.Xv8.]l./J7}w.=.o'Z..~{|.'Zi..k&.k..`ed.o......~>...#.../......u.NS.......h.n..AY...&....T..B..X..A....7`J...b.K.q..e..'].m....T.98..Y..7../..6XJ.=.I..2.YM...0z5q.+F.....L..rn5P@m.m...xMnb...7..ujr.A.@...5l;.H..iID..?...U`...:?.L....:.y.}Qul.f!.-.....TO%...E4.8...f...%.....?+..{.C.bx.Rj..y.....wI7..4.,]...{..Vby... ..Y....s...6.......l.}v....g4.t.&<..%.3T.|9.[...... Q.j.%W..n.1..=.(.s..`...\6.nu."fXA....+._.F.c.<....~.Ok.^~..A..y.N.l.V.......n..

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Microsoft3DViewer_8wekyb3d8bbwe!Microsoft_Microsoft3DViewer.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8168
                            Entropy (8bit):7.9763843925834355
                            Encrypted:false
                            SSDEEP:192:6u9/gM3pdTKKRvV8+rWszk2n3qgTTxYv53QUQj9+6N:6lMZdTHR99CszN3vOg1pj
                            MD5:1AD3055E830F6B2623CA39FF2C7CB0BF
                            SHA1:DB40EFADDC98A7D06C4605CA5CD0CD2E373CCC71
                            SHA-256:0FAFCBA08EDC225A4A2140197C77D4584C802DA1CE46056D1BC03C6AED0C0138
                            SHA-512:C2C37713CE5685F75FB0B7B0F2BE925D390E5F58CE0D9C18377BE73F8F84809B055CEADC8B87E9E9223050CD4B70CE255F4ADD2DE81A499898D6200852798D99
                            Malicious:false
                            Preview:.Q.8.5.O/...V4O6~...E...~@p:...uQ(.*..t'N.nyT...y...=q.d.3t....C.DoU. I.(..C..b..........d..<..D...*.nI.P........v...n3...[Bt....C.#F.:..g..g].[\...6.....1V..i...-J.'...{.%....u.R..7....(LvP$..2.N#..].a.....T.r.v.....}....&.\fB.......f...L&6. _?..WI....n......5...#..:.Z...j}(.../J..Fl....'.4*nL..<.RS.P.....@....|%E..7...Q...".....^M...F.yq..:[X..:u}U....X....zV"...E%q;.#....4i...\..zq?.:..+&1........p...p^....V....-...k.w.NQW.7K.Cs.......Pg.ue..Oz.#.2Y..b..@mh..\j..{.(.........L.[,i.Y..)..y..TE.p.kC!.S[.o..Ca.D>..;..>.0:.^^....d..X..[..R..}...}L.Fj.....tG./..U..K..Asr...`.kw$..w......J.!....p`..iDJ.=.j../k...g.~'r..aF.@._5...R...>....`7........n...&......[.]....Y......@.b.I........G...)....L.)........{' .Q.MD.C.W=......6..&A.....*...6..VL...h_.5.H.T...d....S..,..{.H=.P.......U....|.......~.:P..,.H.M@.k..W..>..$..(...l).p.D8ss4f..U..~........Q..m.%.U..1..V..L..=4..........k0D.i..@.%.1.\.....*..F....q....*Lj.[....7......u.N..nH.Ui.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_MicrosoftOfficeHub_8wekyb3d8bbwe!Microsoft_MicrosoftOfficeHub.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8169
                            Entropy (8bit):7.975998427361846
                            Encrypted:false
                            SSDEEP:192:1SuVsFyMNVv40PEdKB/5rr762OoqbGp+MXq+to3sgf:1lVsM+prPEdAnWHoqB+Fm8gf
                            MD5:09CD57489D1B6FEFE6AD5D54828074B3
                            SHA1:2BCB8FC724717ACCAA9D52A5CB737B935A77F032
                            SHA-256:83D83C8FE786E0A701EA9E9D31B7DF59CECEC9A9451A09BE5C1AFDDC30281C73
                            SHA-512:375BB78BE25D99BCE89B441D19B7D2CA71953884CDB89ABD2E2DE17A5F6AE867C4EDC8127229384AA99B09B979ACD207EA6A712503671A14DE9670999A49EEC0
                            Malicious:false
                            Preview:.....av..q6..1.....LD..nni...............M..."@.;....F....m.e...@Av...k........J._...h>V.^J.!u..Wd........~.5.....5`...."....&...SJ..,m.E.;...7j.@W...*..8>...|I.o.E....k8..%.PV_.S(.#...s.=.Amh..S...j.dH-v.....RP{......]Fh..(!.t#...+...k...K..]VG.1<.z.O............V....J...HR..9..v.>M.{.2.D....t..4.....0fL......P.Y.`..&...........m.@..%..%E3.Z1S...W.#........%[...."Qa...$K.Z...-P...(....... ..U.z.g.\....{....Q..{(..d..E~..q...G.[./....&.;...._c#.+I...O\T-,..)..j.*.o...5..Vm..&..'.......Q-^.#.......}B '.:..4...f:.ulj........Q!bV.....[.....:.....t.....j.n...........[..'J.5?AJ...E-....?(d.V^.)}}........b..h.)|N....@s.G:..(`,+..U....H...l...T.c.......I...4..=M.[*b1....*#R7s..-.B.......5..*.#..I.l...T.9...{W.v.[i6....~...L.....{?.>..}9..V>d..C....H..?~a.A.o.S.a.Ma...f...b......|.).......A.....8.PDJ..-..T...m..G..e|....)@T>.D..'..VOev...Y6\l..o+...v...D.L....LmL..A../{..!1.bWJ.........}.Z.......w..Nai.Y.(.i.....g.Q.[..Y<.1?...8o.<..R.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_MicrosoftSolitaireCollection_8wekyb3d8bbwe!App.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:PGP Secret Sub-key -
                            Category:dropped
                            Size (bytes):8184
                            Entropy (8bit):7.9754231333762045
                            Encrypted:false
                            SSDEEP:192:VPCBya4Y9MdN7lK8n+jCaIv4MCAsCv5fvruAvYHxtkQHZPA:VPC4ax9c7AMhaWnvhzvex+QHq
                            MD5:20BC447019DB90A4EAA9B1A52936DFB4
                            SHA1:505A377B9A26206A6CD5489A816AAAE8F3A197E9
                            SHA-256:6FDC62060306D554F3D9934A272AA180E64B92E9DEBE58F4313846C3834872EF
                            SHA-512:987760ADE55674FED565B39630E616DB3C55BA2508F89C0A30A0FB899561C5304C3594BB9E84273526E4FC00C1EEA6D9B94F297BF19468E40D052B39FA5968C3
                            Malicious:false
                            Preview:...+.).%l.......cAC+d.6.al......g..n5.f.....l....!>!.......l."..T).7~}.'.V...Bx..U.Wg..[>..GBu9Mv.......b.i.[..m.6....}w ..j:.}.....~|,.%...i1...C.........*...w.\P.ez......*_.....]..5....Y...2{.........f..!k...+.M.A....j".....@V.......;<......;..f.j4P}.hWQ.|.....N.i..q:_....m.?.;...E.....1...*.E~r...;...;..%=.7L.....N_&6..X.T.V^.H...Q......Z.!... ........0..nmW#...%..!b......0A.I2..FK.<..4.!S.{F...m...LB.....4.|..9..g..4..^....6.z..^..X.....H[..C..q-&......sn....Ikp.e...[....|.....[....g*.%...\:T.[8{..X.._Ez....?.n........0Ds1..1.!.Q.y8,..t.....S...B....Dp.{.N0..e......Ui;.!...g.(..n.u.P.f.=j....$...P.G..A.W..E.. X.....S...r.a...0.t.%........<....KFb.1.j1d...Q.....I.>rg...Z[k.a..V..l.i.:cZ5\..>..1..Yh5s..4Zw+..ey....>._.'....lF.k........T....J{..]............0.f..u|....^j.w$<.>...p..(.. ......... .:...O7.#L....Y....y.)3..;./..q=B..E.&..@..Z..r...0...._...-=gc.,.....7.Mc.......B.R....s.....+..u..t.e.|b. ;E.G~!....z.H5..e.t.c.......h..M

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_MicrosoftStickyNotes_8wekyb3d8bbwe!App.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8172
                            Entropy (8bit):7.979133893421614
                            Encrypted:false
                            SSDEEP:192:qNQNynACDgfo6YJqBvDLt5A3jMD/IPh5IbcUs0j5F1MrR1Y:qNiOGAgB7QsIpGwaVMd1Y
                            MD5:BFD8FEA73026064446A3888123D8CECD
                            SHA1:DFD41655C3687D85C6936997EE3DFFC80D850787
                            SHA-256:79C8EE4B9EF45098FAB4412B5046E201FA2985E23ADF954454BE8BD08B579528
                            SHA-512:8ADE6D7DCBF12495EB9CFD55A0B13BA13C10C02F8B44343A56AA061A485196CB503B39EE123E776A4F464B46799484125AA2CD6F468677D40F139C9878E5637A
                            Malicious:false
                            Preview:.k.....c'y}q.T..m..G.........y^.<_.:..i...1f..DH.........Bo..k$.........(.....`.e.d.Ev.-Wn{.C..<.0.....b..{ot.m..U......./.(.......w......A...M..H.J9.......v...+..D.+2,..:.....5..,.P*....ogh`[/.A.*.P..-..Y)?.....q..?.j.k; .a..t..cA.S7$.5.._..#:.<J...?Q./".R..`#...t.*..X..,.a.(_...%m"O.q.2. .#.)..i.eu\N.i{...0.#wEu...8.T.A.X.....+._]....(..........8.|..a5.../5'..,M9.(d..3.[......v...1...<.1...D2. ....I.=......?.s.kN.&T...f!..l.O.T...W.ND..:...dtJ.....=.r.....&7S)............-..(..L......9......3....`...G...Q...t....G.. @U_X...O0....j.....o.R...&..*)~#[.a.!.8.L.E..s...6...%..=...vR>#...;..v.p..'.{.....Z....V.]..L..5..&...!:...l.n......S........M.t;B.Y..D.V1.&.".}./N.b..;.e..K...Yp.H,$..];>G..;w..[..X..'.Db....tR....R.7>....Az.\w....\......a.+...DrT...i..IAXA.L..4..|.q....T....<.b4J3V.g.../.....z.X..J.(..q.......O...........$.I.t...z..DI..^`.2...}.....6*..]}..\.\....]R..3|...f]....../V..S.Lfi....:.....i..E..-vt.....0t ...#..~...C.....H..B1.F.....

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_MixedReality_Portal_8wekyb3d8bbwe!App.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8181
                            Entropy (8bit):7.97302244254053
                            Encrypted:false
                            SSDEEP:192:yfpYLUbSbN5qTWHnXvS5pix80fTk9Wjru1c/d4:IpY5aiHfS8++Q9Wqc/d4
                            MD5:38415C066784873E731F59447C1937DD
                            SHA1:87B7DADFF3C390569B46DBF319D5CAC5D8335608
                            SHA-256:1E5B5DB211612CDF040A0DC4C18E8B54F20B4204C72069136A2D30FED1F78B8A
                            SHA-512:C2CEE98513A420FDF33C2ECC08C4B93C350932E2C4C6F9E0D813168958ED70648B0CDCCB62938EBDAEFE1CD58DACED819447EF4730ADA068207974F39A0D7F7D
                            Malicious:false
                            Preview:.-...4.Y...D.....N&\G..8nC.h...S....z..e......v..d..W..2..tFL/K.$.M.^.........1(._.bi..........W.<..h..|....[.N.q..H.p!$[..|...I\>......,...`L.$..:..]..D.8...%.e...SL_.....N.F.5.....&')\/..M{...0.L.(yL..K.E..4z..G..E..0z>.......f(.+..C5.^[.D:j......(...V.<C..."+....unGky.t.xG.T.O....y..Q.36....7`~"..w.t.....NB..F.p.|tc.......M....................j..l...s.. ....B....d.. _...J.f.I/.E....kJG........rc...._.p?!.|.pzW....U..Ge.p...*..z.G..d^7t....!EPl.%..z.v+...b..c...I...E.....<'....[t=>.}I/...F.@.2o.Yx].HN<..Q_..%.2....n".T.4..d.+7. 9].gy$.E.._.w0..Fg......r...W..&.c.c.......;I.kC..h.b.....H.W.q..PG t\1Q:^W..tH..m.....Z..%.g.&..[..3'-'..gr.v..-)p..09..4..$sE..=k......P.p...f<X..-X~uH|.P..Dv..sKZ..5.sr,...........$X3...u@7O..V......-'.t\YY......C..v^}n......xR$...%..<..0>..GG.....>......0y...y..?.s.r..R......W.=.7.G.ET/..h.@.P,.0M..].p...../I...s..z....U,..et.h..h..0....4<l..+...zT....o.Rm.......v...CE.<C.L..`..W......f`....a{....Z~..S.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_DATABASECOMPARE_EXE_15.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37289
                            Entropy (8bit):7.995583293339484
                            Encrypted:true
                            SSDEEP:768:6anRhH3PIKbL3N/rOSlOMcyuopgw2Swufp0/rNUdZpKh:NRhJLzlVBVptnwe0/rj
                            MD5:516C6248C8F791785096EEE9A755E9DC
                            SHA1:57BF7BACC97D2EE3FEF090B3E79EF40EFC571C06
                            SHA-256:E923710E0CEB1341138E516CEB9D5A035BFB7BBB2B110EFAA9AAF4AB3EA9A8B3
                            SHA-512:37A6BB264927516355A21204D2A43FB9762E03108666EFDCC1F4D6F51D6326A17F8089889208D59E93F07DC4767861ACD5DD00D30A092E76EF6905ACA3EBB3A3
                            Malicious:true
                            Preview:h.....8..&...MG...)o.....(...8Mw.5.......t.C.....n..........].i.N...b".....w.....%xL...0.Lcy.^C\.Gtii..K##......-{..^.M.m*x.g............)Zt.........1..W..o?pk..o...y../.<q..).......^.e.O.."........B.a.5.6.....S..?Ig.&.L..NE-).H._.v....?.. .5\.])....9..H.1........S.T7q*?g.x@#.....P...g....a.h..;.\..........B+{..:......6.<).f....&..8.I..H..M...I...o....]........u.$C..0....."U...........v..1.g..!I<. ;m..*.Y....!.p=BH....F.]_.'....d.u.`s..:..|'&.,.....#9....r..J,.m..Ax2......%.....#......g...].&....<....I'u.B......R+.....X....a.)5.T..?.h].5.u7z0.2a.."*aJ5.r...~..p.N..}#?L.....baD..7.....x...l.IJ..;O...Kj....%..V....EP....U..b.tM.....7.$n.h.Iw.)......P...zaw......p..I.a.o.S#.......S....[..Z.....e3TW...h....@..r.....9....P.......v.~]..q...`T..a#(b.[......m3..!.;....,\...*..C..L..m..]~.q.7...7..lj..<.B....\e.e.....F.S..%..X.g...2]..q...C....~..R&.7.X.u...%1....9A....Y...(x.L..)..ch8VT..HhV.L.'PU\..lO...!.h./.\...O..I..^Hp...`.jH...h.D......h@y.....Go{.6x

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_EXCEL_EXE_15.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37275
                            Entropy (8bit):7.995110595731649
                            Encrypted:true
                            SSDEEP:768:8NHQmHbdS6eMFqWf/hTor4ZuZeSFOPNT3fjpSSvus+qVco72bFp9:EQmHXeMt/D2eSFUNT3rRr2hb
                            MD5:1F7E3B74346AC569A6E3179CDF837399
                            SHA1:21C457BF3DCC412057388416912D79D87A9978E3
                            SHA-256:7C7359F3C081196DB22B5ECB677D43D48849C84E3CB25D83B83E63B57DE64505
                            SHA-512:41085CDC896E306E6482E88C1D7C31530B3D000C7D8AA34A034E77DA8D00775BA85542A8FBA3F33FB23F9AC0104E52EA70D6225F1571B4FF567C6D5A7C8F0E25
                            Malicious:true
                            Preview:.....^...7F.~.....U.s...L..M.....,...n.E.k...al.K9.....2m.. ..),.eq.....v..oW.=.v..|.Q.."...`.w..P..9...Cj1Hj.......5..o.TK.!...3.Q.FY..m%SU....|.gt.J_/.'...../.W4f ..F.X.......wv.....Cy.w..eU..".r.KT.".k..".d ..?.I..>.rGO...v.;......~..;..."..!...|...f....5V..%.....%.Wp..8....T...v...t.V99..J.qR.....JS-k.>.C^..AD..d~..:..D.c0.....8....~.'...I!....B...k.{...i.D..>..Y..Y6..'.qe{E.p..j...'L|..kg(%....>.4..<*.m/.t..,..4..~=..K-ev.B)..P.?.X..];.(.T~su.........x<1).x..dC/..b.+.Le^..FS...~v....q..q0...s.k.3)G..iA...be.e...b,..xm.xKW.....Lx.;C.2..5.4......7.F..^Tw...]..X..[d[z.5Xe$.wa./.;&..D.>UA...N"]...I_....^..E...=.Z.Fu..=x.h.[.B.@.m`.~....UR......f^_..K.>.`+..=.J...d..{. r3...h.x....n_.....)...I.....e...#|s.Wj ;[ .M<......C%.:..R..%..S.a..c..Z....Wt..n.lM...vb.>}..Sy..].h^fW-.u.l.......4.....M.).qi.Q.....c..!.uk......'.E.<.sQ..[jI,...(....(o...j p.R..A.p,..L..4...... ".m4Tk.OL..p...K..A.....P.Y.|..vp......$*.+s.4l..5UK..%#..YX.m...8

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_MSACCESS_EXE_15.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37281
                            Entropy (8bit):7.995462563808581
                            Encrypted:true
                            SSDEEP:768:sj0pvzZbgMxMb36EoDMLfgbh8bE32LYxirWjMbQj9W+Zk4WNrG9HujOUJd:OSsMxu6iLuCIT/jelKb8
                            MD5:1AB9E15E737FD770AC4A5959CFD71FE6
                            SHA1:5024EC604783D7007D0CC28377E47F403E82A5F1
                            SHA-256:8D19AC5AE965306665BEF2805E7A0C86BC25CD97480A48531E7AE568EED1EFD0
                            SHA-512:08593337C675E9630EB68C71885714F16AE4515972A73D1E4DB811BAC62911174E3505EC0DCA3284D6EB35E2100534D5CE300BD92B3932B0FE349B453C5B618C
                            Malicious:true
                            Preview:%..../'"o.j..v... .SPB.....W..[.%.[.:..`.....TR.&*....S...[........,.H.H....?]...^....q.F...".0,L...m......u... J..5.....|{L...s_...-..K.HA..{.Q.......r.O..<../.>......h;b.+...v....T.D..X..2t. >...-W.m.M....Eh...........]H...Q../..e.&@q.d.\.4.?d..V..|..G..p...W].j>SG....#...Qy.jj..g. 5f..N.G'.^.W......Q&..^<........|.U.a..?.r..cw...d<H.$.gk1....<...5E;Q...<......I.4.MLU.5.f.9..+.4H.....Re6N..]...&...Rp..4...g..D..#.L>.j...+...h.`o....@.}}..$[....'..r.....v.b...W.j.7Hk.6M..p...V.v.`p....[..;w ;UP..$.....M.{......|;.4.3.im..?i...P.m1q.".....1......5..T...;z....Z..!%.?L'H.".(V..t.}|.(<.N.c........"fb.k.....?.('Zs.E.....eI1..#.....=C.0.w%....4....8....e.3..m...I.sp..k.*...wN[w.......E.ss\.......%,~....j.nw.].G....9.lC.....IS..Ji../...t.....Jb.p.`_...P.....^|{8?..6n .3.[.`.O.......n.......g..k3@..@..,..k......51+.v[C..Y..;..vi..Q.?h.e...S.96......L.|.$.P.P.T.q..+.c.:t..].Q.....=z.....?.G........[....t..AH?<D.Y...........>......N.&..Y#.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_MSPUB_EXE_15.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37279
                            Entropy (8bit):7.99464541573792
                            Encrypted:true
                            SSDEEP:768:YDeLQa1iiI0kzbixyD2cqPWjDr8WDaHdS7QnclzwtBzC6S4qZVRrR:UtanXkX6W/lDaHdS7lUtBzC6S4qZ7rR
                            MD5:1EB006167043DC2D9AD50FAC0BF9C8EE
                            SHA1:5E01B08CA6B835F29943E9A451813E7F3AFCD9E5
                            SHA-256:0FCA8D44CFB19940FBFB21F53C000FAE382FB56D6482EACFC00E1F7AEEA2CF2B
                            SHA-512:E5702B95E2AA79BB9E9647C3F213441A19A1708F1D9E653C6997E8B91575B262AC8FF04502A8CA46F8670F5F4489F8BAA57C30CE980EC3E144DC822968C2062F
                            Malicious:true
                            Preview:. 9..z.X.i..M...5.[.....c........2(.X=...D.......OMYJ...70.F.B......q.)..P...7?.b\...]...M1.J.....Po.{&....O.Q..0..Qg.K.......E.....r'.4.3.7..8&........V.....un5w...6.mHL.(..p.D....,..d..G...P.d......ey6...........W.Ey@...{:.rIb....n..yl^..<Q.........,|.l(..H...a....s...k.....PL..S.Q.........$........].6...=.].{/..3....X5.M7..KBT.*.*Y...|..H.(.T...x.D...a..:.0o*..t/..<..R...9:(_.....~..J.#..u+i..S|............-._+z{.@...j...=v..8WZ.r.b.....M.<.L.B...R.n;..`p..:l...,..W....{.qiX:.`.Xx-/.5.c..-.....x.Y..V.....+..}!...=.Ra.....k....K..(.W.....d....b...:Z..T..I,..(.....WjGH...r....i.vY..z.z...B4J...+v.X....m...YK.#xJTN........5.v.fe_ug.;j...#....C..:.+}.a.Fz.....Jt),...".....wf.......sW...+D..%.,...B.:..v=.x..U.N.....j......V.w.e.m..{...r.2....H...'.M......*.....`.%.....".....C..M...A.&...o.${..D.....J.H^|....,.2...&.i4..J.BsE....._e.I..u.u/.Tks\......M...>....B.....?./.\.6!.M:..Ags/.......r./.....ER.......q..........l!..A(%.m....j....X:....%

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_ONENOTE_EXE_15.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:OpenPGP Public Key
                            Category:dropped
                            Size (bytes):37277
                            Entropy (8bit):7.99577592478947
                            Encrypted:true
                            SSDEEP:768:vdj/kxLYn5gSFfhwfgI/SGVkudV6jhBTleOLJqvZm:FrkxLWZcP6bun6jrEOMM
                            MD5:0E57864DEF8F012C7FDCC917155A4DC5
                            SHA1:92398D81F5A8196E0DD07D4CBB917F1B5C426B8D
                            SHA-256:DC92F363ACA92A8BDC5B699CF7A9F43018D5962ECDC152154534B48A5F87E193
                            SHA-512:710B0A6BE89DF16E79B25D71594973554EEAACF2F6EB06256957D0D4907316B9E639FEE40DE2F212B07ACEA55C7B6B9F1752164A4776B167D8BB51B1EB4EA62E
                            Malicious:true
                            Preview:.M`Q..`..... .7.o...%.O.V.;../.t.g.l.:D..;.....9-K.......A.t.q.&./...~G.......y.@@.X.8......p.}_.....=oS..%...O....:......y....Mj..q......"..V6..t.....Ks.......q....^........zX.(T!.aK.......k...'r...../..v9..7...R..B.W.8Kc.Z.q.N.....C#..//...@.#XcU.. _..P.7.T.h...}:J.-.../L.c ...h......'....#....&1...^ZQ0.B@c...>.)<.p.y.D.^#...z......-]...El.g.JU.n....hQ.Q...v.s...}.Tfq....><.U.:m..]k.N...u..}....4.N&i.?..[..j.Q>...1k....i?....+hg.A...@...(5...gx.g........+..z...../...U..3....X..g.....#i......a.....\..,k9w.G....3K.....%......Q.o:-...I.s.+j.o.hw...AT.......aC.4(....N.o....G.8_i...^....;..cG.0........o....Z[.).T~.EO.4..y.X....R.....D.p..['....;^|T.,+....w*...?.%....\...8.W..d.N.Y..,.B.._s..d.....W..b.{_P.*N...1......w4......E;..%[Gn...*U..._..!...........*qL..M........W.........Q.e..D......@.P.R29 c<.1..!.C.Zf`S.{....gv.*.......slO:@...9$..}..$yl.....u..t7b.."f2.o..g..1.....j./5..U...k?<..).*...0.....k...].,...S(.. .&.....^.D5m..

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_OUTLOOK_EXE_15.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37280
                            Entropy (8bit):7.994530979049729
                            Encrypted:true
                            SSDEEP:768:QJx3uFrX+dDcYGHcDLa2Jr0CLTMAqIUndk+yGEOeHZjQELxJoiCEaDtGE:gKrwDFGH2La2Jr0ud6k+yGEOeWQrotEg
                            MD5:EB37BB05B0FA17C7DE2C00458CEB61B2
                            SHA1:78CC19620B19A8A8E9E22EE71D86E0F3C96DF926
                            SHA-256:3FBB9933F707293AA901BCFC19BF3753584AB144C5D81B4354766EF164E34E79
                            SHA-512:2153CE272ED0945D59C0A8BD30ED854E7133C2C83045C09D711A6433CEECBCBE25924242A857200109BD05E31D23567B44C8E0F2A99A843E15E1368586020248
                            Malicious:true
                            Preview:N.Q..<...b.%......s..Pn..F....1p.r..T...'B|..xI.Op....2h(... ..[..0..:..2.Mtc.....i$.H....C.b(2[...lF.>.....rj9C.gw...`E)e.m.j.*o.`.....:..Y.;.Yov=BA..F.O...k1..8\I...@q*.c2(.......M....c..m...#..!......6D~i.B....r..D.....yFK....-]..z.....V.....uPG.M!9,.lE........3k1:D..~...)..M..U.K^%..>.5.(.......d'qc!.{..C2.`-...'Q./~`8...s.V..2..!\`I~....w.W0.r.4(....hi7HY.....A._....B ..oN.E..fb..@b=7.f.\.b*m=...C.......Q..'.LU.*....ljx.W...y....Dv.S.[X.S.V.8..C.$*....$w.....1;Y..C.H..&.....^.7FQ.A...........X..d.4-.7.x..Sw.\.IG.\h......5.77...8.|J.DN.lh..2.\.=s2.I._.....A....l.z..K..~..hNER..w....K......v4...Y...A...l.EU..WE..{^..7(...&...1M#.."...r...p6......P..tz#.7.....}j..A...3.X.I...m...*...v.....2....E..mIA.g+..E_.........<..|...0..I.8h........dO.IW`..hr.C..~[..Z..v.)...[\...l%.....xI fO-.._...../.-.I.a}v\_n(hA.[...h....=..m........<.%..Z:+Xy[.*.z..rE....s.U..4..fd9..^w.s.9....[q.....9...O]...G..q..6......)..*J...Z.W.4.....0o..0.Y}....$..W.0

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_OcPubMgr_exe_15.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37280
                            Entropy (8bit):7.995684190682809
                            Encrypted:true
                            SSDEEP:768:KS0Z5+pAF5ZwW4/CQf+djmgDqpP40prAzaIvRTxGEIiEvtpy:kZopAF5a1CMyJDJ0prAzT983vS
                            MD5:6117DE723762777AE8952B770BF82584
                            SHA1:24821F0C5AFF1D8140085CF410647E75758C4671
                            SHA-256:7F24C0FD08F10F463BCB57E75154E92C879AAFF8766B848C3FF7332AE4269847
                            SHA-512:A55A10BD4EF0862BD95B8A0017616E4F7DB4B9E2F32ED4D6CCED298BCAE2F84EFBFF0E0CA3CAFE76261918E3410630528F27861C234A06DDC991BE18484C180A
                            Malicious:true
                            Preview:w;7..._....)!$.+......-n.p.:..w[..9.....e..2*......'.....8..5\.&K.....g..X+...8\.&p../]0.<..V...0u?..Iz)....,.>..M.!TU..eh=x0V..i..,\j.R.)......).{{|.LI....E.Ik.(.a..z.>.R.u...J...|].k...$|...p....l...vW~....Z.It..h.........\.7...i`V7.h3.c..z.M...0...i._.j%.._........u..G.u.._f....m..U.e{..N.!&..VU..p~.B..nv....'2_..I,...M.T....._A.,.:.%.f.....H.....jdM.g~ch*win).Y.`.......[......`..d...M@.~?..Vc.}.ooZS.....K..O<.Y.$..vwc]....DF$.K.XD %..".['.a.7H1.!i...(V.t.........:............4....4.(.<..hh.*z.q....M.kV}!K*.B.-I....X._+}M.<..$.3....bP..K^...{.Km.I^.K.....i ...Px.F$....e...jU..0).7......_...d&.|......W...).9..]..&....h...i.}..g.'...T...X.'.....P#/...{.....{...OkO).{.':;.U.a....4.~.~...t.......;|A.F....|...,......r&g_`W3U.nS..T..R.W(.|`.$...I$.......K......{.m.1..........c....W.9...r...mE|..=.W.eb.C1..D.....db..1>.....P..#F}&f.b,...\...q.(...'......._hnB.O..5...C.X&L.........T..o....8.z...\.p........F.<Lp...TL7.p0H...-\.9...m.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_OneNote_8wekyb3d8bbwe!microsoft_onenoteim.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8178
                            Entropy (8bit):7.978057181769128
                            Encrypted:false
                            SSDEEP:192:pUtx1hZIwaReq2/QRTIkdlshGCnx21sTJx9OBKN00V8PO:iVhQeq24R0hGCngmNx9OBT0VyO
                            MD5:FC10B840CEE0EA4CEDD735E284825539
                            SHA1:0AE73C009816053B25FDC593BC0D9800D832AAB6
                            SHA-256:3824807737C736E2EC55682601F8988ABFDF1EABCF8E37B2B708EF057F7EF274
                            SHA-512:EF74B84692328A8552571E2F6662D281AD24C564E37ED71145B37B7F9D7965E3C847561BFFAA88C4CF7D96DF2A3F2E11BA6D33CE22B8C1CF066981D84EFB4A31
                            Malicious:false
                            Preview:a..........'q`.)..............].E>7..N.S.?.n...Q..s....a..;h-9..`.:8......{k..]....+ ...$...r....l2..?.Bd,JI.i...lm.,.'.H@.....n.*.jl.X8.....^...(b...<..k.[az.|.q.{q...&.`.....=Q`.s./..........].......lOf.C.....P.9..../f......ZI...I<..........u........y...>.....jI.....t..~&....G..V...uc......r#...|..#....O...V....Y.....v.h.$....m.H.bX.)...i&=Exa.K....p<.J.[.G.duo...L<X_U4......^..H.z$<..U..9..Yd.....}f.s..?..,...Z|.......N5.-.M5=..M..............p..S......G.}:._..M..X.(.F......].r.<..cS0...x.Bpl.1.Q...3.H.G.O5.xdQ.S="......B.L........1...r....(.Hr..&5.|...I......:A..T.8@..Q..H... >.W.e!.:[..5..KuN..f.....'y....k..d..e/!hoQ..0.zQ...G~..(Z..#N....y.]5]Q..@....K....^.....D|.Q~..QK....J(..t.r%....z\.N...}...E6.Z...&..O.....2;E...."...]....e.xo.Y\b..sX...(.E.R..z;.i!2..".K.U\..(C.........}.P....+..0"6..27ev...!...n.T.].!..re.8...H\...GE....r..k..(.o...!...t.t.....)..H.e A...V fdNzfW;...M...X...s.........P.....52...f."..>.#J^:.I..s+

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_POWERPNT_EXE_15.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37282
                            Entropy (8bit):7.99540409773294
                            Encrypted:true
                            SSDEEP:768:TodFYbO1qHx5ebiAVm2TiXPVIxkLudKN7xs0qzv2ziV72WU:kdFNO5UDE2kNIkN760LziV72WU
                            MD5:2881C0E9221004A3B9B28C5CDE48672A
                            SHA1:D9D99A1F693F46F010349ED74BEFEE1C2CC20E11
                            SHA-256:ADBFD13CDA26BD1AB2D3AD0F966B58B47E4C7836E5AFA3425F22F89DE4D37C97
                            SHA-512:5337E1D929B4123C08C7C957D228D969BB9A1A77157ED5C37329025D61A93E62B923CEC64B94FCEC1CE72D4F9B816CE04AAF2DF49DD045E2503A34AAFC5E2532
                            Malicious:true
                            Preview:.-.....b...0&.P.7C.Y.i. ...Q?......T.u...1!S....!Y..o..!.1..f..}.T...'6,....$.).M..@H(..4.^...&j.=\k.eZ.$...,..'..Mj8..dKx....\.L....'@...)K.:.l.Lo....cz.i@\t......?;.=\.TC...An#.D.Z.9a%..7.,g'e...H..Qe{.n]......[M9..:D...........r.v.#..3.z.n(..Qp.,.#.q.....^...H..i~.&WF.."+$...*}.Wu....7zM....B.O..O...kI.Z.O..m.\|l.E.......YF...Q):<.}b...oEe>.;...V.P../....^z...k....[`..$.^.|HK...-..Jow....R.fS..Kx...X+g0.S..........(...I..w.Pn.p.X.........:)..4...2.2..6................q.c..3... .dH.....m...s.....]@..y.6......$.K.(N......%-..l..).#.Q..D../i9.....=...L..^..._.:{wi...Z.W!..W.Y!.R..[.;.T.......l...n-U.A..V..c.;....Y..`...v...9.N2.%^..a~....'.?IW=s..t....D."1[....5Z....*.#VLe0.......2+.....B.<......aoIq.N...7..C...u.[V.......s.h..3|.z...........U...d.o#..@d....;T.k"5..a.I9.4C.,q-.gv...O......@.$d>L...."...a...L...wC.u..q~mG...A.Z:].3.Rh........]. ..'.0..).1.eU.W.O$.[.......9..........K......g.CU.82>.........yN.=...'..N4p...eo....U.*g'.P..

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37283
                            Entropy (8bit):7.994531661183095
                            Encrypted:true
                            SSDEEP:768:Ke8fmu9LRCg1XwhuRXKSjZiaxxcD3HhgyyJ9ce:Ke8fXVtK+ZfxxcDyywOe
                            MD5:B92B33E2B28DEA6390BB831DB8054167
                            SHA1:0F371DB144A91DE5CB81E42D4CB6E2C6BAB30151
                            SHA-256:179B8E2D3F0AC8EDB11AC5C0D77FA80CEA8FD24DEC855A962B1122757A5D5D4F
                            SHA-512:AFC88ADABC8893853DE6656167C0AF388CA94F41F37659DA01CA1C1EC778CF511591093EFF7A3647DFDE7E2A39CACAF6A89F3A38C1C9114421E9A019D5BBDEB0
                            Malicious:true
                            Preview:.\...p.7.....q..g|..................cRq.T...E..../x..\.x..V..^..>fM.5.....j...h...._B.t....M...v.......][4._...."..Z...3.k..\.j.}.../IY)'@.q...\Zi.........7.[.[..........a.9.R...&hYx.d..0f......[..f.......6.U..w4i...].P...6.n..qt..I^.....pp{cf.;.a..!.0.:2..........g.... ...4.(.y..a0.....+....K..n.n....a.B...%2.(>o4wa.[. .k.7.PD..s".R...y1+B?......V.p..".....H{....i...].:...`bx...\.f........;|..{peH.9Z.e]{.._.8.-..H....^..y.,...!......X.<..$..2|.)..N.....$.OL...r:Y..l.9.EE....0.Ak.B.P...:o.....k.......7.....Tv...YK3.....9..K....E....K..a.....|...h.}.V......7......].....`t...:j.........9.Zo.$.o.7....X.8.J...1X..W..d...<J_..gI.)..O...... ?..Rg..&J..=4..#/.#.G.,.G...$.....A{.prd....O...K.bw...{:r...$.!y../..'.Ut.T.W..7.sXc.rW,..(...py...,'..i......a..=._.cf.'.B..EZ:........r.$...vv.g.......l.%I....".v...y.j.u..[?.S..........Is.d..E....".........]....nW...\Q{..QL.cEy.........yJ.4xf.....(...&......?t...2%V.;....q.....a#.|..k.....nsk.'..q|.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SPREADSHEETCOMPARE_EXE_15.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37295
                            Entropy (8bit):7.994871911185563
                            Encrypted:true
                            SSDEEP:384:lBiNWiOkU5Fg2bWv8RiGDxTVaE3gPYpPnxaI5RCB8z83NJ1ifph43/Ctdof2TYh7:lrvkUL/GQVaGcYFnkgkiQsaPMz+vzP7b
                            MD5:84668EB0075500E7AE58D72FAC84C954
                            SHA1:328A9239851F464438AA58EAB685EFCC16DE56C3
                            SHA-256:97216A3E7D266105BA294170BF1C1758609FDD2FF8779C1D535CD966C45C3F41
                            SHA-512:F8C1EF6EB1E02EC8CAD271A95771F349C949C0BF4A2FD9A60DCB7BDC94F6434F3D1E0255591C01422727152A3F9C3C8411CA97E35E3A33E26D4C77C1C787CE57
                            Malicious:true
                            Preview:......R.{......=.......s.)..]....4....O...p..}..q.C...x._.9..(H..>.b=....;..].'I..Y..[*.M.E3;.........@........h....w...D..A~.!Z.+:w.#6".x...gnFl.d.....V."...V..i.D..G......\_F.......v<.Y..X...}.......N.H......D..'l?..v..y.C...~..\+.G..ui...8l...e)B..zi.K'..Jx0.R..~V.R.-.A.............iJ..f+..*..9r.w.1f.r. .|E........K.~......F.....{..[....]S......1E....."w.mf..=Y`.bWn.....`j...2..5..je..%,...z.r.a.s~..+.....@.#...kk.$.M..]........1..[..$>..(.T.a.....;+i.0.(X.%78m.D#..A*mN.....y..D:..\...@I[...o.0.C..F.ex.D.2.Y#.*D)i...Z.6.b.I..A}.5..#.......m.Z.-...8....p..-.B.z.....B.w.....t.,...U........"..@5.#Z....x....i9.B.nh.r..;k&..^MJ...>..*@O.$..L~dB.....J...f.X%...........Bi0..PL)]..<U..+?/<:%..Gb.Fgu..y.b&.......s.....'..jC.pu.....S.#C+...d.f....k...Fv.. ..FSZ.0u.C ..m.c!...x.%..w......e+.$.....L...e)?LM..V._.F..X.U.*N.E....R.,...3.8..B.%|..obvp^..a".666...K._?.,\......Z=....;.).s......>o..m.Y../&Lh>..@p.~..]....N34.DC..6]..N...].8_.Xo..6.j.bF.^$C.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_WINWORD_EXE_15.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37281
                            Entropy (8bit):7.995302249719624
                            Encrypted:true
                            SSDEEP:768:gsF406lpgn0A0+QopXHRWSBp5o8uMGjI+HqPwb4R:zFn480Sx3BpFuMGWCM
                            MD5:F8677E0A4E65832F5CB16E5A091669D7
                            SHA1:428465A8EFCF911BD0DDF9C54C855BBDDAF64634
                            SHA-256:FAA23474BCA7D1276EA1D0040F5214268A5A83C0EEA615C3E003A8B273CAEAFB
                            SHA-512:5F8455FF25B39EC90B6455525C61C3CCFC1F9D8F4414CC357BF3A312CAF648949C4779F391490645C8A3BC54AEA86F45B63253BEE1FA1963011F7F01AA401EE3
                            Malicious:true
                            Preview:N.....N...3@....I....t.......v.*T...i|U_.{iM...N.M...*.....A./l...@..W@."./....#..c.jY...\.#{.z..{.<=C..7.......y........E7f0I)...'.*.b....Vl@.-......0|.>.m8.(9....)..Y}3^..Q..R.......k....w.\.#..........V..M.$..,.+.f]...#8-5.t~.Xp... ..t...dr~.].......50...7-@[..5|....3....7...._..m....w. ..U.........G.Ly.L}.`.C.;.}$n.E...{$.....31.J...).m.Y...'4.h.[^......s+.."T.......(......P.w.K.....z.1..R.85..=F...m4-6O.'.\p)m..C...v.W...Y..Mc.QB..[.......j. !v.s...9..&....IV.Dl.9.=.K.."..M..P......$...z...|..Z......,...$...^is......=.U....7.....I..|;...}..0...B..R...:..`....*.;.d..>../$Y....6.\.<..}..rD...e...5...^.N.C.:.'....v_.....-...5.....C....N.....!.Q..........[C........n*..?..n...k.J.Lc.0.......NIX.JD..UG...N..i.[.~..LLb.u........././..H...?..]..........{...mS..,o.v..c~.d.E^...:..?.0...1..s.PG.H}l...$.X...j.!.Qb.d..}....5.....2n`VS.3Q.V*+%S..%.:.d...K.c....ru.,:0}.....UBb....I..;Y.|...5...m.TW1S.i.-.....q$}....p........{.S.(..=I....PW...v.%g`

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_lync_exe_15.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37275
                            Entropy (8bit):7.9958220078203075
                            Encrypted:true
                            SSDEEP:768:LM6Rcte/MWq28lgdxwV6RG3+l8XLRUjz8gwjavyFMmJQ91/3jwwLiv:Y6Rco/ML28lQRG3+l2NM3qQxjLL4
                            MD5:3EFA82796F177B031E876995561E863F
                            SHA1:5A746A1B8EBE62BD1AFAB350B4A5D50800D44E4D
                            SHA-256:E9D61AB58152D112B145075A1B812E2590C6EF728902E53274CE72E7FC513A8B
                            SHA-512:86124909CA631C307D3D29A6D6DE15A12EA5E88FCB66889EC0A034F55DC527BAC8B299DDEFFD738EB305EFF8033A35B64EC0CEE45F05054361233CC7936CCECF
                            Malicious:true
                            Preview:S......P..-vi].g......3.v...#...M.3.N.L*i../..&..;Sbs..x...+..mKi"..5...rM_..7..?.f..q}T.[.....R...^.mA.P..z.<t@@.s....R...U..G....I.........../GlJcM..&.......;..#..S..j!T.."...J.G9^..L....+D.L..;..D....[.<..Q....-..X...j8G.....8.......|..1V!...|i..[.]...G....>..p....m...Y_3*.B@".7LLF..................S8.A..4a..... .Rm..5.~....G}JG.=..`..?Ff...w.T#.%i...D...d..:FiH....W.X.<..Nn.@i'.I..K..j*.....m..D.Q..!v:..>,. |...wN..z.L.rY.Z.v=.c...l./=a!xR<.......c..7/..w..S\\........}`JR...H..9..(.->S....Hu@.....Z....P..(.G'.<G"...)....9...x..s.....{7.(.NRF.......%;EkmQ!..].~..T.*..J.v.@~..@oK...i..I.l:g..m.A.....&..b.y@.0.k.@y]C.._5....]..c.W...&..l.&):{V..I....5..U.^1x...........eh..o..D..Gr...I.B%.....j.z...Co.....oG......u...2b..`.Q...>k...../.."s3...._.w${|......I.hd...E..go...>4..r;.raf6.......=Hr....^>6..!...6......gR.~...).n...53..a......d..4`.})..r."RV'....!!......W..:.H,b.T..!]....=...Y....B....EK.k+2ej...H...f.....G$......,Bc(&z.j

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_msoev_exe_15.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37274
                            Entropy (8bit):7.994801042868548
                            Encrypted:true
                            SSDEEP:768:0p9xlOeGGZZiC51deKa63+h1pdqEB6WCj9QqQ935PywIBx:+UeGs53HKLkE/89ZQ+wIBx
                            MD5:788952B3285361040B47635997AEB217
                            SHA1:B1AB63EB1B017D930BDC347C8E370DFEF94F1969
                            SHA-256:BBED69569EFADB4C221054B2F184FB1518BD2E604C0552FFEA54B54D089512AB
                            SHA-512:44F00278DC6E4D52163556270AD1EF47829311C0063FFFC75F6F8223F9E95F9BC3E1CF03358538CCF8BDD5B06FA84EDF70FFBC04B443612AFA29C0FF8D07E6BB
                            Malicious:true
                            Preview:..!\..E..@.p..at....$.G0...{=..(..A..{.i.....n..&.h{..?.Q.....Q.xM._.d.KK.....&@.&..5<...........[...f.-`..#...j.l.V./b....Kc.m.F..rY..]J........r<....h..ww.|.[.B.9N.U~.....cdq.S..q....Y.D.p.\.4.'...G........;.1.zKU.U.X..Q."...l>....aH...!.dz.fS.......Qm#....,8.......$.o..cL..2E.v.....t...\.W.a.xz..L...xh*M.q.8.1.qG..........EO...#B....Y..{.e..8W.&....:.l..Q..ofG~M.VP.8....#.....S.0.l>...+.......`.25C..%G;.V...$k..X.F..k>....5N.g.).X.5.U.....s..`9.`Z.:OpGw...b..CE...Ki7^[..... ..gd...S<V.. ._.yy..Z.R.4.N..R..5ci"1.0..@.D5z.>.*...A...O......V..n...I+...Y:.W...2.....v...o.....g.....+_...ynk.*..!..t...b...d...U..u^.x.JT.;7.yf..ic+!....:..-]#..0..(..........u.'.+..KD..A...X.S0?B.4..5.>\...TxT.k^$oA.h`u...?..v..ba..^owh&%Js.[.-.O.`:~..?L.\..@..H..e..+[.vJ|.....B7....3........q....B..H\.....UE......m..j.9....L..U.2..Q.,..D.2F...#...M.......;~D......n8.x. ....MY5(2....4...bhfn........[s..%...8...s;I......v..._Sz.a.mvW.lAv..J.....Z.7.x'..l..Z

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_People_8wekyb3d8bbwe!x4c7a3b7dy2188y46d4ya362y19ac5a5805e5x.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8210
                            Entropy (8bit):7.973842976027157
                            Encrypted:false
                            SSDEEP:192:5HlgUpbazQFMPOx6nsTn7G634NdgzdGtHH4QoEMV23yGrv:5H/9QsT7r31zdiHH1ovYP
                            MD5:5E4160D5C8C77544EEE3E74D73027ADB
                            SHA1:052E34F16230759379B6B6505A635D652B3815FD
                            SHA-256:D1C2CBA18F733D7194CE964D2C6A5422468673C2FE4C90F1E53B48F48E1013DD
                            SHA-512:08FD74703EF9308CBDCCF2B88325B56D0674D51023A3B11833AAC2A32DBD12D20F70386FD7FC80860A54F7B576B06E013F6969EB533E5F66248181416FB2459C
                            Malicious:false
                            Preview:.j1EN.c.........5T.........t.y<.w+..._.A..]{..S.....Y....d...n;J`....1..r..|..G.E..,(....?...M...i.d.Kab..nM.:.Ah..v...\uR......6...*.J........#'S.....u.G...m..N...s.......T.B.>5.......|h.f...q...|.Gg.>K.A..FrL2...M."9..Mup>.<...O..e......Xk.*...u9G.H....V...t2...{.\......p3.;c.pK...5.CC.6VpM...y....;Y.b.<.F..M..jt..9."(.s#... ...3....(..h....(..6...=....>.R..6...Q.HR.......x..=./..+2:x....v{{.).<8.%..A:..O......o......?.B..z(.K.Q...~....t#jX...*4.a:."..}S;........0Z[.......;.....P..1.^..B.C.Q.,u.........r....M..H:.....7k$.../.F.h.o.....!...6..@..(..h....bI....2.<7..H..M.^R.@.......t0.g.HV.4....r).+..0....tt4..z...FH.7......\..mr.h.+....|J%..E.,.q.I..7.s..IET...&.?....X.........u...*2.v%N.e.......f..7t*]....GZ..=?[.z.S....g.$.|......^....B......F.`.[aJ..H.]n.Tr.RH..h....umO. ........>..1..,.d`.o.......w..@..g|...F.....0s.....XZ..sp.....F....7.a.p.h.%XtF23..5....U.&....kQ]..k....M.8..D....;.>"..tH.k.O.*.....PW.%HT../...~,....+X:sb.c.73

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_ScreenSketch_8wekyb3d8bbwe!App.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8172
                            Entropy (8bit):7.977796374120672
                            Encrypted:false
                            SSDEEP:192:u+pC7DU72OybI7WLnAeQZP4GHEbXMa5fnoybI:tInU7nybIunNQaZbXMr
                            MD5:0C361680066DAABB3723693957973CA7
                            SHA1:4C88F5981F5F603008295EECB5DBA78E98C98144
                            SHA-256:64D9ECED02DCC6EF4E3C6B2B759C322C0F8B2786CBA372F979DF006EDC4BDB27
                            SHA-512:CF0AEB325EC415C815D973306C7BDF93CF2486DE0CEDEA974B47C548959457AF2D5CBEF8A01C9E68507325C7DA14AB6AA453C916B25CFE98045553D74A10429C
                            Malicious:false
                            Preview:W.k..'$..6.xi..]..Z0.z.....@L44Z3.o.....].I.......~%...Z9.Y..)A..no......6...6.o.,d\.e%...$JV.....mj<.l.j.8wH.B.V'.......M..rw+...)3.Z.`.r..*.}.W}.Z.....CLTz....@0.UA..i.....Y5!..".....*..5.D.^T...8.:pC.E.~..'.H.5,.l.|....fG....#......{.Lw.(......J...z.U.......z.SYe`.Tl.mi.I.#W...c.nlx.5vN.=....$....M.........p6.u}......c.&9..@.);..I.&..hX.H....|..S..&{.x....&..!..CY.........P^....y?.S..<.+....:m.A...*..aH..... .p.vV..Pj....lS.KmRs.k.kr._r%....`X.^.-|..~.3.v.XkH..JQ.......u..w..>J..1.R.yy.Q.u..3.....((.\*j...........\tn../.+..C.^&.n.S..a{.-O....d.P....1......:.4.....S._.uf........R.......S..+.h.+.%.....e.M.6Z...G....R......V).JM..a8iVP..v)..%..Q.ZQ=..AK2..i...A.j .OJ..).^uq.-..../^B?0.v...H.-Q........>...A.V.y..rd`.......r.Y.9Xm.R.J'.T..@W.(.......n.....5~q5a6....r.v/,Q..W..>......f6.,....ht.7*.v...31.7..E.,P.t...~...O...s...:.t`.......Pz....g.W...5....M{?......Oq.dzH.O:T:.C .:n...b..8...r.4.....u${a.0.de....u.e=...Q.()...Z./N..F.L.$q..Xx.-N..

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_SkyDrive_Desktop.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37275
                            Entropy (8bit):7.994938553771583
                            Encrypted:true
                            SSDEEP:768:IRfBKjDrRazBkjqm3WYXGz5CW3t/3ieFcpvRaweJ1PllZb9NB2KreAAr:M5UPRmB6r3FCJ3iEJ1PllZb9/2bnr
                            MD5:737EB2A059C483A1658D84AE3BA1FDCB
                            SHA1:94BD97520B4E4939B287CC78FF4627E1CCBC4E13
                            SHA-256:6DF956A4A2D3CEB9A2F2847FA8E4266C6751F5679264005D464F9C50211EBB76
                            SHA-512:855761960E8438456C6F2CFC124DFA741AEEC3262551C9345990B33B9A02C4081362D05854E76E9E71179BF064180389D8A2C22B71188E6CEC87382A7E958D78
                            Malicious:true
                            Preview:&p.dy{.<.5...>....5.=.Lg.Z6..}..@.q.c..E..F.+.\<<..jQqt...:*..KA.y...^.q....k..G.".}......<.....zMVc7 ..J.Na..F..xk5...%..N.m...\.t..q&...8B.d_...8.^.Vv..=...%.....(....>.=..]6..}....f%.K.......:..z.g.*....`D..i......@.'.:...._Zv8...k....i..s.P.....w.n....f./:...R7B.t....4gk....Q..)?.NfT.VA.1.;fL...x...Ru.......`........Tg.....U..H.D...nhFq...+...Kv.q.......U)O<...}}..g./b...W?Pv....G./S./x<.[.R...U.g.X&.u.2...ug.=.{.....~..h1m).r.p8.-.J66..T........Cc,_..-K..d...F.|$..Ff,.4......L@...W...yL....k...3.....zV.....U..FY.yB...L...-..F<...NJ.OI..xa.h.V..q>k......B.k.J.^}........{P..2..P._.A.b..(.....~...M....X..R.g..H)D.(..T..a}...y....=.v.*....'.h1.......Nz.<.KT...;...X...X=.](..>....=.W@<..v........2........hW0.!^.$.....@.[..aa.0..'...o.v.Y.........,.k_.....fV'.[.<....?.%..4.|.yI.I.=.....~..m.5._..n......3-.G#.%....C.......C...h..S[.....2..Q.I.Y.jLW.Q\K....*....-.&..R.KtP^.Z@.......~.....Q.b..VzW>..y;..OOa..X.y......1w.6..(.H.x<..g..

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_SkypeApp_kzf8qxf38zg5c!App.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8168
                            Entropy (8bit):7.979487560977207
                            Encrypted:false
                            SSDEEP:192:DFx93gRsdxT+3Hm8SWSekqC0bls8RhUIuHFq4uGXyTLs:D93gKvYm8yJtV8Ht49X0s
                            MD5:E224981DDB56749C34D581226C886A6A
                            SHA1:FA27714F4F6535B339ADBCF993A93CE13D78A371
                            SHA-256:3891F1E25CAC6006A84942A36A41662577D6B93115BAAD7CEB7102A4F587DECA
                            SHA-512:9AC0D8B29CEC65DD7642954E5557146B8620090F10A42E8D24C537FD1EB0BC335ACF6859DB99896D467895B65087B4B35A50AFDBC2C7E9AD91C00B4F280579A9
                            Malicious:false
                            Preview:]...Md.HQ........#.:6....@....`8....7.,b.n.`.F.I{.6......N.}....a......R..>.....}..C.......mc...%...p.NqOJ.y.0.6Z..8.L..FIi.J6...=0A.5.v^..^....S.B..T..<r=.p.c.....7..2..].)....4..s......eoI..Op.}t....w.]...P9H..-....Z.....K.L....zUU >.'.......pV.T.*h.{..V,....jd.......j..X......~1......+.>..E.>V...0cM..d.[...o-Zu..D...L.D.?.U.O5..?.G...bQ...5..?..X....N.i~...I...[.}L.OW.......=~....2...(Jv.OPB.y.!...J....y...|.a\#.EH.#.2...q+N.3.7.....2....B..(oKY...4..W:.....hGje.n,u...v.A.6..8..%........_GC..r......2.B..Rw.;.Z*..6..M..S.E..YA.....".......W..k=.Ec.}{aI....M6...........)[.b<D.b.D.@$5.8.......RY-.Fu...]..Y....i.~X%.+I./...5;m../.....\Ak-_i<0.W.u..2...{.sR..T.~.........g&&..X.j^E..P.G.../.j$K.B.2......k.]Hj s.....sZ7m..M.Cr.W.|..z....e....M...x.}.O}c.:X.F.C.3...7z...I=...-.Z..)o....B.3i......{..D..~4..<...pz.]...M.....K@........?w.3q......Y}M.ZL..B..;B....w|..^..@...Z=.o.T.)i...J..oF.......-..6..W.......8.......7.!..._...,

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsAlarms_8wekyb3d8bbwe!App.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37293
                            Entropy (8bit):7.9945562322544
                            Encrypted:true
                            SSDEEP:768:b/ADGWNaEfFVwsmNe0BOslnNH0uJpYwJ0qTrPH5CT5fMta5FdGsJ:bivjffmNJBOABHnfJ0qfhm15Fdf
                            MD5:287EDF1CB7C2835F1CAFBF99A9BE9244
                            SHA1:FB28F3D42BE8C8E7C8501D27EF2670B91D61F193
                            SHA-256:E1F1B30718304A21DFE6B21557E6CE117858B4D9E58BA1B1A648301A24FB1CCE
                            SHA-512:0D25FC5F88316BFCB0C87E18EE2A8DC597F40E3B3A26A4832ED9920B975E69804DC401BEB29AB42859CE874075AE71AFEB2CF6F9A73BA15CE448263D13321546
                            Malicious:true
                            Preview:.kt...V..._..h.... ..U|.d....0.M..Yy#l..z:..rEV..Jg.1.1.$G.v`.."M.d."$.......f.....l.....c..].:....u...h.].(:..Co......w...tJ...-.+....I]J.'.~l..7p=.n...!M..H|.....s.3.._.|..".C..r.s..4*..G....,.r..)W.`0...U.....4.y.%8{{3..J......Os......V.Y....f...v.}.v.7....[.%jz=..(N...Oa..fN2...9.wt...?. O{..u......../.;..Mis2.hoG.P....K....V.....g../...+.%.B$^..........1E.=.7...I.]..c..).@;15.5.}\...k.?.H..e.;.y<]?.....b..n..6;.....o....[..(.......#...p[.5.?#..\...)<'..ur[1.ry....-K..Z...+KAi}..2.O.^c,.....]..0Z..a.x.ie.hB.aW...6........._O Q.o.N..#......*=....[^>._#....D;.......B...A.f...|...-s*.P.._kL.{.Cu{.......G...<*'...!.1..}/.~..G2~d..h.n..S.G..c...#.sa.?..-Y..8.C...0$...._.d.*|j..}.x...../.q^.Op.>3X..[r.".ZB.8.*j.%&...........O....O...b.W.;.q.0...p...s....#.4<..K...&...>.0.U./.aGA...M.....0..3QA...........{.....R...yF..b....r....W.yK.$p."i0..L..v!.3x\.p}1.=u./.6.Y..?u...G9.X..).V493j.>i.x...U..Xm...!..........Y....}..2.......WPJ......@....

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsCalculator_8wekyb3d8bbwe!App.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37300
                            Entropy (8bit):7.994789196633987
                            Encrypted:true
                            SSDEEP:768:xJjtdWRncTWvC1jH0OwmI6IcSS2HEx7cyylz7KagslKw8MQmsGw:xJjHWJcMCtZrlGQcyylqslKcs9
                            MD5:B404DCE22457F8C6B3565FF582A20DC6
                            SHA1:F5591E869D88FBDD123EAFE135ED086EDED30C66
                            SHA-256:5604FE7F09332A62522D49F892EC58FE40D47C21D5369B1F3E44F766197F97D3
                            SHA-512:C72013DEEEF530375CED3B028B1D0589D89233107C269226810C55E85E3B608B6AD322F4BE83756DDCC9F7990FF0B8DC0B9283F005BB9A2B060D56FE1CFB3660
                            Malicious:true
                            Preview:c.2..1b..n.?.M.rC?.+..R..L.`y...!.,..f..D...S....S...T.1...\...s...I.p.5.d:M.R..X....{..=......e..YVA..2.......[.H....E4..K..@...E....j...L..\...^.....g0.x..HKLn.|Y.....^.8n.../J%..$P.F.).&.L..?.q.....x.Y).D.0...`a:...."...y...s.Se?..#._.....F.........OU.....v.X.....0'4..*X....{.z....?..qs..(q.E...!"..v.s..sM...?r..6~.bz[Aq..?.0...o..F..O....g..) Z.g..(.13J.R88-.Q%.t..n.$QQRy0..].t...~....=...=.9......W..l..{..:s..e..........p...P#....vP...LN.;...a...!P.{.<q..C.ET...........eR........tFVD..Ns.r.H?..I9.3....d.{d..v.Q .5r%.q..q][^\!..4.....c./;Y1..:.\...hd..z..\..2.....X......%Dh..F.>..<..W..J ._..V.pA.Vt,.....95.u......^.*....Y..@.n.....*..i.0h.&....`..&../<...u..w.;...;;~D.q..~1.4.j...Y)m.2..I.f.;o..}._R...f....#.g|...c...'.h...... =......C.6..pN........!.....&..i..f {.....B.gA...L.F.rp..N....8.q.}...#...@..#~...Y.....Js.9>.. .*oH.......il.Y..gR..W... .].R.;....... .......e.n.\..ph.t..zZQ...M..-...@.we..=3c..u.1..Je...J.A...\..../....

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsCamera_8wekyb3d8bbwe!App.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8175
                            Entropy (8bit):7.978846793416431
                            Encrypted:false
                            SSDEEP:192:SG0ZK21oylt4J9YLc+Fnxrk3vj9/vsgiaQtjq0QqkiJR4skG:aK21oylt22FxrcJvsdnA+kin4sh
                            MD5:6F622C3B37FFF96E082D1907138925F4
                            SHA1:452C8A8ED00AA764E9831CC4136155EB4EBB8E8A
                            SHA-256:2E2B03D8F4EDF336BFFB211CC82093055148E219DB0999C1758A07D49C524770
                            SHA-512:2DB35A93E402345427B4C7727E2C2188B4C655D82190360D62229EC595D9B32D70EB5710D998E3F542C259DC02DDABAACC413E521CEA72D7F81D063469AEC5E5
                            Malicious:false
                            Preview:2."`....A/..f.p/.tcG..j.{....}DR`...-......>....,i.9.h.YB(....WK@v..]\....!.I..@.#.I.:..;cLg...zQ.h.2......6...*.........4..QW.R...F..T!5.)b.... -.....=>~..-c..a.....+y...F)....b1..1.z....Nb{0#a5.>*.bI.f.......?......Q...h.J2.o=.....7...y...j.......eb.C..S.o.@....HG.8T.ncq..4A.F."ggBw.....B`Sw.B....C.l..uT.h.....@"..........GG.MHV7....N...".F...JAB.....PT"u.......n..90..@Xv.}..Y..+...3TB.D.u..W./..T<.`.fJ..]...y.3..,...B..V,.8.....r.0....e_Z..q.YX.E.....R....A.....yt...R.8.}..?S..IG ..<...Y.p...a...d.9..A...J@b...{....$......7Z..Ul.cq.:.L.5.K.<..U.EU/.:(y...OF..O.p...6...2....!S]@:z.....).........7b.QtCD...d.....&.&.K....."...Xj....PE.0W..d..._Q..,Ir&.._Xz......T$G]...7t(r..wr..M....i.....Q..2..+SH.oY.nVb.h_......%p.R~s....<K..%.(....\....S(|.....e..' ..........a.M..)<}9H.m...5..U...'..K...d.}...{...ej#... .q}.-/...9d8..l..g1{..c!A.^.....gS..c.}4.v,..4..d...#..7.e)..H..o...I1.t.y.7...p......L..+U.G.T.'2Db.Kt.v.;;..'.V...-|

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsFeedbackHub_8wekyb3d8bbwe!App.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8180
                            Entropy (8bit):7.979039678010575
                            Encrypted:false
                            SSDEEP:192:IBS4k5zMbczUFxacKDykjgtjggh53+HVfA6gAeI7:I/k5wbfgDykUjgquHpVgAN7
                            MD5:231623F529FE6340DADB742614FA6A0C
                            SHA1:3ECC31280B156DAB101CF0A27B931656223C8E2F
                            SHA-256:D4C4FF641D8CFE517CF83DDDA5BA97F83EFA4B34864E43BE5A5BAA48616F8E30
                            SHA-512:0BD5E37A2D502E8A69A8E2DBBCB01C472B381EF2A790B33A3D8D9F9B6B7FFF30D9E1F1E1BB643C1C49E78599805C6679076D3C462190DC11F36E5E7D50838144
                            Malicious:false
                            Preview:i.~.y`.?I.....c.M9$".2.5..@e..'.....Y...(.Z0.n.{..._...t[....#.......`.9....rK..c.F.f....FT..j..T...s....&hts.d#.....-`.....+.1\x#W..&&.p........+.:.....BF^+vY.,."..R;X..:Bd.K.\.....T...s.D....Y........=B.k.7...Gx"..v.E...`.w.-%5.E.l.Z8.Y.J..g...|Ks.+...;....;.....h'j...v.L.!..t..)..a.RG...l...52@.o....K.......&.w\..f..[_.cM......>..o>["z..w.y..PB9..a!#U......rMLw.8..v.. .....b..%&.^.s.W..E..&W.v\.c..Z..Q.g.u9..s...o...P...q.5.....4l..:..$.V.....j.D..'.M7_....6$....\..~.!i..b[.;.A=...^.......#.?..<i..#..:N1..$..D...p.I...8..........&.m...J._z.4..CW..\W?./..M...).utpA..........!.=....^...4..[.D.........9....'3/W5$.'.R[=$.U...f..Ns..9a.c..DX.....$.....Z3.U.O4d.l1...re>.(S.L....5.^.R..P..f.o.x.E.b.%8...U...<R...@.\KT.N$...K...z.m.s.a..x.O.QU..........K#.....$...$Yut..C.U.....-n.....M.Rp.q.S..;...g&.+........)...w..n..)...._.)..@...._.."hD...C.<>^vh1..H.Fb..T@a,.S...P..;.(..e....~g.J.u....AP....*l..4...?U&.M~...V.....<..a.5.]7"...qN..}..q...

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsMaps_8wekyb3d8bbwe!App.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8172
                            Entropy (8bit):7.974156803940904
                            Encrypted:false
                            SSDEEP:192:GwnHfP/AbKY2y0V+LOLI1J+V8n8Z2+6/r8JJ:GU/AbIBV9LuJ+aH+6D8JJ
                            MD5:0D42D5457AA2E08C40B2D3863478F064
                            SHA1:8AD44A1D3E1F5E0C7FA69A0887E69511482F26D4
                            SHA-256:540ADE259176DA8CEFDDAB1709234CC2BACA2C79A8B985ACBD53D79CAB2A5E1A
                            SHA-512:60D8D88C2476851CB721022B46783B95FD52E52A67D4ACE04D085FDF0C5381502B45B8209A55CE2BBCCD2562F1199D7CC11AEA637AF561BD8765B5E1503E05FB
                            Malicious:false
                            Preview:.=.Z...@x..<W.*..7....[*zq...!.".....c...&jci'Q.g...z.2.~u.|{........7.=j%....Q|.......=..-./o.."..K.....l&m-.A..T..9...5..4W.G....'....gN2.....{<....[.i..x..ws..{.dI...Y..k..~...n.."4jZ..`\..n.......sq....:7>..n.2Z...Q.m....:.k......}...0...B..0.........".8../7.(>2E.U.%....)Dx.{.5...Y.g.%m.]..<S.....!p.<^6..q..Z.y2@.....2...|.8k.........vx..p..8..d. ./......C....=.....Dm..nq.5..-....].+.F4..1....Vz..'..i....<.5............B,h.B..h..8.fs6.v.%.'..t..u81....C.LO...(.k.@.#.c......b..E...g!A.[.Z.d.(..q.z.'...,..>....;f,..u.2n...B@....Y.Xg.8.>.^....0.i....k.1....n4.Z..)..^.N/eQ..k.\....,.G<..M _....y.Ju.R<H..Y.9y....c^.T=c..L...'...d|.h..zL..7FJ...K..y.U...2...GZ.d=..E|;.....nYW.......B.w.R?.G.R.6..,Vh.4..w.y..&.....P....-..Y.3.....r.._..Z.A..@...B..p'.../..k$....7_j.-...R..ga.....C.. E..zEXG7.)<w....[($.,g..XKw~.<.........Q.F..B.i.L.... }..T.dSY..K..j/J...v..nR0....7..Zv.&I,9i...../R..vr.#<z...+...k..b.:.x.R....?Lh.E..7,m.3<.;[C!..Xl..V;/....%

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsSoundRecorder_8wekyb3d8bbwe!App.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37301
                            Entropy (8bit):7.995752244746008
                            Encrypted:true
                            SSDEEP:768:cyrRNJk2Zdl+UVNRu0YI58ssHmCsxH1UCEeByo25O62GsoUS0df8/CSKzbkrk6e4:c6JndlDNY5HmCDC8IGDuB8/CDvkq4
                            MD5:1FBC7993E1B257659EE1D0FDB21E57F2
                            SHA1:22D07D62183D5D2A2375C666B2E909071DCC24A2
                            SHA-256:3F03BF8813CF27A185C918FD51499D0C130A5E3FD167078A0AFE557A0DBF60BB
                            SHA-512:8DF48E7CD8F3599D47F82F11B2040C6CA846B1FF9C9F7B0C2603B0899F380BF2B15C7E36334094C918FD0A1E1CDFB61494E2F591CB8EA22AB9512DE5FFFCD591
                            Malicious:true
                            Preview:.@M}>......c].7..O.\.*-....S.:..;.......[.fP.hB....".St....V.r`4)&.<.v1.P......&.u|W.<.....o;.Y. .qf$.....|.. ..O.58.c..z[a<."..l..H........ h..A.-Y...../...a..nn...T......t.Wak .b.LmnG..m.....u.\.(...1a..q.......X.~.......=~.6...=/i7J=e......k|.B.a..M....f..sT.9......I..]......q....j.........%l...1.!L.#.._4...V -...6.(...p....E...T.<..h.Dm.............<..V.kQ.;...yx.z.....>....D.@XT..vR..,....cX,3B.....Z.Oc.m.q..D30..^8r.t...T..GB.X.C........h.j .dl3j..;...V...%.a...0..w.^.....h....].m8..f=.vre....=.+hv#5.}..J.J..0Ih....J.kZ..f...8...'.:...o.....!XVe.n|V........|.$EN&..G.....?.b.(..F..T........m...tP....p.....*..[.n....\.8!.H....e.^q.)S}.....|. *.K%..........Q.I..K...h.x........9.o.D.....Onl......v..M.ys.;...cm...].l.A.<!k.....8..y.............j...|Qpp#B...1DX.G...k..-.?~S.&.....N......y..Xp....m..7M......t....0..!..T..x..g....50.)...x_..Sw.L?.O.h.........%..t..&.'.VY0>.......&.........@:.X....-..Y.U...'.n..p.V......Vse+...........:

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_WindowsStore_8wekyb3d8bbwe!App.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8172
                            Entropy (8bit):7.975027669205363
                            Encrypted:false
                            SSDEEP:192:0lbdnOR9/gwGcZs7LB73tU2+IhXf9/ls+w7RdeHgw6Vssg:629/WcGXZ9U2Rhx2+w7feHge
                            MD5:23C1D96CA9D2D8E1EC21B7F45248353F
                            SHA1:64C26F83425BD7D7EB3E427A71BB17DE96086F00
                            SHA-256:72A155A570FF857C7DEBF38F13658F9B82BC18714AD82C1E3E27F8D0309A5FF4
                            SHA-512:7D7FA00CBE07251FBA2EF9C3E333B7AE40E12750B361EEA67900D92098A9CE184A5CCC6F9F9811BC333665085B7DB25B29AD5FB04BADF186C11C71DA21EC525C
                            Malicious:false
                            Preview:.......Dn.....M.r..?....9Y...V.hk..E.G"E|.."4.M+7...g.[.....W.JQ.W!.$m.&..C.`0B......\....^.....q./y+yN0...5....d.....d..r....M.Y..x+...v.u..AB..A!.d-:.P.Z{..+#l....c.,...a.........gP....w...Ed.d...AL[.......#b..m..t.nz.B.6.rjE.$y3..=g)..ng....."d...=6G).9...:....a....K. l......&-.}e..y..............}e..Q..Y.......[...........V..5.g.=.?.B.@.U....!]b..}2.6C.E.....l..\..'w>.&........v#..r...;....".F\.|..3.H...I>.(....`.._ _...Q..Mo.!DV.B)..h.=..(o...@....~......zG..[.{R..F./.V2O.S..$...>n*....r.9<..W-...V.+.gN.n..=R....n..^..?..8C...M.^.....6..dE...`...d.<M4'.R;..4.1{....././..1UB_0.Y..m.PV`...|......L.xH..v.A....1Z\.../.....8h).C$.\|..g...;.5.5&S.<.Hl8......d.x,.ps.........._Y..c..5d...0".z`..?..F..%.+..bE....]W..Mu.Y..y._).z.6.......V..................8.Bs.r_.....j.S...~F...>..!.. Pi"...\....&..c.....1QeL\NW"5S..0?(%..(..V0..>..x..4m...d>....X.4cX~.....e..V....e..u..N..*r..G.Qt@.`dN.........f.I...R........E#..s.6N.o..~l...............c.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_AdministrativeTools.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37286
                            Entropy (8bit):7.995508877377701
                            Encrypted:true
                            SSDEEP:768:WFsV8CmOeB8LA3p8eufGJdLrc0qzOQOMcStf3fhDx:wsGHUA5HIYdLIlPDx
                            MD5:8EDBC4FA5095BD56AF4E13E0909B71D5
                            SHA1:9AB6DFC8E014DC8A67D288B9203878C309E84C12
                            SHA-256:E6801D9742BE13530E532C8E54BB9D53A559F45FC2B391D74A57DDE3E9BA9010
                            SHA-512:57945604628C91B8B0D720752B2347F7F08483B66EC85CC0B08BA83D11EEB0C3EF12D7942F3025A06F99F3BFC2052CE78D07EA291BFFF757218DA5D82843055D
                            Malicious:true
                            Preview:.h[.lAV.+....a......~..F...L).5b..: ........iV.......3.HD...........S7....BL.....|.D..3.O.b.....2.J.e.~..K....f.u..71..#.P...+.-....6....-^G.4..L.qj.._......K........x.8...$..X>mo....ou.P|....N.%..Sa.C...~.Y...k...Ns..r*.:a.........Ld...%..P.;'0.....7.*.b.._~..*..G.b.vf..,~{t.O..}.FH{D.b........tV.g...U2.Q...+....P..~$....I..x.TA#..'.K......-.~...mbq..^L`.*.@.a.!.\.h..%[.nS.#...Wh.W......;....ZWo..C.....~..(.v........T&. i...).H......'.....CXnZ.../..........A...J.C(..^.'..:.Rz..+..A.-..w..1...Sn..T..,....f..#.......?.6.2M..@A|.m....O#....1. n.{.............7..b..v.P._....,....~..^.RU...q=j,g.D.e.vI..?.f....9.^....l.0f.k...~..r..O....q.[.h....e,.'F...M.`uE5..G...13...L^....... ..[.".f].4..|./n<..n..^.q.8.T.<.'%S.....m/...w.g..>M$.<..6ls..F|...o)....U.FeH....Z#Y`......~.Qz...#.~.../~W.g%. L.w.}l6J......U..g...1.....{......:.U...K.M.....l.L...8f..<...........z.B.BpU.GD.x...{.s.....#0u@.B..u..U...9.J[w..=T.7.g.......z...x...}

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Computer.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37273
                            Entropy (8bit):7.99392611384433
                            Encrypted:true
                            SSDEEP:768:3FZVhjlmaJto7nPrVVEq0I+QGhRQRUxTocyRdvYHUw4d:VZzZ5uPrrYI+Q8NTydP3
                            MD5:5A467CBCB304B57E8D5ADCA9A3D5E720
                            SHA1:0DD5130DA4FAE7B3520A462BF005A7200CC82DE6
                            SHA-256:BF546056CBA14B54DEBDB0B45A69A252C503594D0632DE957C07BF8952387A0E
                            SHA-512:7FBD11E1F0413CD44D4B067F236C5F6498575CC93EEB8B86172609DD36BB1C29B4173696D4B1C9264E41B4796DCE571CC65CBF6BFF7EC497AD588D3C8971253A
                            Malicious:true
                            Preview:..Bb1-.....@.....).e6....k...2D..>n............^e/..r..gb.&.Q.C...{.........!.l.".`.r_.,^.i7.^f..Rp.%..>.......V...a>E...?w...G..E..Af%...AG9..'R.l..."..-....l..hD...y.+.#W.dv[.....x\B>...._....a....].`]....%.l.[].....K..s...!.>.~.q..r..F.."..f/.|S7....[,^...Z7;.h.H.....6....x.H....i..C..d.!......dUZJJ..T.+..R..3...l..6P. .M..j.q6'.c5......-..y.VT..y.yF..._.2._..u.'.y5.s..|....e.Q.M.u..>X?....~..|..r.e...._..+wB3FRw.$4.-..].......d.O.....m..d......L.....L..w....I..h..gb4.>....x5bj%@..._.X..O...z..s74Mx.."}HO..o........V.y..[Z.;w.y..]-.3..NU.Nd...._.!..M..}6m..1`.R.{/.0.Q58.y/B..9.b."...s...&.3.m.......G...p.3....fZx..F...G..V....8...w>.......9......YZ*o..O..*........E...;..2.{...l..yD..(..T......).....p7..q,.W.o.r7..<.m.......,%.Y..=Z..n.+..2.uF!C......Mx...... P.FX.6.........H(...0O.F.v.....a.=.........D.(.n....b.<HCxA................n.........,.Nj..5...B..........6r.N..O<.x..?.qi..K.n.}..7.>`#..a.."...E.-?..iPC=.%s................e..f.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_ControlPanel.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37277
                            Entropy (8bit):7.99535122519218
                            Encrypted:true
                            SSDEEP:768:lg08au+dO6Q1Et9FQIq9KwCWxRLpE/i0sDgam4zUzJYv78sfcih1r:lgJYs6oEjFQIVuRK/iG/Yv78sJh1
                            MD5:D7CA553FEA31ED72323EC535AC2F0F6C
                            SHA1:638821803ABEC2D24417A05CD9EBF845A9989308
                            SHA-256:6072A987EA7F9FF48119863B8F97D5B59C052205E9D22C6B4715A0668334CC67
                            SHA-512:D6B251B929C749ED4FAAA25573E46B47C21E3255CB798900E3D06FB1F1ABDD3F7BA7863D145609772F8E9B95C24A3A4A8497E039B7B7DEF689CBF9C14B7A5754
                            Malicious:true
                            Preview:....S.....;..9...^.........7:..N..@....F..#R..O..[.sF..W+."..-#..........c.....n.......",r.b..Y....B..Tu/..;..T.....!....>}....")......NEl...|.........Sz....:..U...d..(8...r=../...........kp..M....neM.d.= ...#b..."B.........X...4.!.T..f....?n.c.J.bm..!9.....+.........Q.e<.+.v.=K.H......I^E..H.-0R....&.?..U3.*}w.g3.W.!....5({..(A.DrR.%...N.V.qU..";f_8I0..~..N;Y.p.J._.....7u\..a..5V.`...NVG....N..#...8...x..%..... .<.....k..c...=F.n.y.O......{Mk......]8....g......r....V@.ZG...Dt.F%.L.......U..0...0.T5.2Z`...{6..&......R....5..[....+.......s2.8...+.1Z.an]A..9...(..V.7.2M...s\........H.CU.;./.O^Gu..1a.%=.aj9!.`.<.......5..w..."/U.4.....2..|pH.\Q.I..r80...6..........fr...8......Ng..d....wiB..m...p .<&......G.}.k.....,i... &=..0.>i...H..9W..WAC[.}..j?..'1.%...$>.v.$$.n...b..R.tB.d...g....DW;.._....t...z{....H....!|.R]II...%KBfO.>..XH..J....B..LP..j4..V%.>.....neW.G~......@..!y$....8P....UWzYa%....a...7...q..%...p.$?...m.8.{...45......">.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:OpenPGP Public Key
                            Category:dropped
                            Size (bytes):37274
                            Entropy (8bit):7.995699102139171
                            Encrypted:true
                            SSDEEP:768:/F2SBGuK1qz0fv9hrz2//yJepbSFtxZEbyAvDHdpxRqF8JT:/gSBGD20fbC4YIzUhpxhT
                            MD5:CE71803671F4DFF4CCDE11A1839797B2
                            SHA1:6221CBC8997D70D3F9728B7F3DC09A8D8F6B7C6F
                            SHA-256:4B001A600FFABDBFAB3DB942E5CEFE56F045382890D8D299DCD22F9A26917B2A
                            SHA-512:15BA9A1F3869E620C35C9D099B89564994FCF46E3E67D5A7119331575BED370C051C58BF8A5BCB715C87A7AFB064D038121B5B689CD6CCA919221DB8D5FF21DA
                            Malicious:true
                            Preview:...y$.n...}r._#...C.TB..~kn..r"llM....l......`.7..Pi.-..i..v|O.2..m)..61R.B.......[..)....{bU./....x....Y3....kl...XMn....!uz]..}.N.(.".3.$..v.!G.. ^*...3.e.s..M..).s.J....Mm.X..pYHP.9....@.?x...!...~,7.....rk..\...0.;.y....\m....&-|JL..\..,.F......q!.g..|.k..R...D.}...(.s|..9[.f..7.g....v.J..]a.&....\.!]....3.......]hn....7..KZy......X..,lZ.9...N....B8.....z....B.0..jSY.......<k....8.hC@......h..s...CwJ..3.7.l....z.^G.....+. u......>........Do...z3>.....=S.._... .....K.z.........&.L..o.......LKt..nU.].Y..B...........;.P.J29.q.'..s ..>..........F...W.b...xgx}.H.1.a5....&.W..+.....5.....S..jo..Snj.[.B..T|..W..qx.:k.3.&.A.o..3...mN..v.. .3>.~T!X...._Tg3....qX#g..5+o.!..(.>.Zj...n.......~..6../.7.F)..C....z}..(2.o..S.d.P,|.`..;Ff.w`.qt..X.......#h.r@.....w.r...WF.......0..;.v....~.c...7....!.?C..t......);.Z..Z5....QAqKT*.g`.U..Ii....P...QL....Y....0..m......<\.s.bR.WF..T."z.Y..g.A..f.7q&.."...D.ch....-~.%.....="......~.--...0Q..u[.G......c+.S.Vo

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_MediaPlayer32.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37281
                            Entropy (8bit):7.994628330268244
                            Encrypted:true
                            SSDEEP:768:IQC6O1SwpBNFzqv28nK/7GALGhQT/lNBRsymqSzRyrD:hfoSYrFC3nQGAT9yyNSzR4D
                            MD5:21DD190CC2EDC7BBE505D40237DE6E82
                            SHA1:7FCA90B9CA98E1512F8BF92277C15791F04CB925
                            SHA-256:8ECCC78EB1AB43EA4E786D8C92D815018719C1E0E5499999A604F3B727AC90C1
                            SHA-512:5BD05ACFF62DF027A826A5C09409E23DB8311E9E7220393E4B938F1CFA00D6090C3E3E716DC7812F0850BF536FB9A6713AAD4508D60A3C2DDB5F6382E4530F85
                            Malicious:true
                            Preview:c8..j.....`loQe..<.K&....E'.!~_....u.iNF...\.....u.=_.....+.....S}...\..6kwrK..G.f.a%L|.c6...t*9./4.t(.9..M..Pf....5...@....ol.i.P..Z..I..cT'........CM.6.J..x..3....l.o..u.Kq.{%8..al/....B....^.KZ,.w.....Y.9R. 1...f...`c.p.n.>..k...o`..G....v.K..TF..D.h`;K<.S0_.K..r...{h..b. .IJ4...6sX.T.......N. ./..y...^h.g......K:#..eH.K..+.k.....F1.OF...V.&E>..Ejgl.+.#)..E.*..p"..1..j.v.7.jQ.cH......&..6..:.E..wv6.Y.U6.zk....D..;....3.W+.&s..D...}.b..."...81A...W.Ji.fu1?.......W...r.w.*..nQA.8.D.HE....T..[R~:.i.{..,.{.h.qHw....d..$....!.bY....Y$..V_..6....0..Jm|...v..]0.;/..-i......*..p.K#.X.[:.}.4.x.TN....EjH.y.....\A..s.....d>..`..H..<....F...^Jn... J......9.7.I........:..{...I.@i.5..sx.."3..j....fgY..t.WN.L.Y...~....!z6+=....a..k.....s4.Y.[.1...C....... k....X.$y.7.........?..hw.x...U...%...>.r..C.]X.......S..$L.Q..:jt5..#"..|..;b.+...........<9fRFNQ..-./...j.*F?.4..+,TtZ<KfP`o..,.x.&l.G:..5E.RM/o.......,.]t........k-/...4..7..`......m@...d.X.w.9.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Photos_8wekyb3d8bbwe!App.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):31407
                            Entropy (8bit):7.994455728115275
                            Encrypted:true
                            SSDEEP:768:CcY9wQvofwxWrpC5YfF8mmuPcsdjgMJzykhGgci:O9vUOWrCEq3rsdjgMJzxL
                            MD5:84EF332769764245DE29E38ABCB56CE8
                            SHA1:45975F0065EFE3D9EAD8E4A45D7C5163A62CF645
                            SHA-256:856B4C4777701862AA62CC88AC4E49FBD06A2A757F93059C45E460F5F7F6A8F6
                            SHA-512:2F9A1EF4B1C7F7122D59BC11E421D43334B32A8386859DE5077AB1CA74ED461CB51F5C80FD56BA3129CBAF4974BC1A1BCB8D31247008E5C79A3CEC75A0CACE54
                            Malicious:true
                            Preview:..L....[..!.VM....v..}..!...?'.%...9..W..........|u.KF*...(H;..10.8.-[W.._..3'D....%.+ .+...w....XyQ....&._.Z..'z.......\5&M...:..M.d.....(.. Q.....U....?@@X.W.3f[...Z)...u.+r6...U....VB..U=.w.7.....&...gZ..7.D)...h.Y...{7.9..+f........W.....@.B...Yb-.]4....ChF$?.....?:..H.J.N.,.A>..a.<.|E.lK._.z.t#.;@...<l.U.......9\u.^.].59...is.#....a..>.aN.6...[<.<..9...p.H..2..x_. .....u-....\.7..6..i.-y..;6.9.H.d..R....(KM....)9.._N.Ma..2v.Q....2'#...9..IO.i..E.. %;.\......_...Fi...U;.k.6l.2-......n....\0.g.y....[I}........<*o....y...S1W.c..}..O....q.......H.!..hn\^.&.o.W-..v~N....K8.uaD..#X....qJ..#^..S.?..Xc...r...-73...j....'.....&w.*.JM.L.7%B-.....c.-.K..6...Q/j.@.<.vg.......9.C{5.......zD......u?...%.9>.d.L.....H........&...x....M..3.."j.....V.....(Ik{d....*.a.2!#......5...6...u... 3.......Q..4.B...b..B.8i.F_Br9.DY..[/Xu.....T....@U}.*L...k.JC.....HV4..@.]...;..Q.\B..`S.....u..U:......D...R.S...v.L{~.......Q}u.....Q.......sm..........~...Q.3..n....

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_RemoteDesktop.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37281
                            Entropy (8bit):7.99477264180319
                            Encrypted:true
                            SSDEEP:768:tnfWAoqsPmyBMy6t9nAM9NNXtqRMB3GayhSc/SYrR1/kk6JPOAVQv2M7Sr:xroquBMlN9uMR+Sm3/kNPOdir
                            MD5:0DB27317CBB0FC778490BD3AED85C7D9
                            SHA1:C079DB76EE4B28CA84257F39CB95C02B03C80458
                            SHA-256:8E3098C11EF3E8594FCA6A8E9CA94F1DF5CDF7BD6975DB0F9FD0C1BDC129F0D4
                            SHA-512:C37C75C8B06988C4C124DA37E5FB8F9BCE1ADBF3BB739B0995D255BC39C9E43F2F91A9A7812B7A30FB713B7659B1483B896DD3DF459A39E636754280D4A52527
                            Malicious:true
                            Preview:......<.....O.....c...s9.......{:.n.....G\.;.]...7.,z....]....:v...h..@..%~..).k....L.w.^0(..o ]{e..b$.9.#<.a./n-.F.......;...Vm....Z.Pk.Z...%...E........+.}.,0O.G..?.Wf;.b..A]-..{>d._ k....7.w..@.~=ffBz>.."..p'.1tO...h4)..2N...k......O.^..X..'....A.g2..0`*OR.&.;q1.u+L.2..`(OQ.#d.]....Q...qhT..0..u..'@..w.po.PS.G.e.w..2..pPlM@........7;]@Q.M.....ah%zP..6..P.}1..V.....P.F.qL......7....K...vT......{..f.&...p \.w...;5.fC.LcBZ........LoR..SU.~7.P....U..C......z'..4.c..G|6.H..~...e.^..P.Z.....f.."..6.Z.-.De.G.m..v...GfM2.t.S..T.6...*.wp.@e..j.y.&.s._...z.k...qj....J...)@..N..3..*...].Ra.......S.(..ms......h.....1..u9>......."....m..!..=\..R.<..J_...d..^bw).0..ODC...c....G.."../n...c.../.v.W~...l.lR..E.;.5nc^.3..#....W.x{.?C...H.rL.....C.KJ..!....SpI..Mo......J..].vQ`YT...-..N.'..8.......1.{..........!.:.....#..5.F...U.+....K..l....2.{.N.[.W..lp".|2|..N.;.. ....q..I..'^_sM|.T./e.....5%.k.T]%.......8f...e.=}G..+C.)y..vzs..........v.S.....W

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_SecHealthUI_cw5n1h2txyewy!SecHealthUI.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8180
                            Entropy (8bit):7.976854027865864
                            Encrypted:false
                            SSDEEP:192:+0giDYwocBzDcDDeml8d8DGv2f6r/oIvgj53Geh3cwIKZ:Bc8/stl80Tf6r/gNWMM+
                            MD5:4C4B234E4E2E4BC8312BB2DBD74F057C
                            SHA1:E74C14A0D4BDA53EB96FECADAB474A3070B92BC5
                            SHA-256:8600672BE8D344E4C634557EBB019D61C6EC2280113EA4F8ED1004385D48A8ED
                            SHA-512:C3D6EF23C964763370AE173C949496C67AB679CBF596C9A54C92F94F611E1A8E573A4897592666A144AAB742891B15331950E01B752E184BAF32199F7649CA59
                            Malicious:false
                            Preview:}.1...5r>K%.A[...m*.m.},>#.....c..V..t=...B.>.@.w_..3)C6E..-.0Z9..P..>.."-....\..I..N...2.nx2....._.^2... ...\J.v/%....1..WfS...}_......[...g..y.. ..\R-.."..}.....,E.?..'Q.........j*6q.1?\M0.M:.X.*-..94.-2.......1d.&...+w..<...a8...>..a..-E.3...m..R7V.>....-.....G;Qm....-k]..P.:;...iD...7..p.".%.8.a....r.s.oF%...H.'.R!.w....C.,.6_yX..u..v..b.....cTT0....+..Y..9,.^5......c........'..%......w....~N.a)l$..\...&.r.x.....H5..z.."y..>"...J.*Kxy.Baf_.0......<..)..C....C.].....U..py.X.(...[b.......K...4..s..6.j.s=._cgYo$Bm.._2...A...+...F.....j.X.|(BN?...R~...Q.y..........yT..n.:`.^.V...e. .Hy..CT{...\x...Q.f.v...>*.+.4...f......x..5A.. C..n?pV..k..n.].-.......q..@.....V.....6.Fg`."...H...*.m..u.v.&.{e...R;1G..C.\&/.v/....Y...g..*K.h]....b}A-P......5$...KM.65U.~.."~.c+...H....y....jM....yl...e:.|..d...(.p.._..>.....V.E....h?.0..d.K.>....FU..Ox5..A.`....@....^..9.G.`Pv{P..|..~ Kr]I....=...*s...C.}...>0i.e..Fz.z..KG.K..,c..P3?.c\..H..Cnh.s..S..../.qK..

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Shell_RunDialog.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37285
                            Entropy (8bit):7.995130274477661
                            Encrypted:true
                            SSDEEP:768:Lnv+Ux1GyWzwolT03RDwNsBTsQF9fbXEF6PidmACLnk8cUjy60id8jh9:zjnW0o97ETs2tict5jy60id8jh9
                            MD5:1CF4B00172ED6F9EBDFD29B5C9541D7F
                            SHA1:54F8CAC2C4CD08144B89BE76E39E21E08A56EF68
                            SHA-256:8CFF7E28F10E35D1BE32F51D2C0B7015038EDDBF0A4573508DA5DF001480CC49
                            SHA-512:CBB60966795EE708AF6E8891A315A18F23B37809965CF3398C3613D787F302873E0916E9F1E11FF2EEDD920DF0BBC61D036BE7B54566A83E83AFFDBE5E3850DA
                            Malicious:true
                            Preview:T....N...&^.:..a=..........K0S..O!.o...y.W.H0f........I.w..h}.......#A.+......\....@.M.j.M3..l...C.....${...8..q.*.Z..N.O.w..............U...D.. ..G...4....2.S?2.....Cm...tw.....`^.......5eZI.1A.U..0.T...u.=.M+.U...f5.6..(.14.j%.XcL5.&.*z.^.....'}.7$.#S...UT7.Q...6[J.d"W.\.I..Z.i..i2.......z.B e.e.py +M......4.k.l/..-....../.....@.f.#/..~.P....wRA..rW=AO."!...w|.......3.5.%4.E..q....g.}.P^....S$..}..}..`.....J.....*....x.=..KTs...W............/...FW........e..ez.,.}.......h0...%\..W..H..R.eY.46..zZ^.b.Y.[........xo.N...V"..N..]..U.Y...w?...V.Y...n.i%@!,$.w...J.....|.M...a..P.`...5q.2.Gn.. .....x...>...zEFi.1....."..S..x...*U%..Y6Y?.[....d..M\<(T...3.,M..M....)...20.A7.=...Bh..5O...B...GUO....O..lnNxF%..?.3.$..z...{.p.R..........,....,.j.b.o....[..C..@sW1dm..9...KLJk..f...:y]...RF.cN>.....G~R.%..A.....i...7..T..m<c....>..9z..S.....h...K*...?{...,.RE...M.pH...6{.L:.)....q.".......D......Ch.>zk.EM(@......./..mOL...xx..T_.........X..sg

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_XboxApp_8wekyb3d8bbwe!Microsoft_XboxApp.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8168
                            Entropy (8bit):7.979666341224403
                            Encrypted:false
                            SSDEEP:192:vt6foW6BPGjC0UzOY33BWJLX9PWAsH24HkxlT:gfpaPGezOYBW1tmW1xR
                            MD5:57658DEA30E93F1D2D91A9FB5723DD63
                            SHA1:C523026649ABE410B462B8359D268CB457D4A72C
                            SHA-256:5A3C517392E3545CE8E0426E7DF321058C8943B5BE42F4DE32D26251264A5DB1
                            SHA-512:9E5456127B0BC29BC5E9027126AED44C8B5DDD5E8F9ABEDF03BFEE586257CA27710A2B04589AE2FB97F7FE1C6EE2E60ABDD025BED789EA940926377C4DCF1302
                            Malicious:false
                            Preview:p..W1.m...t.rU....'].H].."Y?.I~......H8...I{o.2Z9P..LZn.D.Td.........2.U+;..F..V..+.......>.$]D.A.s.0.;g.H.1j.~`.;.....C..".`..O.)..m.r..D6.........(K...L....*.I.....ii....{A.....E..k..%....1G0*../...!...C .wC....8.W..T.......t...i.......k[....I}....J........!f/..*.W.h...;6..W.g..,..../H.i.P..k.c.`:...-....f......,A..*]2.@<..W.T...`......b...?4.f......F....QD._..[....y..&m..e.Y5q%.<%..zsN......9......a.=.!..C.....&;........%.....1_..a.un[X.V.3..U...R[G,......i.u.>..I.YNp.s;...zi...Q....OOx.n.j.FI:.......zU..-.j^.y.{...&.I.....c..B...kT..5&..X.XI...._CPa.a..Z......`......_o8..e..E...,2M'^.,(...V......).......C.....`._.....!.}.A...R9).!._.W..A.j...;.b>.....2.....).;....|G..c..Q......]c;mK...@.t.J^.l......?.#G...LA..g.....M@.1.6.(.../.n@.`S.....4.{..l|s....p.. ..........5f....B....J..^..O....[.V...|%..m.KO.1.g..7...._b.s....~^Y~..dB..o#. ./...R.79."<D.S.2`.N+U.2J...g..G...[O...f..M8b.r8.L...:...v%.........^..1.../.P4..(,.......^.l~.`......%.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_XboxGamingOverlay_8wekyb3d8bbwe!App.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8183
                            Entropy (8bit):7.9773126884892935
                            Encrypted:false
                            SSDEEP:192:oA+QWzVX6eyp63maiJ0DrFF6EvQ1zJpajm4s88N:UQS6eoMmZ0DbJItQjm4uN
                            MD5:105C463C82A59A14F3FB99AFF0D322EE
                            SHA1:12DFF182246C765090CE5045C00638FC9C4DA2AB
                            SHA-256:2C5B25AF26E99A3FA2FF9A08C418D3B97DBF15ABEB8D8497432F454FB05B04B9
                            SHA-512:2DB6907DE51E9B42035891260A63D4AD4DDB9733749D94ACC5CD0965AFAFB8F2E13D44E73577E5DB43C3EB3B1FBEDD00969B9AA1D212DCEB77301F38D5379C4F
                            Malicious:false
                            Preview:xS.A.-.>.>.B>.._..?..[..>2=....G..FG...*....<7.....I..v.kb..@..(g.$^...E.A_n.~........%...f...5.\#[..C .....7...:.0...Cu=.z.KM.A..BIq..%...w...sq..w.t.(...F.K~.D..........:C...Z...k7...?.=G.<.;Hm..h.E.k..zN..Y..n.....".....0.A...a.w.."..#..........'....*..+3j.V.F..P.;7/lC|...gv...98/a.2....n..]#P=.J$..r.sb.6...w^&B.U.W.:D.q[...5.#t..u.w....Fe|,...qb<-.c..>,J'LZ{\B.=.....q...J.Q...V'+...X..P..:..%!Gu....W...p...f.:C.d...9q.5+...]Q`|0'..t70..3..%.p....<..U)C\..>?......HG5.._...Y.V.t.h7.P......r.d.`..s.Tn-...)l.W>.VJR.M..8...5..&..1.q...k.....nS.......@..x...E...?..J.F.c[..T..<....\/.K.4u`.u....../z...e=..*.k.{.'h......."5..".....*.u.b{.A..b}....%'LE..BY%$c..7`....v...$7:)]s+#.<.Y..4g...MBm...[......-....1z....~B..Pf......M:$.;;..g.vG..6.].5s.i......<=.+K..e.6...=Xx!..C............F.HNu.3e...>.;.<..m;..C.1.%..F...x5.t,...qMD/Z ].....F..X.{.Z..O.e.....v.9n=.C.N...zo...Xf.......O.{.9=&@.6'.V.V.n.i..k...k.;..Dk.w.O.......R_|....

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_YourPhone_8wekyb3d8bbwe!App.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8170
                            Entropy (8bit):7.977154364500184
                            Encrypted:false
                            SSDEEP:192:ShTjLBsKIXrezdQ9dZj7S29hH+GyeZyV6rLyhLLTph8Ch:+TjLBsKIXrehoZeqyzh8Ch
                            MD5:6F0B3B0279EF1C01098F43C382447010
                            SHA1:DBA91DBC1062D943032DDAC4DEA1C1BB9ABCFBFF
                            SHA-256:3C0D0202F7F65BADA66C5CC72E4B09AF84EBC6E03C71ECF823D80E9D9B9F3976
                            SHA-512:8016D57E57F76D55F4132346C2054DF3462516010A24525F545D04C93DA92E3E2A235F4F6F4D34A4B5453E51C5F830107289CBF9ED2EC033A57D79E493B4A987
                            Malicious:false
                            Preview:.`..n....^K..M.....#~+P......s.+U.U.E.Bi...f.i.%..).3..-..W..w/.-(`".|a ....7_.R.dB......0...e....*.Y...Gv.........lP-....h'kn-j.V...E.d.f..S..{EG.#.z....>....;...!..)^m-...0...Uk7.<_.^P.L.....b.W.;%.D..{..{..M...eX.........).K...%..uA.5.$z....<..=E...uB....r/..P.OS....$.a....d.)...G...&...)..J..W...l".^...z.V..{.......U.\..;)^...Z.l.....W.7..f.N..S.S/.....\.....T.....K......X6j.e.%.<.$.....ug.kj....B..p..>....C.t.........[..O..u....w2N.V....T..<..P..Kw...w..q..........dCw....O..B+....b....u..V.....\O...K.T..]........u....o.K..%.sr........%b/=..8..&T?.I<0...,..:I.b..A..C....^..?h.#.e..d...G.g...f...a*..>2..v../LwL..N../.........-...X......s}.S.By......."..h...LJ6A.. .....hl.Ti<.R..i...ia..6.}c....M....<l.'`....F...+.d.;.r2\0....{.rt.h.<..@G.....Zo......w..+s....d.....z.l...).U~.#.<..a`.!*.y.e.?.....#].......a..S...l>$.9......;r....Z..(.o&h.dK..|..8.4X.(......)J.4.I.6..?.......*".>.^g.o....D.../.........KB.....y.z..b1..).-w

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_ZuneMusic_8wekyb3d8bbwe!Microsoft_ZuneMusic.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8170
                            Entropy (8bit):7.9765098803225785
                            Encrypted:false
                            SSDEEP:192:yS/IwdsSaiiKuCa4fX+DyJ3LLuWlqy8mzXs3vsbuxUOqdEMUy:hAwdra4WDyJ3Puvzs83vHqdl
                            MD5:FC49B9B6EB09C8598E0CFAD7C0AA2576
                            SHA1:0C66D9191A8FB3CFCFF2F22F3DA326FD08668CA4
                            SHA-256:2A35008CE85229D8B9AD7D93B0FF0ECB31A689D25826A10F92B7DF4952E24144
                            SHA-512:82518EEFF06CB60BE1EBC0FDF360246463AA6BD763D00D7902EA86201600D6FEBF5EBFB82CFDAE0B9106168B79AC861BF9D5D83B9B6FF67B3A5D64D2F4ABD23B
                            Malicious:false
                            Preview:.........zvM/s..u:..(....0.B4.<.R.j....)....E82.....K.t....`tGGb..w.U}.$.:....h...M..........-....Go&b0..A..|C.^....v..d......Dn'..R.....Mt;G...2......$}^cu..n...@...n.s..... .q..7...%.u.4H..MXG..%.6.Q....z...m...q.'..L<T.u..YO.&{Qw....w.2O.K..^...-[...&r.:..Vi...0o..p.."K-"..c#.!...%.u].Q..l.#./.%u..C\...H1_.KE.]..5.....q..&x.s.....@)....S...&..R...^....(.?e..?.....V...a.t.d...t.?....D.k....Y."..na...j.O..3m..7G.u.L..9h..1i..[.>s@..[../..e ...H.....vw.Q4..z..Qv..9.JZ.%f....S.......h.....y.Z.l..........l...,8.3.>z.....5....v.:5b...4....+....*-.._|J].k-.....dA&..w..D.z.|2..:.}...~.:...7l.V..3;y.3%..n....1...E..X..n.g.....&...b.|....zA..T....I..!G...U....*.....?.sg..`......J.....?=..d.zj....N.........f..m..#R.~+6.:U..s$.}..T.-..e.i.x..J....u...A..2.T..P.....U.+..R-i"soo..#&.....q..i..QF...L...s.:...O=.|.M.h.!.1..zt....p.....Y.*..~.Y4..3..xyR.'pc......p......0...@7...7.43...A.}.{0<\_:.I...._to}[...M..w..MR4...F.<?..'o..RH...-..JU.g..-.....1......D.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_ZuneVideo_8wekyb3d8bbwe!Microsoft_ZuneVideo.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8170
                            Entropy (8bit):7.980518920547939
                            Encrypted:false
                            SSDEEP:192:QRP1YqguFMksn91ORfe6eENPF4h6qq2+2Jjb:QRWuSm2EAh6qqE
                            MD5:E8A3E4EA09A4EC23ACEE6AF5BCAD4AEF
                            SHA1:E9BCB97CD94AB0F71AA5435C97AB944C98FD7376
                            SHA-256:C65A3FB757284872A760307FC17BC7CBC412208264B27A8999112CBBB6FD93C9
                            SHA-512:76F09E3B3BE2BF3E22F15554CA13E4AA0AE75BD4FED30747B2348544CB06D2F0FD005828775893D902BCD66CB687A341BDE5571EACE190A8CB70DCAAED655F46
                            Malicious:false
                            Preview:..BGO[..7s^bZ.H.....z...8[.d.........*..I......TL./......]6......Nw.d.3Gu.. ..6.iskP....lzE.W..,c.X./`.*.....s:./.%Y.X8zb7.o.:.p..<...........(.].G.d...T.%s,.<...E.7.P...%.$.]..............E..6.i.Qx}j.N.l*.W.p....$.c.......s...(D}..l`.xM.L.v?.p......g.oM.1zu..8...f2...4l.....D....x:...S.n..p..kL..c..^G..6.W.......r.....&<2v-.S.5..P...|.H..:....h.@....._A.....;PH.8....)..q.....Z8x.$jm.)G.Lb....k.u....U.....Iu..e.`.r.Dm..^K...X..N.".....*...s.....|.${.D./....-0.!...G4......Q*\8(..<..H.1..wJ...s#..D....C.K....e$a.mm...B.a...?..L.0T.t0p^......"o.h.m.y...:Q.A..N........[s....H..(...MEK...m.!.!F+.A..x..8.%8...'hI...g/T.Q5.pf.`'.joD.{I~..L^...jd....B..\..o..J...k.E.....u_3..KFF\.R..#Em3.O.fW..iS..L.3.....g.wy&.7....s....[n.V.t....}m/B.No.*.W.7..\..f.C...\.+e....W5...r.."6s....[.k.{.cl.1..SL.h.m..k<.`.-l.k...mu..../kG.Tc.#.......f.pV...a..........@.\O..... ......8!..,.z..?../..r^X...D.E.?.TA._.g.*....:.c?(Q...P....C.K....}.@...HK.._. s.1.H.......:5.^.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37258
                            Entropy (8bit):7.995544102324807
                            Encrypted:true
                            SSDEEP:768:P71SDLqMsqGMh0nWC+4iDlY7+2o/Oswjfe2cbom:PBOOMhocjD/f2fe2Aom
                            MD5:FFB49D6876FEFEB4C226EB668866ADAA
                            SHA1:1FA89A0912763A385358561A5A6932DDFE24F185
                            SHA-256:8D981C9A5431148B67C2F1546349FA98C1E3DFB3F93A60006AE4543B3D19D9A3
                            SHA-512:FEC27A8460BD05836B4FB1889F01CFBD8933FAC86EC1C2426C6793F9FC3318DF56E65B9C3C4112183120C8FC99857458454ABD0C050AB89CB304546892DF175E
                            Malicious:true
                            Preview:.....w._Sv.8.9....$.Hl".u.."Q5j.]m.&.C./..$..u....m."....N.;.`Z.....F.d_b...M.8v@!&.ybn..P...i..iN..<.4..w.a....r....Q.&.a...m.$..`U`4.(.5,9."$,.S.Nm.k........I.....b.._5r..v.....&/j,....7<..2.....l:.nYi..D...{'.h7...."rf.j.>g....Ir... .|.S.G.C..gB.F..u.O.h+V\.....PvZ.\..nmdya.9.8/..3.En....Y...c..,y...#e?..?.c[.~=]4b...^....h......a9 ..K.S....+..9.Q..X.h...v...e..7...'...N..4.8....4-...#.j^.m m.........[....b....k....d.sy....-.V.K......;AL{9..Cb....F...G).k...9.5.j.F.>.6..a'......m....n..M.P...?[,..eg.y..P0.`.N..1...b.7C...xJT]..h.....d..l5U...C...........:^W...vs^......x.E..g....+.c..7.... D....~.4......`...L..d6..t.3..pKg.dK..UF4.+;.e.i....S..bu<.K..7.Kp.}..U........?k...#..oz....B......Ihd...ovG6.iT....[.}....,.q....5.b4.....U..7......r..i.A~k-.3.+0...Z..S...<.iB..v[7hA.&.t.k.u..C..3.........?......OlH...(k8s.....,.i[.Y#.."E..c...c/..)=?.~}U.1.Ae...m>*.Ij.%.P.B&...K.._..6.B1B'.]........A9Xw..{.pQj.5..Z...4..P.H.veY..&..H

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_help.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37263
                            Entropy (8bit):7.995094842717876
                            Encrypted:true
                            SSDEEP:768:iSpm/69J+8Q43Dv63XAfxpjSg+5AV66nISptLTUAd+QzkaGlTDttaZsbzl9CHnVb:HpG6z1TG3QTjzwAVHnISplTUkdzknTDw
                            MD5:2A16659C87371FC57BE0491C17BE2E6E
                            SHA1:8B19D82D308D1ABB88A9ED1953DDE422D08B1B92
                            SHA-256:632B93B5C8B4106E606B062BBA68C7BD2096CED084A1204E257DBB981E745890
                            SHA-512:04E4D09C2ABE7125ED285B7D6793F021D87479023B6CF9A5EE337C61EB4289B08F34CAC47EA2A0AA879BAF44FA5C0B845A5B735A1D4829B32A0783916D5B4398
                            Malicious:true
                            Preview:"3...`.R.=.M.......Bs...~.....a..p..H....HK._{.a...Y.-H. 6A...,.s"..z..V.l.I#D.. W|.zF.c....P|.c.Tt|Pc9..i.i.....7R.!.UF<.2....X&y.v.I.*[......2k%GG...+....&.........lh9q..*.NT.......J.{?o......ZS...#Z...7K.Kz......f.?...p...,.{O751.Ia.lR..F.....u..w.'. .@..*..p..b........c....w..W5..Z..sX...N..N...C$.+|.f..I../M..g.......!.j.g....?.t..i=y.T..F..$..C8....5:2{.....].4.~O..k....^..b.o.........>..~>z...5F..._.\.{.s.....&..&.R..K..r/}..V3..QT.B=...X... ..l....@.!.W9-a..M...T_#+[..,.`.`....P..3..`\..|.%\..('......#..D!BO.t..h.$...]k:..Q]....'<...)..}....r.f.uRA..t...P=..h.e....>9.L8..y.3...R%P.z...y...H..,......W.!W.`.\\......p#.9......b3.k.........^.....b..\.LE.....T....y.].rB"V.H$..Af.P..`}.VF......`..Ls.Z."..R..- ;...r..+a..a.4..cF@O\..y.../:-..;2.O&........K.N..F....9...dQ.H...t..k...$.+..A9Cs.U....m%...$..P...6j.w.....[......k.v.....O.XY...@..eCHnK.Q?..UG.`...8h.$..zh..O..?DAF...Y.!J#nr...}..z...-.+9PX[.B....V.s.k.......5RZ.....-..^X...

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\microsoft_windowscommunicationsapps_8wekyb3d8bbwe!microsoft_windowslive_calendar.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8200
                            Entropy (8bit):7.976134203920154
                            Encrypted:false
                            SSDEEP:192:dgw8/zrUU0NTDqQ6haNAq8FLwFAeIvPjDSAqFhzTSePBwbI0Mo3w:/8r5+qQ6h2ijOF2ePWlw
                            MD5:174275A2E03D0AB38EC2941E5BF132CB
                            SHA1:61A8EE1461D91BF52B9F94332D4E1FE4CEF2F06F
                            SHA-256:800E83C78A80D602297F46F0F8584C7630AB178560A801E8688369BBF8384D8F
                            SHA-512:166EBD248FC398B32ADD4981604093EDCD38EAF4D37B709595A22C256257D04DBE7EAAAFF15B6657CD5C7E253B18E282FFC717A17D2399977E7E18A165E53018
                            Malicious:false
                            Preview:u0.D..9\n.\.s#..-....k..]...&...........]44....y.Q.:|........./....A.kOue..4f.....`.7....N....]|...".NW.ghph#...-q~;..l+......K....g.8p,...P.$......^C..L....x.h_0-..n9a.;.>....`.M..K.Nk.gT$.6C{.`..[.R..P...8.D.T.....C..o...._l...".+......P......[P......s.......>..h..7fc} M.$hW..q.......C..>4..W...~.nT$'|.jh[.).&w..;.bw[.8....i^>....h.9R.l.e.8.X..\..A..............l..N....c.%..3..(.....QM..(...wCGM.G.v*.b....j./....*..q.c...?.......pZ.!.9y'.Xw...R.....6........;....r..E..........Ka.i..U.z.....7B.*T..C.n......h....h.7(...y S.......rl.`.......P......JB.].%..&._.4.!....L...W._....L....F[~....`.}a.~d.f.S.,iO..h.5 \s.h..%OHe.3Q^`.X8.....ZW.D.h&.....J2.?.U..f.WR.8..Zv .......n....t.......s.XB\........L.'/..{...r#...y.5E%.!..U.y.R....O..C..v.a.L;.. .....".....a...6'.(.+.....1W.......Ku..>mPEB.........{..N.VgCy.w.,.@.Ep4...1..n.....G.n..c..'h.,$.....g.=.E.$........e....9...hB.0.q....y3..........{..GN........ .R[....`..dh..N........^.].sB

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\microsoft_windowscommunicationsapps_8wekyb3d8bbwe!microsoft_windowslive_mail.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8196
                            Entropy (8bit):7.9780500101670855
                            Encrypted:false
                            SSDEEP:192:+z0b7ulB09zVqkcwUoTDU88brsA9GdwrH5rP1YCJpqfA0AFji5eSKM:nb7CB09zVnTqr6dSLf7qfKFesSKM
                            MD5:3EC65C8FF54697D4844ED43997C25399
                            SHA1:0FED5E8C107B2F1B8E09AECEBCFC4F9935E95EC6
                            SHA-256:92992E7AC99452737FEA05D0AF0791A8244D3693CE6BF482417117594FA5EE06
                            SHA-512:1312DAA74033A1AFD480B025D9FF8011A368CA1B140C6B4050BC7A1742FC653F8B6A1F483E62417E259538E06E641EF86D5CB350E244CB4D9C70BC6E0B864DF9
                            Malicious:false
                            Preview:iY.g.Iob.g...C<|}o.P*O..m).....@.uL........;...h[..2..+...fw..;.........Y...*.7.E....b...I.<e..]....?7Z.._..+V=o........_.-.....!.._..z....Q.5^f.s..j..}..mT.'.JM+..1.ur...E4..J..$...-.d."5...q.8L.;..KD...U.[.J?...`.....d..;.N.*P.3.9..?..t[.w.+.V.c.Z+.7....2...bS.q0H..za.......B..D.z.....U..|i..n..).k.j.=.....oD......'..SQW.........TYy..F..r./.9n...N*<..S..0..:W.s7UE..J#HQ"W.>.d.t.Xo..q......NGw.M;..+../>.a.9i...V..s....d.s../eoG..9.-{a.....J.....O.n..>.K=.^+.=tL.....I..O"9'.an(HW.J.(... .nkzW...;.B.j.Y.B...z.pMj.^.............+..../....R9.(2.....S.jT..Eo./..-^...A..yj..p..?..@....vB,......t..$.U.%k..G..+..W.v.]....t..h...he.m...f...... .O...^\L..qO..x.%....(8...y...b.,...;H..{{"uPv.}......,{.J.1...H.A.O..n..{......D@fW.^e.0(....5...!....B6(2.$.......D..Vo..B...Gf.t..d..t.&Lj.l.+.?....xi...u[..v.;..f...c+..,...kjd...80a.qLG.Ka6.`....qh.aYV.:o.<....%..T....Gt....Zx....It[n"9.x.F. ..q..x...y....+..y?$.G...F.j..1....h.)...2..{N.........0$k.8..

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\windows_immersivecontrolpanel_cw5n1h2txyewy!microsoft_windows_immersivecontrolpanel.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8192
                            Entropy (8bit):7.979177449549304
                            Encrypted:false
                            SSDEEP:192:xm8XHt0+Nm7YBCY1g+oPP3AMntcb0X/O2qdO1NOCG3z4axCx4:fdq77Y1g+QPQMtW0v8OH+3z1x/
                            MD5:EEE01A2B8C7827CBB3627E18305A19A6
                            SHA1:B4162DB91D4C7254407D35CCE9C5F49269962ABD
                            SHA-256:E07C6C5196C644C72529B786B8CA0D8D333B6F20CC08672192521C133B8B2BF4
                            SHA-512:B450127920E4A38D81EDAEA5A3330E48A1CA41FFDB2C277A7DF1439AEDFC25500A7A361E60ECF584F3AD455FF6C0271EBC6B894F5BEF88A5C51FF44ABCA8CE5E
                            Malicious:false
                            Preview:2.Ya...w.>..X....\..b./s.`n..&\{N..)..#.DE.)&-Lh..zKN.'..z......".I6.....l ..9..k.....sn`./._..k}/6;...N.t.."o8x.J..se+o.ud...>DX*Q ..#R....N.yl&^.5I..9.a...K.7ML..IY>....Q.a.6.ADm........E..)*c`........Xr.."lz...epF..x...0...T..H3sa,..[......CPn...Wc:.nTKa.......E5K....v%{...."....O..j.-...Rb_N.:..z.^."c....R..O.8...\]\...U....'.......g.k.h..-..B.Xf...A.{..M......g..u....z..[7.....#9.5.P...h.&.s..$3.,...V1(.[..L....1..*...2..-.....J,9X..c...0....B.GSN.............m..p..s..{4ya.b....c..O%.8C(.z.9L%...U...A_R............uOd..........BC..=....~.&Q0..]0,.........?.s...&.z.1..W..L. .......=.y.w..V5...z...A.O..A.nK.K.,Q'....F.q..._..~.&z.B..~..z...'...[....L..t.X...%.A..D ...:.wU.W....Q..T.'E.o.;rPj.K 1.V0|..X..)B...F...b...D..Z.C.}E...!.8^.p....t.0dg./g..N.6.8....~B.r..........HZ.XC..[...Sq..I.<6...%*.Py.Q....jQs8(.V....).v5R.Z%U.SZ?.gA..n..(......o......)..4J.yd::....0...Z.;I...1..9.h.x..i....HB.x.D..L...y`../1.GB..w<C...EX0..F..

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_MdSched_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37300
                            Entropy (8bit):7.994651479051976
                            Encrypted:true
                            SSDEEP:768:buzqXFZ47F7o4Kr9worAYqZc72/YDCZICGNewtAjR+54B2n13kuT:kqXFW5o4KJhdEGAYDCZIvtAE54mG+
                            MD5:730D88A7A22E59AF29D39A6D549F20A6
                            SHA1:D505B0132ADFD3CD2847375DB343529978E97CBE
                            SHA-256:CF04A51F4750165D3BC8D53A97723AA908F5D40232A69D4F1C3BE02DB0762162
                            SHA-512:0738F2D3F69E94F64B0F0E7DBAF15E324A6D6F7C8CFFFEB9AA2F3F0BA7403FDA1E16734495ACCD7EB3D2ABE41F68631758A9233870B1866486F56D9AD18F0C50
                            Malicious:true
                            Preview:` ......C.....i.CY...$..w....v8rdl.`.........w.}.,..(.H6...).pV..X.N.....JA.g.!.zsX9...&O...!......,x...b.[..\B."1.&.._.DHh.6.9....~x.9MJd?li.w.O:.R..qd..,.X.WL.<7....K....W..&..P..Z....X...`&C.....,.h.U...WR..4.X/ {$...9c.c.KA...)....zQ8.`,F.p3........k*..G..y..3/.".h..P.P,.-+.EA....D.J.t.gL$..F.......[.B.oT.!.?.U(s.Z=..9..*."..+N.....FW0..xWt5........t..Tz...T..2$.}.\....11.@.K.uw0t.w7,.R..93.....=....e..wo6qj........5..'.........Ih......b..o/M)S...Q.g.....Gs^.V!..........xc.+...9z.!..".4..s...EF.Z..=....b../<..MU.k..a+N.,.....s..O,o].a<...|.Q0......&l..#Kt.....I/x.8_./bh"8gK..0.l.y.`....................l.\....]..Fi..]..aD.Y..<.|I]l.&y.J.g..D.$...&`...#......#...C....z..2.lsY.s.l.m.UL|.,.*hj!.}...|"qR........4`.G.-^M.h4D=2...C....%.0..SF...I..._.b.^.2~.C0..S....`...-......."]6..?.h..P.N.Q.e..t.Vz.....5.-....~.$.>.}..E..)..+C...l..(.w..Js..d....~E....I.j..E5....*9..i...gR....A.....p...`..v.j.V.LS...g..29pD...:Aa_E..{.;.lZ...z./%2N.B..2....n4

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_RecoveryDrive_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37306
                            Entropy (8bit):7.994583530538972
                            Encrypted:true
                            SSDEEP:768:zoBnpaSA34OULGyvFVh03tLnVa/G8/AElCLsAWTzP8BtHNpB1jjPbO:sxcULGy3het7Yu8/AE0ZwP8RpB1jjPy
                            MD5:F8320C43E8092587D6B29435C70F98F9
                            SHA1:6064426154E7EA979A00762B804DA500D57EE497
                            SHA-256:073439C444858378EC37A02F2E813BF0097DDAB669714F2C856C7BE477E9BF75
                            SHA-512:563E2B7B90DE39381061D9CAC234462BD351FE9D00314D79E9D9641D83141AF342560D5173D2A2155D6219701FF022813EC0ECBB6160737724AD6C99A8678904
                            Malicious:true
                            Preview:;g;O.)....f..v..]..oas=....!..B...V.^../..;i......'@..o..9#F@5$4."...Ufi....H.6.....P.;..=..........m..V..7...=_...9^..i..*.h....S%.,Q..ERE.E.....zN...(...m...(DZ.Rz..:.2.n#....".?.x?_.F.......p.vU\4|.'...2.=.....&...O_....i...c2.X..?.p.......9")X.P.9.2o.q..[ic....B...O.u..7...H^......5.C..p........H.CSh.o1....../.\..sq.....=Pw....o...0...vx.s..o.../..6I..!....9.G&..(R..SZ.H.= C=....ak_Gp.8...o...... r9.......#z..>[S. ..\G%.|?...k|..M.j~..:%n...:..w..iID............,.L*..F.Q.P.s..|S..V...P4..d.o..`q...5k...)..(...O1!2..T..}1........tZL)g.R.6D.7a#9......~i|^.:......[..-....Ufh.....n..q...71.y.....&|...J.(Up.......].q......z..?.........FC.GL.ke..I.H...._S.....['?..._.D.......~Q....../.>V7........(R+.,6....0.#...]..aH#...nx.SH..t.#N.<.3..b.$Q..k....7y].vz.K...5...{.|...B.3.j.K.....)...-J.wi...1...V...G..?..u..=.9.!.....$..e3_ Z.k1:@.i...k....q;..6:"-.t..p<Eu....db..9[x...t...#.%..3O.)...k..0.L........>(...1....n+.H...W....t.|.......T2....W..W...

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_SnippingTool_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37307
                            Entropy (8bit):7.994754324339442
                            Encrypted:true
                            SSDEEP:768:8xv1QPcPCFEtFHpZxdHGvCy5VPdSMwegvJRE9gKYGFw:KpC6FH1VGB5p4M0v/uZjFw
                            MD5:7A43DA27EB3618DD3C8D185AD168A121
                            SHA1:4C7342763F893F8E0D7317DCE1D27927B6F1FF9F
                            SHA-256:6CA5B3A880F1830DAD64D8CDBEC42ED49658B3E410586F9764EBB104912395F3
                            SHA-512:1F207617F1B5F96CD0619508C269C27AC50D6531B66AEDDE67B7FF94D27A20F0BF225B2ABACD0EF31CA248AE59A83CA07957B7EB353539A46E133AD386435B05
                            Malicious:true
                            Preview:..9..s./..S...k..jc...Pk!..S.l..<Zj..^....G.O.8..@...,x.e.`..Y.......,.}x..Y.;......pR{G....d...T.../.$...$X.9#....e..8......(.e...2.....J..3.}.....3.H..}-.5..t[.&5U...@.z:..!...+.A.a...0.....v..n....fY.N,d.....@}P>"._....B.....t...,..D.aM|E.U...vJ..HPBDV7A...$........k...bL#5.?.....bU..g.....S7.5.%.....R.7.....u.df.j.L.....w.4G{...1.*.#4R0....Y.,......'p..\F8......7.ww.0[T0t.j..Kc'..K.....jHj.#........,v...#.S.=.7/.6{G...0.if.b....Q....v\.<%Q....*.$.X.....#kh.:........{xI4... ......'.... ........FW...6..*..T....H..R).........F....W.m.)...R..}n.UJ..z^-*j...,G.x..P+........$.*7.d0....;D...Z1E.....B..t..%...[..-.H..:.......W.G...y.3j3P.Q.\G.~R...|....x..p..h.k..G1...j).'........8d..i........L...E..h.....x.T.(^....k.27.@.9z.Is.f.....{..h".7....3....?.5 ...`{YR...&.M[....]b..u........k.u6b......zW7..*....;.L.=..R..P&.k...../._a.1.....>..C8Ed7TU..v......U........Xs%42f1..J.....:...|..#...e...o.........\.e.b...9qa....... ..$.i.F.*}...E.c.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WFS_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:SysEx File -
                            Category:dropped
                            Size (bytes):37294
                            Entropy (8bit):7.995125810651347
                            Encrypted:true
                            SSDEEP:768:UIbPw4aengy7E07qtqRjSKL5covMxZKMciTD2poxCAnJWO7QolROmU:ULenZ9uqR2yHvUEMcy2pTAnJFiZ
                            MD5:260099C00D855A7432D930206BFA09FB
                            SHA1:855FEB4C82998D6D6F334193584AD384BD8034EA
                            SHA-256:921545AA30F27E45FE1E0FF825D09C7F4ECDEF32B885B265734851BFCA86AB9B
                            SHA-512:308607BC9161026AE9BA93FA3A5A81309D3827F47B955DC5AE0AC850D69E6C02A6E115155151170381CCE2C0C6CEE4A1F033331EC8DA70F200D12DF88AA2868D
                            Malicious:true
                            Preview:.5...7.4H...p.U.K..MB.1.i`.:.u\.?.y..s.".814N(\*..v?..L;......2.Z..'.y.q..N....g.{5..f..y.y .\....2.:fv..,QH..5.....hQ..c.e.B..egr....pT..).D.../'1...._h..-:.^.P1...Z.$..>4.{.... K..r.:..Q...Pe5R>......R...2U..7d...,.-.....[._.G.M..0....mdKKv....-..Ehq.j...g.:{...$.f.....7.CT$nGG...?.._...&.m.kgo$.+...`B.C....a...m{.`..j..Z,(.mG...Q_ZI..Q....'..n^BK.2"I..[.......Q.zV.v.....\x4,..@\Pc.5.......S..^.f..V.he..r.../..|h.z...E.0.G..j'=....?>....Uj..S......1.+.T1.;.xQ^.6..vv...>......o......ZT...f#Hc..0.R;V....^...Z^Kz`C}..m.m<`:..B#....0Y../...w..u-a........*.i+.,.+\.......y......n]....f.-...}..v%.%.NS.zC......Q!..!j..R...3....DV.....G.FDf.o.."...x........E..?....)..30Gs.Li........}wo..8..0..._.......@-.[...>M.A.C..x4....{.xT. ......A......2>2.....C..1.H>..2.%P...n6U...i...i..E..&#".vg{.......M..2...^.6.en1.fpc.R.=\\....=]j..Sj..w.......yj....A.X.5S........rs..?.....L....a2.09.W.S..N.q>.?...d.v..-.\!.\|..V(v.3.qhTo...K.x.M.:.Va....Pt.....

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WF_msc.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37293
                            Entropy (8bit):7.995446540271211
                            Encrypted:true
                            SSDEEP:768:YHyCFpt4TRnFcrh7JvixRY9JEUM3OT9rjCBKALRrgNMEgOC6:2LgF+9788UOJiB1LtZS
                            MD5:C08409B76C6460B1C07E809D21031B3F
                            SHA1:67526B48C1CBDE2A5E3269CB3DC8D022CC8227DA
                            SHA-256:6BA0D119EC1AAB38AA5B5803420C657740DDF1B8C16222D1D586CB1D3FACC547
                            SHA-512:658725F50E8106718DD98F392CF3E2F69F947A17487D02D2A9FDF6999C68D2FA17C34ED82F6C6BE2E3EC06A984CA3120A8CFAD71879F204E3357783CF1135F52
                            Malicious:true
                            Preview:!..*.[H.X.........A.....Z..eR.Jo.....U.....]X..J!s...ynOL..pU.l..T.../v...*..H.W..O..t.-.^e.r.<.....e..{.k.GU.....Fh..7{..".GmGTK.e...Or.].9.XI.9.W'1._......\.+......\.).3&..Z....6.C.N..d..7..wv..oG.s.r..{.q..".>..g3U.....b|..9Y.2...'.U.X..|Q&K..p1.r..o.....e..xXy._.B....f....b^..w....6.K/......I.L^.o~...!O..j.E!.....nY.......C.:`"....n.`.G...V}...R.4...cq....g`d|jP./u..&L...l.Z.u.....,..4...Q6dy..5..`MJ..K.8..YH+Z..uB.2.:1....`Z.`.D3..+..*HrD.....]...\.S........7...E?6.bj.P.. .7.&:!...T...`>."N.cV..W..|R.a...."oI.M.....!.uQ...6f&.3=0.....3..........de..&.K.|.....y.P5...3R.!.\...P.w4.B..s..K...A.....K...7.....?.~......%...............6.0N.&...0....&..:.2..I]p........m.8Y.X....Zi.9,..D..:56..R_..Cl....#.>j..*$.k..]+Y.d.W.<..`...x.......B..4t..y./..g.+...\.=..!=..S..(...n%.VE\Yu3N..E.5..K..+..w(..&..YI:...w.....c.:..u.2u........0...H.J<U.....D.....Y. .A.v...3.c._C.....(.u...o.+:".......:.x!..1.........!.M|F.K.k..#}.w.....x..i.8C...

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_PowerShell_ISE_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37328
                            Entropy (8bit):7.994865936243797
                            Encrypted:true
                            SSDEEP:768:ZQqSRaRrPHwKUHaxVn8Vuq6MQE+bFBD1h1Bq2Cd9eCkI079uJM82:ZQqSROfwKUHaXnxq6Rflq2kL079uJM82
                            MD5:3E871E4CB18D6E6B62ED375C00F4062C
                            SHA1:A1132D934178474B0BA88445D42DD9EA8F9E9519
                            SHA-256:42E3BFBF148A3EB407290965829491A6F645E2EF2A9C30AE61D78ECC862E64D7
                            SHA-512:4E0A78F0C7E76ED4333BC3CCA70ADBC5D0E30A847C2F7AEA4FFE1223B9F39F2BF3449A4D3D734BBB157018B434BB8CAB4F0940E388EC1072825502B690314339
                            Malicious:true
                            Preview:a.._..._.......0....}`.H<.m........w%O..MX.Y...-.'.2+j..8.N...D.g.......K../J.i..+&,?..^..e9..G...}.O.....s..+..6..7l. .oO.w._.R.SC.g.Gj..j.....}$.....w..H1..Y.c.$.....Xk..*~.]&....h......-5\?......A7"..2~'...@..v%..o.3.4.-.&.r..}....8.5.......Gq$6`..x.. ...I..6....&Q....I.#R.V;_..d7h.CL.v}.m~....4@b&...^...To+...:.[.jQ..... ..3...3`0b..!...^..G...2...+./.....B..].<..L.ZT..I.".?o1.....8Z%.4iF)S...K..l...b*.a.......l>....?........].(}k.5B.!...i.....N.:.4..X.O....|l...5.C....Xb../|8..D..L...P..M.*b....X...o.-._.&j....(t.9.a@..........p....6z@."-...].......z..,.....4#.#....%}<..Gxk..lh.4........s2.FE....wC..O(...{.....S8........h&%.A....V.....`.)....;...Z.....}...b.......t.&.*/..c.....#..s.f...<a..^F.]....?.5.;.$..w....S."...[..|.+~.Gv8 .Y..#r.e....<8T..A..>.m..........Rpl..m.k.....Vq....L$.G.D..w"....n.x...T..2.{Y..a.........3q...H.{.T+IXR....L..=F....%..9......@........3....n..}.....m.......Hy.....#....w.o..DW?...:`.{./.m..i........o).

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_powershell_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37327
                            Entropy (8bit):7.995795222226778
                            Encrypted:true
                            SSDEEP:768:hNuyr2jK/ULpg0B0Qsbe0RIoMJREyFt0Tkln0hSmMnJuF4B5+Ll+yqgSW:GyKjKcVJBAGRJHAEn0h5S+LlZj
                            MD5:550CF50BF5B5436563DCB0055C36283B
                            SHA1:BF8FE93260339D7CAE283DADD93FDA0A97778B66
                            SHA-256:6D63DB8FED9B743D8F17612D2A6A126669A3A2BD3A36CA617F3481D7A395F1C3
                            SHA-512:4EF6F5E8DD27C6C2B443493AFC108A67FBE20B21E2AD55E03D542CC277E9FE24298792A0BCC67BF208098CD2E462600FA16A0306D31B208CECB082E97967AFBF
                            Malicious:true
                            Preview:...$H.-..k0..L..$.F...G..h....m....>>.`..Lv.3..`$...v..b.M.)..D.e0o.6......[9..r..M.,.ff/s..ix>..a..N7-.......q.D<....RC{\x..}...$v..~..B.b.....g.D."....yE,..C..K..&..i..1.!.[.+$n..-..8.}G..rC...!....S.OK.V.]vge...f....B..._...I...:(=.2,.....~.e>.,q.'.o......|IP.w}.k..}p.{.r...8.QO...`y.|.q...;......&.|@]6.y.@.h.R54......{.5.?_.....$.L5Z....lR."..$|3).T..N.....z.......h.I.;o...B*.>p=L..H...%.z:?*...pw....,.nkv.>.b.q@.`<:.5..R..!.S...?'..A.g!.|.E. Q.\{=.o}.j...>.#.]>.&%).t...}77.z....Xq..h.I.d..C.D.}E...`...J.o....Y....._.].Cho..)..8..kG...+.=.4......}..m_....:...T.L.+P.Vgu..IZ....8...f.v.QO.........o..b..i..6...Ss......i...........M............g.|...k-k....%Qe....f3F..&..[".S.5.."...~#....0.M...i... ?....X....<\...s............{..G....D~...~..].D.>.yn.......,.8./..w....2..p1...U.:..UZ..A.2^_.{.x.....?....*...A.6.r......W.tSE*4..l.....wa...;.M.P...p...... \.+..mh..17.. .]>#q..I...(.Po.ld.=.+......d...v..M.u^%.m.....D.|..zg.....

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37300
                            Entropy (8bit):7.995407150863652
                            Encrypted:true
                            SSDEEP:768:fjhIaLs3SlMhTIibO9jUE6cBc0fyA1oQOJq5uFWLcqwxO:fjiaLs3SlsEiKBUE6foyP4dwqwxO
                            MD5:0C786BA6E19BF67A9B33A83A8B30423D
                            SHA1:59C147E6CC0DC9097976BCC04FF1A0D58E2B8C47
                            SHA-256:924783030D426BC606F8886B9D167A393CE6C934D8CE53115ACC04FF4B5F7902
                            SHA-512:C559E801AD1E9E7E57A4A2048C9B4070C66223982AE26C9619A988B42944C8A6E48CB04FE62405ECD5385B389EE2473A8D6C914BBA7058688B2E4C4B40110ADF
                            Malicious:true
                            Preview:....|O..n..>Fg.b..dA.p.(.<..E.v..C. .EPH2....Db.2...n.>e...)..1..........".!..?.)n.EpUw....F.+......=.]...T..M.5/:...XX...L5..pP5...5.f6..q.1||..v......H.9...y2..1.^(cM......]...H..iFhNJ.|C.......J..!-A..1.`=h.).ax....G....E...9.w.....M%q.M.*=t.....v...\Lz&..=.f4.F.`0.:..<.P..<$..ax.......g.._...Z.[.w....N....kx86..~..U..@..n.j......BY%.......}.....{....+.V.er...W|......r..'.....B?m....%...l.j.kU0.".....[.ke~....."f.x.f.USY....^.:~^T*..n......Zy.._..q....|...c?"8D..R....H!...b..\V.FH.O.q...tH.-.C.....^.r...x#e!.. .`^.$G..S.).z..r..P....'..Z4.......XkR.~.+....u.."7..<..cK.p5t..k...jz..J.#.Em..~.s&S'B3.lM.vA.i.3...*..2&.:...&.....Hg@..).5.R?<g..=.K&')...u.] .c...RCF..R..F.LyjB2....]....O.......ei#I>...Us...>....3..-R.#.........=b.cx.....-fn.[X...x.g.......".d.?+...|M.j.Cmk$q..S...z..1....=.(.x.....~N..E8.(.........H.......BX....;..u..h4....tb+.......eK;K).3.....+.G8..A.w.....\..._..$..5.%..D....e....Q.....?H/.~...../[S.....WF&.......

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_cleanmgr_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37303
                            Entropy (8bit):7.995052891230384
                            Encrypted:true
                            SSDEEP:768:0dfshSm6M17/1qnIq6n/LU+PpdycfIiBTBc9uQEb0K8dvBqQKoEihZNre7vlGu4:cUh16M1gnIhn/Iwby9EwZZ9RthTS9Gu4
                            MD5:BF8906CE0BF34C02BBC82CFEAEBF2FE9
                            SHA1:8E27295C006CD86A3BDC3A120A76F4B899D9FA15
                            SHA-256:5156EFC8BE632B43BBCFB18206A91AC51991D547F9B9800533F6E8784C88E6C7
                            SHA-512:59D355E47751CD846EBC476ED3AADAF3AD0D9F5659B7C329557053060DA32234E1E946CBEE56AC2426CB2282F4D413CAC5287E95C10CD231579805CEAFB11E2C
                            Malicious:true
                            Preview:SMy..p..n.r...S.......p*........;...v.f.U...q.MS(...."?...1.......(...k@...W..E..n....|j..S5H....Q..+t....yN.7...8.....u....E..[.5C..u.i.`;..5...|R...,.R,0z...W4.lW_...l.E....tK.{.nd.=Ar.....P...'d=<.H.?..(...{.GL..zk.:............f.nn..G.]..>Y.F...Y.9.NVN0.v..{./....cw...I._..fB.Z....a.{. .......~..?(S.=......P..ljkc.^Q..w..>...E.......#)...Q..G.` .!..q.d..t....B38p.U..'...,q.f.mL..\7L8D.|BM..=S.f+...a3..6..(..o<i....r....d.zQNMk..,.=.^n..Ns.....P.)X..US.........z*....N.p.z.....hl.[.[..N+.'....q..PS..%....b.N.4.......o.6....O.0....`7..J$..{.R]....j.f5..VAR...N.0>'.Sz...oJ3.}..zV.!..Hm(......:....VM.~....;|~.6..K^TB8..c[yh....\.5.G.f'0e]!....}b..S+.|d.....kQ.y......Y..x^.i..U@..4rs..J.x^k.^e...R.>.7mD..8"...[.IB.....<t.....R.E!..Pa.....K..............28T..>....5.G8.....Cl=......."X^m..vO..$Z_..O...nQ..C.#..Q'...&.'-....f..a;@.v.E....j....q2;f.=j..^b....a....,........=..&.....S.X().T?..Fs.PU...Y....W._Q....E.P..x..B.>t....k../.s....

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_cmd_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:PGP Secret Sub-key -
                            Category:dropped
                            Size (bytes):37294
                            Entropy (8bit):7.995508734461146
                            Encrypted:true
                            SSDEEP:768:vHFVqgHYf3C918aCxnBmHYB3oVcpeYV0CvfKRs2219he6yPkpE1m:vlVDHA3C918aEs0t30CvfKRsDe6yPEKm
                            MD5:1052E4FD263C675E62BD337F2AEE0E9E
                            SHA1:B86CF17AB8FB01EE1DA2FD4876873A43508164D7
                            SHA-256:4EB2B98071DB3DFBF8473AEF7C51EF1988F6704741A3AA7753A5941B221E60D8
                            SHA-512:705FAC165690CBCCB0379A02DAD6663462DDFEA40BF017202878308BDA30985844FC1678656482634754D8E9B6144829FFC5C2DFA102DFCAB14A5EC1309FDFE7
                            Malicious:true
                            Preview:.O..> h..;tw..B-.d..w............v.'..^..E.e.~.i...x.H..F_...\a....d..-.../...DZ.W.!%1.s.Uf..C......n.....B7S3DP4.B.C..=...z..Y..&P.a.x].g.c.8...o...[._.m)..h".1...X......F./G.{.^T.56/..]/@.<..G(P+9....N.]G!.^.~....0.$H.S.L.V;..Gbh.].u....6.8..c..F.K......5|...j.j.s.{z..8t.V.a4...$.%...f.*...n..5..&.....l...}...SX.j.*..u....e...b...5.'.....\g. ...6../L.8..8R,.y/.sp.r).......d....Lu.^W.G...%xJ..zVf..x..L`!.4{s.U...e......>.M......f+.Q..~.W...`.l.z....j...*.B.v#h.h...,.*...xd...A..T:(.Z..Yh=).O....t.8u............+.....=......-y7.b-.F.Yr.4...<.F3..KLb....^.BL.kj~>SI]....^.......M........exm#hY....;..7..........u...I...{4..3..j4.P64W$.h....~...v....vGeN#...=oz..u...%.n.j.V.O....[.{;a.;?>jB....2.....kR.{.m.4.gt....@..7/..5v.-S.zRF..t.M...F.<..@.".%cn.S.....D.vD..<.ceSd....I.ha.L........K.~...].....S.1.........'......Kk._...e.../..L..Q.O.&...-.ZN #....pF1s..r*../.'X..\....Ma..Q... ..+x]...vd.+s2.U..5.....r,..f..YA...~..F.....n....!..

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37299
                            Entropy (8bit):7.995420443033986
                            Encrypted:true
                            SSDEEP:768:FQiN7MZ1YJJ9ldx81RBsumTzpvgTwNSJpcYQUv/GBZu7tDPZ+7OaD:FQitw1ILdyHAwgBUXGadPc7O0
                            MD5:595B7F02522B7C6E2AFC141680BEF431
                            SHA1:545EBAD0BCCE01E8AEAE985976D8869C52A1C892
                            SHA-256:F1CA4DC1774652C89BF04CD8410D478D7A5972569EBB433906BA7E03A137DE09
                            SHA-512:FAD5B428E3A355650D53F0602638291C9F4F42F2B19222DDB2CCB74682E20BFBB9E9CA96C76AC84EFA98FA3F2E660858578D7EE343A5BF6508DE8971B443F091
                            Malicious:true
                            Preview:..l..Y.W..o.......H...2e....C.E.<.N=.AT...8....R5).x..r.6kM.\.....U.u.6..3.w.H.O.V.R<...Q..+..+.;.W..d....?.u.9f..b....r..:6.....X..,er.X...#.-.............Y..<.4t.{:.!].1...7.F..p...Uk({.....g..%6jt..).@f....(/.v........~.m....d.;.rE......%}.dg` ..u..@.>......P.r{..dEAsCf,G.H.]/.,.id.C..pVD..GN..F....C.0,...W....w.mEo..=...&H....\w.@.D'..s..^..........!S.....D..}.8+....tJ..qT3....9P..!.Nb....Y..v.:.%.... D..D[.b.l..`...XV.......>...5W....`...5.#u..sP.........;<@X...5..Y/..ta.F......j..fx..f.....tN.....4...!f.O..=<.M.5#..M.T.A.c...\.aM..i.... .jE....b-IV'..i..U[0..pE..T..3.S..6{...{dDw\..!i.Z...Ka..Lg.C.VI-..f`....nJ.Cd.c>,).>.Q.D.!)N...?hX.e..6. ./...Hmo.._..``..w.i....h.eQQ:_..7{5..>..WJ.la.k....'....$%.....1....yQo......4jK.L~..V bc...."n ...,Y.HSX).{Dv.]......+.#lNX&....K:7=.sD...d:Q.PBd.P.]1..t..MWcx...L4@7-*;.@.PC..T.Y~...y..._...o.......4*.@...DZ.f.....a4K.i..QfiS..7]U....d.a ..,././XT%.......y......+.{..n1i.%.Pc.!.ti..d.....N....2hV.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_dfrgui_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37300
                            Entropy (8bit):7.994648748964574
                            Encrypted:true
                            SSDEEP:768:K/mpB5o20SzJct6eh3E1BM1lDMqauPwqu6Azb1wqrrkb8QQdmi6mSJwIdLG:oEB570Sdcp5EQxrPwxn1wIrcZQH5rIda
                            MD5:C7B33698D9E1F1FF904DA9AF1F71EAF7
                            SHA1:19E145AB16EEE8701FFBCF425104944F9CBD1D5E
                            SHA-256:4F3BD82272E5A0DB609BC06260A9BEDAA4307BEAFE6B5C3C2B7FBEFF675B8797
                            SHA-512:7D8525A4FF63D707EEA78CBEF41B6F8EB1F7183386B8A20A1019237FD8E2F268AAFCB589EA87489AEF7E2B8E1457F9FDCAE528AA2BB38133A2F59420DCC3EDDB
                            Malicious:true
                            Preview:=<..T$..g{J........4QIM...-.y......^........M..L.c....(...{u.:..$Q...K..4.....?Ir.....E..wo.3...._.??M..K.#.f.I.e.]..n.g..=...n.._lk...x...2IF2#._. ...'....h..-.a...$..\q.Z..o.,jd( .;....7...B.*..5...Z.J..$.9.C.......W./...zh......%w.g...)..X.w.[%8.x.. I.`.kC.......~W.J%..q"y....6...M8.v1..%....V...3....&.f..i.&...4..O..nx.M.g4.\........T....h6e......d.r.Z9~r...{..sQ.w...[rc".\k..yAA..X.e...+-.X....q...W.7..j0....J|.....W.....nf...L.R..xP.~J..w.V.......s......}.2%...-....4#.9..l...........yE......j....R.Q4n...7.........KF+X....!G.#.Q..co. ....S...7dl.TP.....o.@... r.L..K.g..WW.*+L..{}......H/.D........p..b..+[......lb.....1.v.8.p..Y...d..b..K.....B.......w.......X+>17..[E.....a..cPL.*.|.>..b'.!}_s..5..G,v..D..o...x^T?.[ ...w..o..u..1.....HC!......9..-B.."....7.7*W.q.40.....F+..LpS)...K...:...n~.. EA.!tc...@......F..u8>T.....e........?^.4.\T.r..Y.V.rf....[xu.C...W.q...._...hOPq.3z.!.`^.w^...^........e.9G...@.....Y...$.5.{~.B.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_iscsicpl_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37301
                            Entropy (8bit):7.994632646983131
                            Encrypted:true
                            SSDEEP:768:/907WjCLBQSkH5W218PXeH+9qtLNqyYjl3fhqWrulDAxEZn07hsXI:/9WNU5W7eH+9qtLcHlv8WrulDiA0t4I
                            MD5:7A74B73C4ECFF7B659324925764C4C98
                            SHA1:A3687E24CBCC9F29FC715C56DBA8B7ACBBE48013
                            SHA-256:07DF14E03710800F1D2B7793BD4BAA5D6F8EDA0DCE0830353E38D86AFC9C8085
                            SHA-512:5E5BE2BEE177C61D1750543976C30DBAF7F6D4E7846A2FDB2A14793C787D184A739AA9ACFB31203BCCC8E702347277D5EF7D39D755F49C01CE2E66EC3D7945A4
                            Malicious:true
                            Preview:.-t....J.{<q...O...K..S.3~}...#.6I.,q.m.UfB.LQY.........S:......)Z,..8......L..k..X....N.#.k_...5....2...Y..y........2......`i.t%..P..^.+.i.oy.P%.......j.^3.;....D..7.e...7$.....@.n.pQ.l.AD...ep..Z./. ..9.......-..Di$7....Z.._.{..&-.E.>.'7.......YI@B..n&.F....2M..d.J...1.....yLm.......:1..../o.)...'h...S&.V....sAG.5.-....3..h..q+...2!.s...S.A.Z.dzg..a.V......)...D.-;.1...B..~)Y.....B...E.P.+?.cB...K.*@..~$M..7....d....x.1>....(...Q..m....9..Q..R..\#!."..drN.!.7...o0.N....DY.}.Tq3.P$N"z..X..7......Z..^Q.,./.-..f_P..N.!..w...@{W.PpT...J.@....gd..tj.b.....g.0.[.,.i.o.7.Z.,...#..~0OW..~.".+V..[.....yn.{T..s{s....Pyt..<..|fK_......y..do..|.0.d.B<@..;.....j.t...r=...P...rG... ..+?....fO<hh..Sv%."......G.w.0..2~.j.[@.h..RA.....6.Z..Dl..bNyU$...b.'.W.0)|.)=..X.z#.....fWV(#....-?..}.".}..S ...JYr....w..#..6g}"...~.-f..?...v.\....r...%wR...o.....>4.AO||...d..{N...6......L.^R-O..d.n....ys...zG.7.aM..)...r.],3lI..x.T.iSM.K.M..Nf.."...%...`p...l[.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_magnify_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37302
                            Entropy (8bit):7.99569510727706
                            Encrypted:true
                            SSDEEP:768:IDrbXZg2ip1npS7wTPCxmYyjXucfN+Sh1ZQZHuy8sMCLfofSO4gfRLeu61Y:orbJg2+JP8AeSl13y8sc6RY
                            MD5:55B1E049BDDD33596CD0F9401F023972
                            SHA1:4DF7012D90DF90CD192BC9F26963F621F221B6B9
                            SHA-256:E92DD5951FE3E10449D8CE93F94F1A0630255B89CFBCF8CE2CCF6EA67C404131
                            SHA-512:349CCC9B9AF76A1A6D11F062909879CA126623F700F33CCFE0FD734BD94BF03653169F5EB6E472EF6D1013996CC79F346A3EE634D54E2EADC612F5C97AF2309B
                            Malicious:true
                            Preview:...W.....Ek7..#.."...<.h...f..........u..c..UU..."0..ZJg....;.9.A..\..37.X....o......Z....x.]S.....vU5ks.%m.e..vV.p.R.;.S)H..A~q....Js.&BQ,..`...Cb.....+.Tm[3....v#V..8.m..Z.u,.G.S.:...y......3...?.7.g..u.....T4.0^)[.3..Ta..a..X...w...D( K..!.>.).Fq.(...i1.x....l.MOM\/.uW...R.).#4?b.)....5x..j...J.w..C.3.Q...xZk\..1F.x........j.6./..' .5.O9.....Y....T.p..!%.....K.f......3.<."&.$...5v...._.p..U...%..6G..~ua.S>\._1.....".[5.....@|..V>.6...4`....=...JK...pT.~?t@..Jw>do.i...M....C.t.E.M........g..h..o....;.9...t.8....(..jH..xeF......).."....=m..5...~...#E.i....p...Z.}x.a.....n2....NP.//f>&l.M.)~mJ.0k.u......{.i@..|W`. uXY......D.....V. .:.H.0H..>>.aPD.........L}.[.r..Zp..|.v3....>7.Tu.'..){..G..zE.;.....r..,..s.....9..gP......N.C...`..:....S...~...P.?..i....e./.....r...,..|Lt....E.k............2`....E.....r.I.~...<..1.(:.o...B.BY.(3.x`L..z.J..D... [q.....D3C..=]>.^My.D..@..m.x.Q....^.(`.6....0.........2.z..5Yg.DT.a^............^s_y......|_o.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_msconfig_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37304
                            Entropy (8bit):7.995021184814603
                            Encrypted:true
                            SSDEEP:768:G7CRUDy8/DXsJivTXiLP4QNVxll/0AQlDcdIxKVau4V3B7CavO:G7sUDZD3iLP/Vxlt0UyxKVsLHO
                            MD5:B6BC21F4F85D9D94F30E3CB96C5C5222
                            SHA1:8B298A0ECC1FF8A9FBA0A9E52CD431E9F8E2F8B4
                            SHA-256:F6AE82D0B25223FD2C8F8DA114B684DC73349A723FB6D66E9DE03AF8D30233B7
                            SHA-512:604A707FDF669F29ADF295F4583CDC991AF0F098236C5CCA081E87AE76EDA53B52F88DCF899A3F039FCFBE2B51568930C5203AEE433E07A44109399E0C851CBF
                            Malicious:true
                            Preview:dp...U$.B....i...9..I.w1.Si.}bC2.I1... .7g."[Y...!..H..Ji>...\..^x\S..<e..>H..y{....8'.r[r<.....|... .l.....C.G..2X.DZ.3'....'.p.Q.ihGG.t.%..:........@.>.F...l~....Q.|OI.O....6B`.)../.-R.(.K..mJ.pI.r.......b..jI...*z...g$,.M..%;.z.|M7......%.].C....T.f..)7.....^.).5.|.....X",.=K....?..;.7.....`>...Hm.'8....2K.....d.....|b.,.QY..m..V..f\}v.H3.l.3b..<l.{Q....&7..F.....m.."c....%..:.v...FpM=G...N.!.6.......]...a.c.R..f.....>...q+..{I.8.........Y...J.. B.`..4..G../.....Z..JGl%.v.rt...]D..@......\I.L..Z.s..1).#....$eQ.F.8.....V.....G....G.......!M..+!.).\........7........1....o..t.q.5?....0r.#SA...VW.3......6.^....?...3.....U.b.pE.d..<b...1....h..$`F...T.+`S.q..:.T......6...UU..[...d.Zv;.c...s...X.F....Oe.....rzp....[)....J..+...%E..v}....t%...O......8p3...G.d].1......d....."........R].~H~.&...*.JS....cl.v.gG...h..1<..o...Ks.......4.o/nI.H..iu..$...7.#.^.+-....".o.p&........%dK.M....-D./.?..+...\.....M.P$d..@.^pb......tO....Zn._.$....k3.v...X.r.g

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_msinfo32_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37303
                            Entropy (8bit):7.994956728806853
                            Encrypted:true
                            SSDEEP:768:J50MihLlF+LoeDn/BCdFbX6eg+IWVL3/G3yz1O038QlaH25:P0zhLlF+0eDeFbqV+RF3k6PMHa
                            MD5:662912FF3337CBD9A93D5AE8F875871E
                            SHA1:D903E04895609CB44702F044AFA089BACFB18170
                            SHA-256:50055AA64385C2CF9C78CF29767BBF91DA60752C85C769542E1C1D32EDD993B7
                            SHA-512:47FB3EF609E972D644EA8F32E4B71A838DA49AF6B44C42A546E96B59F6DF4A4739D9C1B5810B20B3BF25D9450E21F0C76ADE2C3243C041FFEA8C3F2158E92B8B
                            Malicious:true
                            Preview:..a.........Rt..(r.. ..J.........mN.R.....J.Va.h.-%.\...6W..@x.J.k.N..C...%_..2w.O6J.cx..~..%./..2..6.Z ..$.K..A..]....v.wz.`..H...`e..,::y.b..rJ..O.d..k5...L...al9..u<..%...H.8I...sO.t.1..JA%^...K......../...^......C]...... ..).....db)./.3.4~8.A.h......... .[z..m}..0....!*.L_.n5F6...sf..z .J....].X.-.|P..2.....h.............1\Nl..1..P.<mb[.)I.......]bXa!.2.B.Z..oJ.."[..-D.|..&...2.2..a/.8T9\..&......6.@.7q.S......+&..o......[9..E..d?4....B3..>9...3..0...:.s7.]G.z.H,.d.6=....w..".....'X...2O.R....M<.By...."...l..r_J....t.{1....S.........Y....OQ<.V.7. ..<.:p..v..>...,"[4a...$hj....XW:+.M_.. ..J...Wb......4b..4..G...z.c)..:mg.TK........, ...........S..g.(R-.r...V.WN.......P.....t..+v....O...g.......c...:.g)-...........C............W.i.L.4..6...R.R..<hP.vb.g.......9..n!k..Fscj.I..R.s$&k....J\{.~e.<...NQ5..+..=.vjF.i.s.QGc......7A.~!..k..ea.3sA.j.....o..4..]..!.vTS...[p.......r...eS).J.Pl]?...WgV#`y....S..G...N...*.wRp...i.8c.`K

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_mspaint_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37302
                            Entropy (8bit):7.994536992422881
                            Encrypted:true
                            SSDEEP:768:V1B5MBSmCWJtddNBbp5SnLVv4qPWllOoVTcgkRrFZ:ZmCWJtdbZSnZv4aWf5Wr/
                            MD5:60B4EC165AE7AC9D53449E15251BE82E
                            SHA1:BE5CA40F20F594AA657DD2D4ADE8C4D13FF5C1F6
                            SHA-256:E07A0B3139F804480B93BD9996E07ECE30303C6D791F375EEE73D8BE6A39D3CF
                            SHA-512:00F4CC0DE11013F6045D2D7EFFE4CF30DE89F8D9AA782E52C23EFB7967B2DBBB798B029EEF26A1CE7319795B0E83164A41A97FB2D24DC538943732361DBA51A1
                            Malicious:true
                            Preview:......C.]..j....h/..n k.M.....X..[-....OKLT..P.L<.......*Z..z.].F.2.H:.$./..t.e....v....pj...dT'X..+...........2.ZE..r.*..C{OAV.Y...E..y\..n..."..8.."V....v....:.../...4......g..'.&..i.DB...9.....x....]..........+qL.p..""..k..7..RJ[p..S|&....`.O.yo+P.}"..4V,=...~...m..-...#H`............~......q.q1.....nG.[..Fw..%...j..7.F...1....F..E...p.....K}.\..Y.>k.....{.c....|.@.<.D.|...''cu.d...8J.m.....q!%.]..h.......%...f;.UE.3.ZjP.P*2.........q.Bk.J..&.<v(|...pV..Vi..[w.KMa.....J..Co..-...HTh.........1...0..\E).......;../..........)..N......./.#0L.J...&....Z.(..'.....8t..X#\..e.xO]p,.[.#../.t..uX..LI...,..6s-.r0.".E...).ry..c...|.C...........HUdV.{...y.a....C....$.'"......|I......7....-4<..Q5..(..yf.k...N$.. q...A.....+>'...V...$..v..$.]G...`.....|..?...5.[."1Hq.p.u...Cx.....~9...":.L..8$..qE0x,..U...K...N...........pX."a...A.0.....C0..h.}.A...$*...pN.O.../.I*n..cMw...t.Q...Yoa..Q.....sUT......A.O.{..U..!}..{.;j...m..!..o....#...e..

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_narrator_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37301
                            Entropy (8bit):7.995677439518777
                            Encrypted:true
                            SSDEEP:768:mdAwnk+CmbV79ZmjrS8XE7b0cLzcbk3UI7RKaa6nZA3Pq9kazM:mCAkkkje1YxbivR1zM
                            MD5:7FF4E561A4CE1856B1431184F92468D0
                            SHA1:74D0EF2FD3969AAAB697679155E631ABEF80E3C1
                            SHA-256:F530F30BD7ED3835B2ED351038A03BB9AE98D4A16FD46A67CB4E9931AE6028ED
                            SHA-512:7114E073D446872AD51E3E5FA89EF7EADAF2FCDA7180624884A844C48C639EA4A644082AD8CBDAAD87789698FCF0A31F2D15921DFC9BDA72BFF45DE6E2F4C6D7
                            Malicious:true
                            Preview:.9.B..Nv!%.S.I:*vs..k./#..G.A..DH......Y..+.p.gc..p....*SK..s.{..f4.:K......C.M.:...=....`Xp......h`v...+..;.cw.........F.G...8`d#..J ..r...aK....j...:..?C.-.P.cta\...Z..o.'.F.}..b6..{&1[...@%..@.5.........7}...C..l..MU..7..h.oS&..=...`j{..5............Y.z...@.u.J....k..G.k.....Y..d.i+6 .Z......,&.2....:P.....9PT ..R..=l.`i..0....{.......A.y.._..R..]`.p.0......e..U..#.>#.y.....`....{.g...7.a..[c.>..P?B...o$0M|.wq.#D\....r,.)........>.X...{.K.....o.KB...6..7> }... .].`v.......Y.p..(\%.(V.FS.....{.uQ...0...Y-...<..f..W..s.....D.s)...K.......d...90."..V..&.....=.~I...O..K...%...Jd.E. .q*....7.D.......H}.L.cH.....U1...V....Xi..s..?~Nyf..e..........."..%......'."..u.....>.rE..f.p..s..:N[...,<v..`...+....!.{0..;..)..Q...j!?.b.6.bP.]..g7!..P...w.2........u..,..>/J..v...b.-E].q........$..uOK../...6.#..t=.eK.!F.....2!..&L..n.k.2.w...p.%S.....`~.....2..q2...J!.XR(..u......Y.....:Lv.'.]M.CV....*J|..m?..}Kvc`....C....c..Y..}P.4. .:...........`..X&.6L..

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_notepad_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37301
                            Entropy (8bit):7.9947342424017735
                            Encrypted:true
                            SSDEEP:768:UYtOsrHofdng0iZUJW4/pTV6u/Ijb4JAIzQwgeAig/+kuSCKo:UYtOiGjY2WCI5U9Az+kLo
                            MD5:1F7C0AD61B88F4CA5F47078C17169880
                            SHA1:F6C197C9ED344460E1F6D923998E77A83F9E9B8B
                            SHA-256:600C5553EC87298A3DEC18271D76EC2EE3849B00E01B53C0A8FB136CB21F1EE9
                            SHA-512:6C087BEB397B7FD36CB272E64B23CC537DECF6B916F223E3A8C36ED458CEC7A350988D82A180B2F078E71D7DE475C5A9E66BB5A4AC8436D69865CCB3A234BDE4
                            Malicious:true
                            Preview:/.;.g..... :.d6].%......_)k..L....i.8....MM..Z.[.A...[.....@.q....;......h).|.D.E.}.......=..3.Z....P.6MDh..{t....ae0e.x...x.,.......O...n5.aA...<K2...........c.)....A...v.P..={./...s...GE......z...O..%.`.;.V.G...H..]z..JV.....&.....;..i4.$..Q.C.A`...C..1.....L..J.,,.....(......y...0..+....I..!.*2..........t..{..7...u.%..L.\6.s.2..}]..$.v.k...B......(V....ExkF.Q.....!....,....+1.p.q..7....~.j........j..kJL(..f..$oxT..'..!mM.'.E....@BF.?...xl......W.P...@F...SV..*............dZ.c..^...PW..c..................gcun. ..':..5b.|.p.7d.(]...^...E...+[Q...4..9al.%Nx..N.>.V..L.F?....._..l.^,.J.....d.#.....9...f.j.-7.:.".Ol%.....+.z._...>.1V.pS..3..I$..V.}...6...q2.........[.._...B....pT.i...{..7....u. .i......5.s..2K(V....07<....3N$!xTC|?..U...,f.Y.hE...c..;.|...b*...'.w.th3.J_sa.......B........u.....-...q.T..?R9...:J.3......@,..'..W...|K.*4.9."..pON.."...$>).?}..aB.....\...............c.k.F...^&.0F.~.G.k....*..s...]....@.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_odbcad32_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:zlib compressed data
                            Category:dropped
                            Size (bytes):37302
                            Entropy (8bit):7.9947430509048685
                            Encrypted:true
                            SSDEEP:768:AeBWvxepEvpjvxxB65HCFM+AxQo64OHlNpxk1kqH7AlIxO:ANoavpjJ5XWAHldk1DA+xO
                            MD5:1AE9CADA9BCA69F56AB86364ABE37535
                            SHA1:F137DBE3813F2CF39CE8526BFCFBBDC929DD88AF
                            SHA-256:9BB0BD1AF1A085D30416BC45CA3F54D26C76A94FEDA4380464687EE071AD1F74
                            SHA-512:2257B0F3C08EF9AAB448D0A0CA5CCB38739E1AAF8AD33FA4A79E768E6120B441BEB14F0BF51D906A886492AFACF2722B4BF08A7980E4E5E07646D2C868B35F68
                            Malicious:true
                            Preview:8ny... ...,.X...1.n.9.C4..w).Q....,..*c.}...Yq=K..aSIm..'...f.!..........6s._.G*..........q.......Mc.. .....sg!....0..4..:.f.?.R....=C...K...R.tN....Q...J<3....5.#..,_...f.P....4X[r..5.k..&...c..|.w.a..~M.yj...!..ZA..O.b...:!...S..Z.......K....U.~m`........5;.ta.HH(v..H.u...pMhp+..#\..Y~..........-..Mk...m(.......+.....fJ.m}`}.......S.7.n....:..I..../....\^"@::...@u....(..<(v..s..H.i...6...w.3...Hy..tu.....j.*./...j.c..u.....V.S....+..e&.57.".|.IC!p.$.c2..a;b.?b*..:(..)[.q3.).v{%..Sh....:..*..:.@..@'..l...3......$.B...u.K...vUN..~..uu....)..a.k;[..5Yp..+....m<.../Z......a..'..3.ln..;..L[..*..\..y....D .d.-.....H.Z...k......."..\.......'...........e.......^.....\.&.Z!.u......&.W.N.}.L........S.....v..vsK..&".]...Q.l.._u.o.......l...up0..{......6D........k..s...v.QQ.'.Gg..._.x..%.....`?..vC..o.cV...d.\M....).E.6~.....K..U.#.........-V..)?X......4=6Fn.p.....x..|.l.J._..Wh....%....q.....N\.owG4..6..>NI..T.......;..%..l...a...T..G.n

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_osk_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37294
                            Entropy (8bit):7.994475426877212
                            Encrypted:true
                            SSDEEP:768:hq5hQt0NTck2tx6rFoPNATWbXU2U2y2Dim3LTTbylRFLYWc9Q7xenwYwE:hhGNgk2tx8FE2Wbkb2NLavLx70wYwE
                            MD5:776CA2A40C3700F85D021ECA30889BBA
                            SHA1:BD8ECBE05BA2A19329AFBB0BF98C19EF425EF95D
                            SHA-256:A2A8080B378BFC6C50C306040F7DB0BA28EDA966873B02CCAED39168F66E1390
                            SHA-512:029D0570272FC081FBFD96B0A77D5F8C23CF7F673D0216E541213DC88212621E3E569EC959BFC514784B4227D9A06E2515A8DC3826980A5762419F87E7A55457
                            Malicious:true
                            Preview:>.Y*#...;!.xs.....c@y.........T#.D...,Y.>..v.)....-....UH.GBx.6....Cs..e_...|SE .7../s..B.M.wy^....(.a.y...Yx...x...n..w....@./.1...V....z....IJ..8..W,#O..../w.a..u......f..&"..f.....o .G|....R.*p...9....A.$.w.:....%....M.`.g.E .Qw...smZ..t04..96.|...`E.T....U..u...............md..r..L.N...?.zh@.C.x....*..5..t^...;...Sm.uA........a..l.8.N.....`r.|...G......l...@..SW..`*.....7!B#c.i..1 !T.GHf .c.3.0.].V.j-S,]...d....^FQ.>.%vQ...N......fM...g.A..D.+....C]iE..(.N...G/...I...".@...:a.....5.u...,..=..d.__.......*....V.S.....p.m.1.f.q....D.c..s.".%T..h.B.....@.5....Z&..5..\.....u..0Rq....E..pD$.g.h..J...9...N.&Mz...q...z.ax.ey.......~>T.9"5.uU.$._k.c.v/..VL-.\/.5...t.^.g.,F48.y:..v,......Yf.Q@{.>.U..J.1....0.8...Y.n5...K...9.u)4....A=a.r.._..F6.U..b... .-.w..D.j...e.[...I.#.DEG..;..y.o5|..C.?..6......E.,e...v..u. ...`k.(..l..J.u....v..G )N....+]..*.|&.y.F..cus.TT.nm.cD........I..tT5..W........i.F4n...\....5.J.-}...Wu7pHU...J....Y...X.....

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_printmanagement_msc.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37312
                            Entropy (8bit):7.994969942150357
                            Encrypted:true
                            SSDEEP:768:R2Po+m7Yac8PirJFTWnFGq6kf7ugWA9Du7WUdn1QI65Ccq7:oQ5zcnWn0eBVDuSkOIW3U
                            MD5:384159F6D239EB12D1873068541DF0E3
                            SHA1:9BB71CDE90A200831A585F4080609B30C67E8330
                            SHA-256:799A89D5FBB606DA78884E5DF6BE699216E3494F1182D4F69C09E7E187E6D309
                            SHA-512:C85EE31EA0BD777BF450E28243F35C7DAD59219C3BAE5EBCAACE71AE93133107E8C6B117BED4DC008C1C15C8F59E6CB8DD31BEB0EBAB147129CAA9C48642B540
                            Malicious:true
                            Preview:.Y.....}.J..0......N;@........Q..'bt..B.....R...o.9..1c.>E....n...2i..,.. ....05.........W[..q...%)....).}.(Z...8p;N8...7q.?.......!R..y...d.........+:~RY.8v.2....%..FO.1.PB2K.G(e....../..7.c..Sg..?Mj..J..\%.-.ya.q....eM.r....V..Q...S7_..R..d..<....s$...U...U..I..21D..Akvo......m...LQh[<..|u...g.....2.v...".`.....0.b.F`..v.. .-.B...Q.K.../.K,...A....@.$)7[J...\.........q........u..r1y.f..1...........dzm..0.B.R....c..~"..Na.W..[q.J..j.....ld^ZI}...}^..H....r.......d...n......Z...=*@.|....?qr... ..1....p.e..;?.=....z(.*xu....x...~-X....._..R...W.....|."g.]........ox..K.$.[*.p.4$.....O..Z!*]....Um....(.Vi.......q%..g..%...Sc{...%w.E....%.3z....*..p.s.....F..7.L..U.(.h{.^=..i.[.I..aM............0...cc.B..Q.S....7...J0.<..{.:.7S.$.........,..\.>.>.....Z#...R.A...I..fO.....}.......+O=gx.jq..S....NTW'...f...V.....A....[...d..6be>q.#....I.9zE...(~T........^...~.f..XW....9..E.6.li....;..|c.c...c.t.J.z.7%.$.n....Eo.FZ..C$.h..$.l..}.THb...W..u..36.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_psr_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37294
                            Entropy (8bit):7.99465507321722
                            Encrypted:true
                            SSDEEP:768:665M05nL7v80h7dWiauilwKAeoxauZKH5bCNS:X5M05thpReoMbZWNS
                            MD5:F8B53477572EE670C81DB2BE24157C20
                            SHA1:4AA2698BF2BD5169B89482FF75F32A89FCA8BEAE
                            SHA-256:01600493C6E7A7098D0463E73ED91FF3F1F43CBB80B4F6F04C722C0C3D7DD8CE
                            SHA-512:78D0BA068B96ACDEEDC31EA0D24795C5FFB23C3ED5E122F7EEC3B7EA8E37D3353EFC4109D3FAC0CEF3EFB20A7E9121AC728C0A55EB28218F185C51795A714125
                            Malicious:true
                            Preview:.w...|U..ds..c.?=d.|.qe..N+..{L.....M2....]UK....(.c.9.\'V..WUjJ."-...6.u.s.....a..b....~.P]c^.^.E....-......U...Y.w..q.a.....M$H...7.E.\..N.5..L.q.d...(..?w.2.i..$]....x.r.8.X_X7Ug.d.j.ynO.B...KB..3.7..n'...e..m...=.#..L.u.....OM...w...$..%....AXF" .il...9.p3..y.uWg.2o..&$......q..\.o<....;0..Y....f..$..E....M............@z...Ha.>x2.\B.D....%..z..9b..%....S..pF.P._...f.D7H......3...L... 1'...C......0S\.`.\.}!`.J..e.(.Sz.0y......p.......b.U<.bv.x..(...i(..a.;.......5.s/w.\......L1`i).....Q0......o..U=.sco2.5.#...q..2...#.:..'...e.....A..K|.J..N.$].{..ls...b5.\.*...R...@.M.D...>ph..kY.m.f.fi........!pd2.J.4..4p.VE4..q.5.~O.j..U...B..f.|.Y.$..F?.....6k.....!.=3.@Y.....;0..+).&...o....q....+.u.6....5..y...S!...X...$...W.S..........bi......B.U..........]..JtRv.A..cX.R.r...lap..uV.L...5.l.5".pl.u1]A.@=.,'"?.N.ej..;.o.R...U.>..;.3....S..H3.5e]..S.!.@.X(.L!FWw.Q..B.....N@N...........K.O/......Q.....a*......G..Y`.....\.!VnYQ...@}..e<y~.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_quickassist_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37307
                            Entropy (8bit):7.994716813387535
                            Encrypted:true
                            SSDEEP:768:2Yey0wliMQq4EwipPAe0c6P+9Myn5hILkkvCg46K+1pXtQq1r+W3+4CN+f:2YeBB5NiNN0c6PX0hILkkdKypdQarhui
                            MD5:9B09A8701CA8F16F5BD824AC36B74A81
                            SHA1:5631086EFDFAF8EB8EFF1DA4DBF94834FC7F97B6
                            SHA-256:72F0B7847201C67CF808370A97EBD150E5DB766C5B48C06F42FF1C66FA132282
                            SHA-512:C509AF8899D24271ECDAD9A2221D9574F7C8EA39F082951260CD7F6E475BAC0B0E26C164A519FFEBAF3DECB78EBB7A4920E4DA7D9B4B3F93DEC141215E7039AC
                            Malicious:true
                            Preview:..9..rd.HW.AL.[.\..}......_._o....K......8>r......D...[..H*....._.3...3.........h.B...!.m...@..&...Y...Y..c....T4...'.q.'-.BF..`...~...`.y.W....]x...Un.........;..~..w]..L9'o.5c..w...<.>..I.Gb.v.49..H..~(..].].?.X..>.$K......*.M<..#...8b:....Kz..q$..2..@...e....Z!ye.o;.{q..e.raK...?B...(`k}./%u..(bAZa...%.+M....`.2RoI.......Oh./.&..Y.35.0_.6..iO-....\.......^o.j...Mi ...c:..P+...1.v...|.W....w....{Q..h....h....q.]zN."b;./Q.Z...nx.'...[.....I.Q.z7.(..z..Q.n.%./..(WrF.n?.f..[s......B.1.t...;._.h,..z.........A../..3~..V......"....{c.R.....z...wuA.~....e...d.c|]v..c.*6....!w{.N..9j*..%..D..`.......kJR..9...c*..#..x.j.p.KJ...U%DTwhC...3.?o......p..7..\..?.Vz.............:.Q..BJ.[..y.z1.~~....-&.0.5G$..B..-..#.{O<....o....l..=....8P.7E.)].."r...g....[B..+.o{.@i.Xm...D._L.k..A.^.r.I'...F.g..T~.y.V...4.....W....Z.Tk...a....>..".%<9..?.M..X..r@....R2.p`.X..|.....tkt...}l......?f...!........... K......7.../...:.......1.TBIt?.[......nF...g.9.......t;

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_services_msc.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37301
                            Entropy (8bit):7.995697652608223
                            Encrypted:true
                            SSDEEP:768:NaQpuxpJCBG0Yq088VPYix7+fEfyQQlOioqYsa/gJD/kjm9XV3d7Nh98lBPq:Qb0YP88ifEfIdoqYk/+mphdf9aBS
                            MD5:9A942CFFF8C1B896C6556F73F00B7951
                            SHA1:B9693FFE36C4A1ABFD623DAC379800D38E78B209
                            SHA-256:F776C28467C8D2FDA3B95E1B76E3E82EC1140A3B97C4F78B93E37271685B36F2
                            SHA-512:D715609A7F747537DD1D4C6DAC79597DD2952473D6C72DC1BDB5CFEA0E5E15275BA2D09B4D0019FAA1DD5232C8A25615CA662239FDAB0F20F25AC6734CFD0F24
                            Malicious:true
                            Preview:T...Z.dD...0....,..E....(22pY@..&m....~..O.p..n.5{..[.......d.<~m.<(....$.)a...y/.W". .P....Z.m.n.)+.z.......b.);{... [.%b0V..>M6`....|.R.&.c..LsvS..C.U..p.'.i`:..E......M.*M..n...^q.]......7.._.....y..W.K,Re........3Z.f.o.......g...<-....o.'.&.]...._..2..5.p..m.8...d..9..HDA..$.}.B<......s..A.*..[.E.Mb{..^...........v..<.*.9_......\\...>I.oB.k....D..iC...E..dV..V3.F.<.Y......_.o..X.>.z.`..F..^..F.QD.G..cph..Q5..lS|7.}.....]]..A....u....t#:O.c.nN.....n^............Hq.c....9.K..*uC..'.pS.,..O..klu\....y5..w..x.....}.a....r.g+o;.. ../.W/.w".(s8&RH.F.....9.:.=M...)..vM..&..G8.I9......\d...=..Q.$PH.....u..9T..^...b.....~P. .^......Fn7......G^..x..t.!I.+.?.:Z#.B1......u(e..<:4....3.;..1.........r...>.jM.[CM....+.7..x.=.....<L?x..FS..ng..T..,!U...N..:.0.=l.d.SIOU.RW&........~KXA.UL.g.7.j.F?....N.)..}Ph/..5..X;c.........F*E.h.i|.zdz|....c;._G..=Fs....WU..>..;U..>$a.........w.U..mS. .9pEy.....+...og...F..f.F..5...V...k.n...`l\(G@.#.k

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_7-Zip_7-zip_chm.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37300
                            Entropy (8bit):7.994357314173438
                            Encrypted:true
                            SSDEEP:768:paHcR/oPy+zdFsSSdiQrwq2wmzL9UcOXb2ACpMnQV3HzeI++Zld1gsH3K9mhCN/k:oHs/o6+zdFbScy4zCHhCKnvI3vW9mkNM
                            MD5:BF646A4C014D8B365EBBD9515BC73A2E
                            SHA1:649235868563E4EF4B57D1B46F931A5397634C96
                            SHA-256:2D5BEB2B3273640FC5ADCD5119A501FA9AD40BDACCE932B96061EFBE8352BCB8
                            SHA-512:293D26CE550BA3AE6A529FA55DF134A1D07B8C33236780035EE88B43F19ACC4A6F898AD52C01775202DDF11E005A513B6797DD956E24503E353F8CF974D2DDFD
                            Malicious:true
                            Preview:.g.QP..!.(Q....$.E...\..v.>..f.Yuk.R)|qs.w.m.j.C.m\.fP..........lEUt........J.K8.r.....,.a|.).E.....<...g..t.U.N%........<.....>L`d.J.....v..{.....^..C.V....>R.u......>.3..4.l..i..t4.j...8.FP%..d..{}.......h...B<j./......T..e..?....2..\*.....J.'.;...9..U.r...x...f..6..j...Z....I..7..S.tmL.6d@$.~....GR..t..!xaCbuR0.s.4.s.Qk)f.qH...e...2.....W.Ak...-M.i...GQ..R...[B....?&rM..Z.e."..C.Y./6w.......%..j;,.s=:"\w...s.SL.........e?.3Q..y.Q3._...I.....z.f.0z.6lW.g.^....F$.."S.^.lb..q]..+C......;iqW..xL~P(........Qo.#.........[...(.k.> .G..e)..\;H/cNy......Q..bO<....\(3...m...sq]o.a.[.s....|........Z.!.A..../..Y..Np.9...3...*.,]......9.m..1.a.3Lt.V.. T.#...o.:fwe..\......f..ZO..<.8....t.fu".<xV..m.iS.......\.o.fv...4.N.%1...9+........c|.....;*M.J...A.n6..=.Y.K._...H.!. ..H...>}.k.`~.d....eM..'.JZ...B...J......eP...6...5.O..:... 8J.tN.6B.........{..mF......N.......I....;.e./B....U(.[....dt...V.|..i.K..[./.s!.h..[..V.Q.a`...v..........|..r...%....

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_7-Zip_7zFM_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37301
                            Entropy (8bit):7.995023952437108
                            Encrypted:true
                            SSDEEP:768:AteSpGY/gx53xAOE7UWJ9vri0CR7tbmgZ4latE8zsu:+eSd+3URfzAlmE4WE8zsu
                            MD5:04CBFEFB60ED0FFA947C85B13BBB0C7F
                            SHA1:25A4C9947FF7F8DE73E03C934AF2AD9E958BE70E
                            SHA-256:C84DE671FB4112328144B89DA7A1582A6E0AAC93FE9EF1B5403F03947C600189
                            SHA-512:DEB320DB3703D39ACD4CA2CF0AE0DA5B8F1A6224FA1627CA79D55E8C8850BEF18421F051369BB73E6A21F39D71F1B6B20B0B916D90EC9DE910A8C248937ACE05
                            Malicious:true
                            Preview:p......K@.*.B/c....B.i.4.6.!u..I6..W...4C..}.EG.......K-o|.......a.v.s$.m}.]...%..:.7.....R.O.6k.......<.Gm1...qS.yJ..G6_.x.G.B...r.j:r...g../.....J.~._...x....-.LI..u.K....o..y..u#nZ..@..(.g=..?C...L..NY.....=.....9.L.t0.X.>.........s..$t.d...j|.{.P..q..W.N......kU.h|`.I._,.Z<.`..e.f....Y..Ct..n.T.HPbR.!..E\taH.F..e...x\M..bCR...)#...ey.]Z.S.....2..Xe...tU....A.....j.1^..M....r6n`c...4..\N.....:..1..%.O`[.=...`..MDH...h.1.v7w.F.F!....e.).........."vz'..j...p...:b. ..Q@TTj..?...e^....)S....h.~...-.#.......A.+.JR@..>..e&...z..x.!...3vNS..0..ZrR...z...x..9.S[.1..7.%TA....E.......n$........8...^...A..n.5fA....O..n..!.:b..x.......;.KLh.N.).j.la..7d?..1\U.$3^^6..Ds+...../......hm....\.....aVl}.....4...S1.Bf..S.S#....I".@..p.O.*.X...I..c.....L|..eLIN.R.od.<..1r..+..]i....#.T!Z..H<..0.v..3..K ..TX....cT...{dw.V.6..5..pkx...|...cx..'.mL.`...q.b...@j..5."..*..#s..-.$...I....Po..0.ur.Zw..Q..^cPP.......Z....5...5^.e*/K....d.Q..j. $1R..o._......]

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Adobe_Acrobat DC_Acrobat_Acrobat_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37314
                            Entropy (8bit):7.994394513924947
                            Encrypted:true
                            SSDEEP:768:DcRVDFfZ08qS/hgq3eE6Gth1lA5y0oZ3Y+LZCcJF73uLSExMEeEav4:gnDFfO8phg6sGtdAfoZ3Y+VVESv4
                            MD5:677729EFAB76C8C7C0557B6BEC970AFB
                            SHA1:723A62E2FA075864B3120F93B54C9734B9EEB1E2
                            SHA-256:5A4CC9640AB99D6E5FC61816B27043A86AF2A925B8C68DDF11E63D4ABAE366A9
                            SHA-512:F33C8266D82C496920A7273EE27D8F8D4302CBA3E3182A1411B980021E906781B7EA5FF36631073AA637083FDA548B52F3A672B5AAC82D58A1A6C04F2E8045AF
                            Malicious:true
                            Preview:....F....1......'..o.\)upf=...~.. .i....n/....Z9.'R...m.$.A..,....^$.l.#.'d.v>Oj.I_>......1.N.HB.f..*..?.c.hV..8.5..%:.M.L..i.........i.SV.X._.G-./..zj.vV........=7.>...A..E..Mco......y...z.iC..}..$......jL.H.u...n...5#.........W."Rw....?2..$..R..?-....i.....ud...|7..q8=.e....z...Tc.;..0.u.h...h..........Z.~.Y.W\`s1..n.g..e.F..E.......(g..k....2.......*].z?...........t.'2&...D..p.g..J..d..6@|.......C.....-..s.b'.#Y...m.pD._.Lq.."...M:J..W....oXS...J.d...e.P/....qW......9.?l.Y.B@.8.%.S.t3...z...8>.IV...."...../.jwp.0........F.o.L...p.)..y<oqW..g.6/....g..... N..D...........^.U..sWB..m%<.`E.$.H..37..>.b.q..79.F......[;.F....Q{..i....C.....]7:..........6F[.............r.:.`U.s.c.9..........c...e....).....[W..9..Xi\........-0....\d...4..D...h..x..F6..........F.9Lz...Q.$.d.n...kIU+....>.Z..b...ow:..rY..,/..Zj..F(...XE.Bl..o.B..^.q/t..O........-.D....^.U..G>T:...@.........-.k......KYg...ew%.1....^C.>{.,>.Rf.....y^.ss3....ge....;;......`Ah[

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Common Files_Microsoft Shared_Ink_mip_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37342
                            Entropy (8bit):7.995747524227302
                            Encrypted:true
                            SSDEEP:768:DJg7yNgwKsII18D/T8t6gMeeoRNjP0OH0R26Ak+aS:D+0gwYT8Ud2NwOHAAk+h
                            MD5:ED53064EAC45FACD9D1292610971ED19
                            SHA1:0781745150179B8607683462641F37736375B516
                            SHA-256:D8CE009198EF790F11A9A3915D0D17F427FBF91D671E133343AC6BCC7AE4DF39
                            SHA-512:70181556EB896F39C71A5F7D58B5D481C6B2ED2B52A2A3B2D8C6C783DBA123B90FEC1269F9271B4F05BB12B52A345FF114E92DE2087178C235202EA910754781
                            Malicious:true
                            Preview:.z~6.....?...W......5...8.v...v.[g..r....r.,......qux.?i.....R@.(.p.7.#>Y.'.\.2g..b;eYu.Ru...x.P...}P.R.5.`.........y.h..n..^.w(.X....k...H.......6..p.d..r..1......r./.......R..1d..JIw.......#d..r....h..:.l..uN.j...r...s...........s...P.>:4..9..q..ktp... .d..z......P..7..i....o..T...5.N..v..%{7.Ur....v-....k.(H=/....S...A.)Xt.mb....V.;Q.mu.\..(.4...7.d./7iN........@;K..0..T#.....NsF.....z...6PJ.L..L.@v..7..;._....@....%t`-bO+r...O`4....q.!..WV#\..].....>.i.(.I.f..B...).VLa...B...T..v..=....k.M.C....f....a..:.(.ps..E..5...>,f......=.....P+.......kaw...}PK.Sh...;(..ZK......<......L.ee+...1{m."..).^].VU;..^.....r.C.R.0...1.....p.3@...x.R.pq)..d92..t.......f:..WO.u...f..}.UE..+@y;Td2..c..}..y.19...*Y.J.F....]]P.....v{...P.......!.[.&.........~...:...B6...u.....b.I7Zt...4.;C.Gf..U.G.....<."4..Y.qQ.G5'..9=q=....P.....,..s.{&...s.3...{6U....R.c.}W......F...L[.=......:..%}..9.'I-|.6"@.....ORz.-..l."A&.a.l....h"".....y5.....'..1..e....../z.....$.5.!.P....

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_Windows NT_Accessories_wordpad_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37332
                            Entropy (8bit):7.994805371742599
                            Encrypted:true
                            SSDEEP:768:8KYYBySeseEC43FIU3iR6t7BaZ9KBrdHKNMfDpO7FD+JArPKKk4R1:8izeseUVIpE7BaZ9CpH7fDpO78GP+m1
                            MD5:84D3344521E694195DC3F2C655316E84
                            SHA1:C7559FE6BFAD99A20BFEE0589710E1C1BF6ACC63
                            SHA-256:9EB44961DD636B6CCBA30259C1AB0F53611C703FA0B0FDC23F56C0040E4755C5
                            SHA-512:202B0271AA4617DBA93CD30A1C26A150DF0E67B2BF5042DA233B6AED533E7CEA6F7DF64BB02655A697F2C4A99219222A278667AEB92C93211C8D1A7C91C76A1F
                            Malicious:true
                            Preview:8S.P,..-...U..|1].R.%pn;f.......IO...y..[5...s..$..XT&;.A:.Fs9.7.w.W].V..`..K..U.1..^...U...^.*QL..~rr.2^'....S~Q....a..YY]..9.....h.\^.?~.\qJ...k.v"N...XX.. ..I.+.{.k.......3......%.. |.6Hf4..+.....w%.^U....Q)........z.y..h...nb..Q...o(.....C5/l..w^k.y}$.p^...........Av.......u[K.x...+.._.z._........!...4`t.@...GF..j...j.m9a..=.5......-....=&.e.p..6.....hu.W.Z..|+Sa..:...$=1...%.......={...g..Rt.L.......|...5..73.T.U...&.K...F.R.d...*S...+.........su...`.I.a...)..P.O ..]......y. x...0;.;..}.:.. M\...p.v..N..zl..m.....(.En6...b...$._/.b0x....'......2Q.;...;D.==..4.xl..&..06..f'.M5....&8.<Jh......vo....V.../...Y.....Q.nL3...6.{....."N]...M........\V...x...O~..J1$.n#?.(7...s....S;.....R.....UV....h.-...Oo....]7@gQ..q..d...k+..l..P..u..R...4W.......K..N....m..y/:.%.P..my.7.VA..8uS.Pm.=^..e6...R...B...u....^:.n.f..c.&..X..E~.C.I..0...E`X!4...E.?.....M........^...x...>.@...IC..#.v.F...iJ..r.R......@..:\....../..+i.4.Xe_..V.Q...=....

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Au3Info_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37312
                            Entropy (8bit):7.994550512939466
                            Encrypted:true
                            SSDEEP:768:NPWASFwPO/MKUdlj/XbBqIpK30mqX9O0+Sut90Ne/LnZv+gEic0l6s2Y:deXMpdlj/bBqIu0hN5ut90O53p6s2Y
                            MD5:B513A492C1D2DB6AEC0BC820D75BA44B
                            SHA1:FBE2F4E34FE33230178A06D445D663F843EDF32B
                            SHA-256:DD3F4F3DD42101B7844FFA8335047D9C8A6A19903FE706DD02E9516629ED0E9C
                            SHA-512:151A048466306192B36D76C6CEDB6CC9AF07819ABA8C30769D7E1E163481105A6BFE31A5FB0AFF57A2C85FB3094D240768F3FA361BE7D224D5803056CB00368A
                            Malicious:true
                            Preview:.A..DR..."..d`9....I...pG.t~.$.......;%&....s..Hx.2=....o.O.G"..W......5..{.i.B..E.p..x].{1'.8..1E0n.tZl<r..}..Jn..v.a7....F.d?..$.\.;`&......=..9>..=.....gv_=.X.?l\).{r...w9$'..^..8A..".#...:....z... 8PXx..q..u........6X.eU|..L@1=.~...q..L.D+.....^.....M`...V..d.. f.Z^.%f.|6.7*..(..v..`+8i...n./..S.....b#K).A)..e..u...e..WT..W.y.<.Wf'U....Q..K....W.......;g.o.,C..I.f[....A.....'Y.S%.%;..H.X...2...A..8.....|...}N.M~.y^.K......Q...}o.....@....v.v:..........o...Kt.3..s....0.*G.".5[2.#.g.r{.E..../..(..Dg..*R5..$.......4[6..E..6..w...H.....L:..fh;...9:.!..0....\..1s..._..s...........s|&1.Q...3.pA...0.P...7...,.\..h..T4....YT#.O...s9Q`z...g.Ns.R.br...[!....W...X..T.Z..\o..P.D..0....V.....5...5....Xy..8..@0..(..............y..>_:..V(J7...^..5}...,Y.....V.......I....gI.'.....{....D$...ki..V...o~.6.....^o..?Q...hh.......9-.?...q|..Q*.Uq...0L.T.v2J!.d.v'3.G...IOD....N...o..v.....=dM..........l\..j..........5.*.!#....t....-D....9..y.Y.t.L....U...

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Au3Info_x64_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37318
                            Entropy (8bit):7.99504688679015
                            Encrypted:true
                            SSDEEP:768:dj93CGru4/SrfqgyDd57fDha/2drReFXHFQqzh4fnTaUNgrUytRs:dwGq4/JgyDvD0udrReJHufTH2s
                            MD5:F72B27A0893F4CFF4CD6A29D964DDA74
                            SHA1:506082D3A573CB1BAE018574608718E4CAF02896
                            SHA-256:1A4F5F03608011CD976777B0ED7FD53CDD20D4CD9CB9302A2C6069AE91DFBDE3
                            SHA-512:62CE0C4B826C24CC1DA22687C424F4B9E63007A913E015340391E4A6890995B050E2A31DC1F9FFE7EF47384D1B413511DF6EA255CBC4D2828EB912BB06AA2D52
                            Malicious:true
                            Preview:M.t..Lk<?....b....5...Yi.....0.-xn%&.QL?R.S./..BJ3...).nfg6..fHeH...n...P:S.g.l...V..&....]Z.Wm.,L.P......x..#..?h.H}=O"T.(2..3.O.:.^....H6.O..ed%...m.}...=c.M.V...._c.?...hO9\.}.fm..].)#.`w....q..}.+T.q:F.......s=......#....}*....../..."u..........1X.ved.F......pe......^.N. NV.t.._.W......b..YI.Y.=k.....y.R...Y%.Ei..."Z.SV.U|.y&i...H.s.2r^".5w......x0A..L...z}...G_..K.R%...R.#i...M......f.0..'.;.$(.^.).......BR.......\........x...../........U"m.o.p.A..}\..u.9I.g.zo..m...f.w.6~.....+P.4.I.8&....sE..CD...G............1.O..ub..H0..=r".:.W...%O)....x...\m.Xb3..8..\%lH\..Iz.H.~.U3.\..p..+lO~.(.I..._...k$).....Y...(.|..r].v....r.}4..^....PD..m..l...s.......=.....u.."?5....o.R}.).'#.|..|.|...b. ..N.0.s...>R...{.^.H.R.+[..^b..^q. F.h....|...YW...ShA..z..!....zY>.%.f...E.+\.....T..*.yK...n.9\.2Q.<r..Mg3...Z,..Y..BA.e.?a.....+...L+...U..........|....s.P..~W.V<..qg.....S..<6..@]..?j..}....Em..)8G5....U....l.f..N......~...........,9O.{...*..#].....

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Aut2Exe_Aut2exe_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37311
                            Entropy (8bit):7.9954990312741625
                            Encrypted:true
                            SSDEEP:768:miII3YpWVSTbs8P/33BRG/CXK95lzW96suF+N1p/b:YAcPBRGaXKXxO5f/b
                            MD5:F7682DAE4F900AD8EDE98EE98A7C4590
                            SHA1:4DA8FA0971A8D7BD8FE18D583C3E6530F655B71C
                            SHA-256:ECBA0872E2B0F8B9644920EAF48279F965D662C9600D90C2DE6E69E5DF594B19
                            SHA-512:03BFAC84ACCB8A276D0B8904B5B02E977C6ABC2DC16FFF64D2D4B5426E165E437ADBE4D0226054ACAE4C4C9891DE74696D367CC8012A435319B117938DD8636A
                            Malicious:true
                            Preview:.J.$iB.!.(.s.......Zi...o...;uI'....v}.4xM.v-..p...e..F.....j+..#.lGm>..m.K......KJ.sb#7.c@..9D..q=/. ^..Q...,..Q...M..!...Z......; ..(E......8....\.E.H..|w.$..o.ym.fO-.C.1w.S......c}..C../c.I.i.a...V7..8....AA...U?.U......)....g5...W.2bY{.1'.....6..y.5;...........:........./j.Tn6....!.r...v-nT...[...|....r..aJ.7).kf+..5.....@.L..m._.0...a..+R...U.W..W..C8K..8_6.zB..d.sSV..0q.{9_..Oz.Z..;.......:...b.0..u.%....(......~20...*h2K.R....=.@...i..Us84Q3......(..rh..~..F...+....*(.d..j...}.?.+k..U.I..Lj..L.V.....Z"=g.>.8....#..M..\rD.B.O.2..-.n...;.v.....V~..L`.D.]v.T.-..ns..&...oz.z.y.....1.Pp.xd$"'.qx.z.-Vq.I.<2H.j.......#-?.....d..!.>.#y..3...?.Z.+......}f.......?P.......]P ...[..{..O.uC../^.. Z..\3..[k.k`........</..M#.!.!_.u^Qp.t.= "Z.......XO(-#..SG....y..#@d..l..HU....R.....+.n..$i..Cn..........+.*,.6J./.T;.b...1.....B.o3h..o..)._N@.~....#..W+{.u.CU.|\..?Wi.>B.....n.....$V.D...g9.]..d..&....`Q.......T.MB..}r...........O.y#....m./...hwZ...cq%\..E

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Aut2Exe_Aut2exe_x64_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37316
                            Entropy (8bit):7.995572023145784
                            Encrypted:true
                            SSDEEP:768:ut1/gqKF9i14kjeDd0J6U48P3xOUWOiYeJFzmqDs2J8cB3+CWif3fqCO79:utm5TA6U48PBOai5JFzm12JPB3+CW8fs
                            MD5:01E5C0F7A87067BEB1FEEF1829FDAE69
                            SHA1:F022B2EE6AC3A655C74AABCD1F22FDBDCA818E04
                            SHA-256:949D5EC8E8B70C29EA5601CAAB1295D9496B7155164216D805D1078282EAA56C
                            SHA-512:C7CF18DA08C4E7BA613C455637465E9BA4A2367902CD743B3DE7C9BA5C9C464ADE7EF4B99260866F7A0B74381E9DC036E9693A4566A07EDB5ED27E886DF453C3
                            Malicious:true
                            Preview:.>..+..)..En..%.7.F. ..8.eE........6..)|..=b...Y.U/...~.......J../...T.y..8i..P.O.~(..x........E.(........D'.?....-.%.....K..[...z.O._._..s{.0..bFC.5....4...EY.>.j.......r..B^q....a...kx.3.........Js.*j.sd..&..7.5.....*G.@.+.f..~..,.......B....3*D......ec!..........5..<.@..&...$......+.W.b.R...U.u..$..X.t..o4...a.E..6t{...PTfQ4.....4s..h.+.'.......j9-....P9..EG...O2.8k].....e(..D..Y..^.!...0..A.....6.=.K..y8Ne.a51..F.`j..9.].~..nj....^BC|G.......#.Q.v'... ;...9.OJI9..Fa.)..+......,-.>.2.p...A.B...q:b.?.S.8,.M...*...Jt.7.]1.......^.9....4.e.;.c..v.n...........9Y.L.8.[...3c.i.#.V......7&..2o...4....\f...m..7.$.h....[-|%S.f".m....j..t....=".w.......0n{....\p..J.t.....i...%......V..,...cl.....=.7\.?..\...^W...vg..[Z.W=.+...K7..,#.H...ox.y..H....8$e...Y..............!......l...,.@L..y..$.}|..5.`...p.j1.....O..C......X...PQ...._.. ..#v.Y.B.k.y....-.5.T.gX.I........|r.A.'u.?q%%....#......R`......`......_TG......4.....bp;.[t..-.^:.NO}j.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt v3 Website_url.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37324
                            Entropy (8bit):7.995510290800937
                            Encrypted:true
                            SSDEEP:768:KkZuylhF7YIsK6hivHlW55Aua+tXUb6BZUYa+KxUkBsL9vM:KvOFUxSHlo5aHbYqIKJBsBE
                            MD5:78C72A254C51D54B87DE1AC9DD760D9F
                            SHA1:0D653609059B2FF60D1C39040B33191A148388FB
                            SHA-256:17D56C9DF0D1277DC68AE0BC45378A3637B615573CEFCCF3DE2FBA2030CC7C61
                            SHA-512:152A5322F0930EAC03FDE54C6D21364CC265CF61CBEA0A5509ED2EEA24D7F98EF804D4939ED48A794326CBB31523867CF8085DB1499A41EC64112104DC4F713D
                            Malicious:true
                            Preview:...-.%.a.(.\K.[.cgWpo...OS.M.l..l.R.a_....3....sB.....Z.....8....}..4G3.....<Dz.....m.Zp.X,...p.\.V3.!P*.....=w.,7!`W..V.._.#q|..v..R.*...-ii.F."...........zn./.j...p.(U+...Xit.2.q.`.....8..P3.){U.d..C..@.p.0]z._..;....R_..s."....oyt.s.Ay..71a@..../.*fH...L.b.F.}....1.^kT+.$gD.G.k(X..F.....;P.)...d..p..|..'j.fx.....r.h+n......+..P.z...C.F.U..]y.......T......m..7[~.m.E...I....1:....uZ.......>.....#......Hcu..xB..tng,..@......aL..?2.......>......k.m.....q*.r.....b...7..u.3V.v....p3..z......./).h%...A3D..(...oC6....BzK..B.V....>.J..~c+...b.R......rzS&KYe.2v..g..k&..'.u.i|..;.....M<.@.I...}..._...UP8....Ry.)..;a<....>.ja%T..9.i.i0~\....Q+.c.c%.d..*z.2U..<.......!.@ ........C|O@)..&.@..^.u.7........e..:F.ld...<......`.<..G..'.....WV,.9.-.qJ.=.mJ..6,I.X............@0eP.FK*q....6q...t.....cp.U4.+m.i..~.t5......T......~......s'....@5.....9.'..7....\.4.1.5U...IR<L.....>.....6O!....I..=8..A0./..I..I....k1gN.g.Y...g....,.Dn....Q..+F.....oS.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt3_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:OpenPGP Secret Key
                            Category:dropped
                            Size (bytes):37305
                            Entropy (8bit):7.995757980203639
                            Encrypted:true
                            SSDEEP:768:f+4SoHXgBTQy/v/sVt3QU59qLjFVhyWHTBB75Kg5pFWUpaQKbc:m47HwBh/3ihzkXcWHj75KOpIDQKbc
                            MD5:0E8447F11542DA233ADC5F29847FA890
                            SHA1:00CD3DEF0ECAFFCDA9B1119F7FD3B50A91C5601B
                            SHA-256:2615EBDA502F40BB3531A154461F612A6F9C2BBE031667011F73818E7CCABEC1
                            SHA-512:E7A54A17D0A64CAB47606B581C9A36749C756D2C9F12AAF023E277B43752CA99214E89B26B7FE5E2006250E7AB33A68C9F53CCD19BAD2BA9D713375D578F0913
                            Malicious:true
                            Preview:..v.|p....C......m....|....B.......IyS&.... s.$Mq i._.E.{.L...j"..........(l..p..`M7'....g....=..%..1.8`5.n......,.d....o.Y.r{.#j.&``~&..L.X.QNL..`.D..J.\.M....9..A.*...,......b../....3cR.h...p....63V.......=.N....I3.....s._E8..kI}.(.+....&..Iw>.;....?r.w{..6.2D.$..D...$...\..^`t.....a.pe87}.jz.h.0.~v5.!K..d..h.s....z.O.C..%.~P.....j.+&.C..."..E...7$......0.U..Y.. .E....`.R..,[#.]........{Vb.:,.S..mo.i....-.d.#~^......^.0.qR.V&.L..M..l...t.;z....7bx"nK/=LC.~..q..".kd&..$...I.ppL..S....F......:Q.X&./..d)RW..N.-..M.y..PY..'.r........3..x..c^.T......4....RM.gZ..<iOj.l.j..CmE.:K.m...._.c+'@.....).Q.. U..,o...U*..hRn........5...b...j..R<'.+z..V....d?........q..6..:C.+2"......G.S9-..OS.u,H~8..T....'...5...R&..1[.P....a.$..8.7.Q...."...."...Cy@L..\.d.5/..nm.v`.,......yR.}&.....(.t...2].... ....&..(2H.....).5~.W{`..m.NEs....7m.{._'..j..]..;.p M.1...Mb.....#.2......O..C._...PN~Uu.4...'..*.;U.}....Z...8..|..}./...u'C..;Z...5.T....

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt3_x64_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37310
                            Entropy (8bit):7.994565482447449
                            Encrypted:true
                            SSDEEP:768:jD2b7WSyIX5sTEC+2iQrMIVUzpy/Fdk9+2J6xfZOxP:X2+SyWsTqnadM4xBOd
                            MD5:E62D095EBE1C6FE8291B6B4FDB516635
                            SHA1:EEEF0A69A75AA0FB1EAB21DE75950EB1CE7AD588
                            SHA-256:2371033449FFDB0809CD4244B39686B5687224F36B2C39EA20FD5A68743A3B2B
                            SHA-512:7C491E28238F2E3220A9AE77FCA29368DC016F837AE6CB6DEAAB9ACD6765A4093B4DB8A82487249E2A07A4EFE99504E6F4807BA253C32337AF436BEB42685FC7
                            Malicious:true
                            Preview:..G&>%..}Pr7....{Z.H....h....w..tt.F.cN.x.Y....#cX..;..33/...'..*.w.^.....;vu~....H]....i+.9.......Q.........)..a..@s...V....T.S.Kp<.v..l.T.......<_../..g..c{TO...|....RG..b..].......|..{.......i...U.VD3.......{.....8D..|Z...<...3..tD]._..#{.....1<,I...........D.|..d.7H....Vhn....!....X..}.Mr....f.Ve@.....2.6'..?<,..._.v.0.......2.[..."(..5?...U'..C].sG..E...E`.'J.<.g..g5.7./[EYm`...._4...QA...@..*'#..+.q.Rw.Z.*<.{.@[..Z.......p.....M.[....n.....)...U. ...l.9.^......}....."..x.^.$..}..w....W.<...j..d.%.......Zz.......}.)f.Y.,....7... .h.jh.....Q.... ..s..eO.L..]#.y2...'#) {.G.M;0.....B.Ah.V..[..UA.U.....\....N9......Ep.F3.|....S.5[_........ea...Ck1.HBI......_.n...Y.m.U4`.T<.sc..{`..z..q..`x.i......Q.-....n.@.......,.LS!.pr.".Y.-'#...Q....V.B....l/.>u...G....-....\.....r2......s...<.~.q.*5.R..j.Q..].uA85D.......FP)..j..s...V. N.......T(.....U....E.A..?..~...'{...D......>mV....M.xr#.7y...9.....U=..l...?D..+...E5(....>;^Lm...x.7..

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoItX_AutoItX_chm.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37309
                            Entropy (8bit):7.995772480568089
                            Encrypted:true
                            SSDEEP:768:0aTHfVbdYhCUVCu6GXRe81jg8Hak+proCmcVXw2F3a3hs63O:bHfVhMCAD6IJ1EGakUoC62FKhs6e
                            MD5:42A3FDE7534AE31B1F159B0A36864498
                            SHA1:67EA79859A4C4B084D43D83BC3438FFB38E4F98A
                            SHA-256:ACBDD2603F21D93243F3084529C77E142980630D1C38043097D6EC83EB1F58CA
                            SHA-512:22484AA54A70D766A09DC0BD099F3E0D2A4D214D7F8510F7BBA238691E31BE7D414A55180F957D8FFE6E0948E828088B68D9272B8A5B4973C188C8D435A40098
                            Malicious:true
                            Preview:q.....'.#.n......%.q..O"..].....Z...c..c.T.:......g.Z>....H.......?9......f..]..._..UwZ..9..k.....q.h..'..d....^.Pg.x.u....."Z.....Vag..Q!;..l..hJ.A......Z....2bE-h.... @..7t......F......D5.....}H..{.......8.bS;vd....xI.......jtpk}M.[b.O......!X.C...e.d....\.._...,..A..9;..."^.._.R.f..Q9.e...\.... ..D...m...e.a{$.^....`X`.&nw...W.N..j.d.8...M.m..z.........d...}B.T!.ab....d.W.\D..(..Xzh.f^..W.eK.t.....Oll......w....~.!V...........`...$..bX...g>....FM.3%~.....d...{@n...=.z@F...B...U..%.r.P..'I(.)....i.?Q".,U8..Ko...V..s.TOG.x.....j.8.!Y.....j.jV.i. ..>..$....q....{..w8.;...!Q...E..Ih...%.~{.....d.y.*..o2.{.ip:....s|:=...n...p.+.]dh...y'....U.......?.mo.........?.FU...1..L......w.jx.....5..a4.(...q.....<Ba..#4I)..V*.......E._|......V....ra..L%.9.....G..m1.C.q...S.NR..K.@.:|h.VK.k..~CC.o.fD.a.2.$..{F*.4../dM..M.........34lQ0.=..g.....=DL..L.m0/z.b.H.}..."../Q.=.Y..e.?/..kq..I.[... ...-/z.I+&. h/...j`..[g..........pf...EL.5..C..).c..|...3..Y1.5%

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_AutoIt_chm.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37307
                            Entropy (8bit):7.995534135484774
                            Encrypted:true
                            SSDEEP:768:fKmEfP1TzslrbMbzs9AXqG8vxeeCDk9asBfn6fnTnQX4oH4F4rFfV9m1DPah:imqPNQVKzeqqG381Bf6DK9Oa6JU
                            MD5:E9718B654A181322FB8308195E049299
                            SHA1:F302A87860C5DF9907D60C90C5176C9C761287E6
                            SHA-256:714DA7FDF1D4EE0E45AE5BD82B4C0B94C34DCAB461BD227E3788D1E007DC54D0
                            SHA-512:EE34A4A6A3BEBA22A9469CFBCB69CE6AE3F100455917B622687AF32BD53704FF53967496E055FEC96CE567F3CE32E5B5587CD9DB25A84DD81234754873034645
                            Malicious:true
                            Preview:...s..H..G.eu*r..T......C..Wd.;.V=.5{g.i..h...2..J.#$..#..%....-..].#.N.{.1`>...w.\......l...4.g..(F..]..5|.a.../O..^.1.g...i.Q+.O7...(`...#.KT..je.H+/.6.............r+e..ldE...Sv.[.d....Q...G.qgonR...o...U........Y..0`8...w..0........[?O....G.d@..n..".U....[..`.q......Ia.kl7.L.1.U......kT.+...<e2..;.~.$......kzYC.......%...9s.%..F.2.(Pvl...K.u+..'..p-.z.J.#e.__.'.pe.pA/...:...x<N.S..o..Ox.@t...@..ED.....{9oB7]..i.zN.wG.Bx..kiE.\.}-Z...Gk..uF.W...j.^EM...?....h.....r....A........A...v.>B......E..>....,Z...q.....Yt.73......X...uY(..9;d.`.\.-.7).v.,V^.R..Y....#c..7.[...~.6.......e[P.CE.(.n.1./.hG..........f>...{8....P..h..6.Q.M!w..T..D..=1.......~.K..ry:...u.U..Zg........*O.d..>... ....d...}.......TA..N1..i-..W."....U..f.)...M+..9Q5...V....\....3...j......z0-s...W...Sw(e.e.I."....1....j.Gl..3.i_^./Xl...S.=b.....6pf.H....M...c.Yh'.....XM.@z....4.R. .Y.=..;...RBL.:....b......%O_.;..,j..V.T.lt......9...j..4....n...a...h..@._%hhK...

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Examples.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37315
                            Entropy (8bit):7.994866881707118
                            Encrypted:true
                            SSDEEP:768:AwLXbE7XrcHBwEkbv597EZI0Cnfi5h/Ta52UK1uJzzhFjBENexZKN:nHBwLbxnfi7/wN559EoxMN
                            MD5:3345B8BEBBBD0EB9E920F553F0E7D6A1
                            SHA1:3976F597075103E2640A8F74304F508AB08B4A03
                            SHA-256:A3E4F46B64DE93F43CC58831E72E1AFE012E23ACCC63C9B95A3D30C2AC64111B
                            SHA-512:C9E7CFEBACF30E1C0DD62A53932E541FD9AF881BAF0933BD65D5F60CAC813159408252348304261940C0914C1FD766C9E76F205D70CBDD0CE610CDC62C915BB2
                            Malicious:true
                            Preview:').!&&...@yv0.Wko..z...`..H........d...Z+(..[....!..{E....Vo.X4.VYO].......RR.D<".5..K..z..s:u+..4...}..q..g.N....E..vj./g.e`c.'...JyXK.{..0]....7..RI.....~.|....D..&.......v.Y...t.1Q.5....../Q..p...`......].Z..X@EQm[........1.z.&..T...=u...:...$.......Dy._=...qG..n1{.4..=z....1..<K.M(vF.p...^v\7&v}...1..:.O.....,...,t7.s.H.*C..}Cmk..`.?..i.._..Z...ns..9o.^g.....J.rT...-7..03......b.o1...R.^.T.R!\...;....i....A.Q_WKN6...........|.i.2(.%..b*9...D.....%.CEp.].j....yT<9..<.`...1.?.%.p ...Kst....]w....0@.G.w.h.*x....i.>..T.-8/.{.W4.%f\v.|K......a.....j..)q...T..UY.S.d..s..BQ....U.H..yI...L...........U.y._.[.D}'T..0...G_.^.r....y.vv....~".).?..x.`E..n.~.b.....m\...+|.....KR....au..kze.i.}..M&..6;0.L.X..W..g...3...=mu.- udS....~..]...._..M..~.......pcx...0"....{.$.,j.u..1....d....cD<..Y...d..gB3.i.C~.C..c..6d<^{.Ya4.M...{..........9~....<...q.]....+..o..dSp..H.aa.!.if.;.\....2....V=w...^.Le....'.P.(z.N..m."...U.VL...#+z.@TE:.....=O......

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_Extras.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37309
                            Entropy (8bit):7.994879288848575
                            Encrypted:true
                            SSDEEP:768:sq7QNrpLORODgV0HnNdOOk7axI+4NoD/rCZRX19tRxcUKXHxlp9RoYIA3W7:sqQVpLCO0VgNdOOQ2I+DCZv4Ucx39yYI
                            MD5:77478671E90F3D52B63A5F15B5C0D472
                            SHA1:A0BCBD856B806A3E829AEFB72DD8C06A870F76D0
                            SHA-256:EF5AE0A71C3533079EBEA5880BA084F31DA44A9CF1B7E26E27984CF74C6FAF10
                            SHA-512:FF3D32FBFA3452C4DB63BCF0293E6FC4E35DDF33F98E00BAB1C950C59B5B6F1EAB4E60401A6F21521BD00DB87632395D8B6D725F85112A674EA904A59DCC8BA1
                            Malicious:true
                            Preview:G<.1..d.a..... ....aP../.,.!.7P.....f.Y...6"..k[.. .*..~.M..0....d....ic.g.`._...r3s../v...,<.[...4i|.>a.p_...O!B.!EQ.bsv.........8i...N...;Qz...E..a+|.."./..v.6P......d..m...%3....^.9[N..m'.\\.......5....).).......I}x.6c.......Z..G...........+..$.......'k..(.=.).I..&.F...v..?....~.,MG.>..-%.h.aI.6I..>.E.y.t..W..N:%.....>.....=._.'.....{,..S.L..hA....`6bv.J......V...>.8f...[.z........Wgn..7.M_..6..k.!.dv..9...^@*....|..2....|.1..}......pW..j.zf.F.JU..9.^.=.jHT..DG}...#....G'.MPvo9..F..b.&6.....J....Bom.....(2.#?.l.b.N......Nd...`.4?;..<...g.<.U...d.....gq5.1Uks-...}!.......[.......h..Pr.(<...Y.<....+w.7.'.....s.>.J.._.%l..=y.]di.j*......U..+.v...x."......P..R.I..5.U.....9.....+~.k..._....`.26..a"Q.U.w$x.(.W..^^...%.[.;.|..N%B.._Au.-...s....f.7...Y..?.P./5.c.f\\:....0W^......6J..[..8.l.S...v.9.....I.#..&.....^rG.....x.@.|.T..%...%W.....K......*5.d..Y..t<...syOe....w.f...?.gg..r1({.f.1.....'m..f.t?.%..C.l@..+.A.l...8U...d....D...."...J

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_AutoIt3_SciTE_SciTE_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:OpenPGP Public Key
                            Category:dropped
                            Size (bytes):37314
                            Entropy (8bit):7.995621319046287
                            Encrypted:true
                            SSDEEP:768:QEjlYTZcCop7Kl2aM6okBWyaQqks5TcIu6RRI8IlRU:Q9TZ6IS60Qq+6Y8aU
                            MD5:4449B12C92578A9BA1E3DCB080D280EC
                            SHA1:7DE6C8A982DA44C085410C522C5545736922F53F
                            SHA-256:E63C7327774DD4CAA541F8BA5A57EA4DAAAB4414ABFEA4ABFF7BB6333A014064
                            SHA-512:D4464BF2492748E15C6AE1536CD5FF8DC2D3629D111DB3BD2E0BAFB1F8D1B4FB39CCBB854AFED71E90D65A4F049AD0F91A5F55DE4D3BAC2AFBFBC9629829BD86
                            Malicious:true
                            Preview:..M..=.."..q.....jQ.>1.e7&.U..c.7..!..A.......E..y..<..V.:if..$..w.c.meT.....-..z....AC..h`e_|.Q....NrA..5.}..Q....(.`...M5O...;.f{.(....|.`r.4.....:..?.;L&"...sZ.X(b${...VU!&..^'.6).......;j..i...........!}....3....Y...h.........:.Y.0...m..x.Yo..@gR..$.A.\........UB.~..X...(..$.U..Il.<..;a...f0.LE.1....u66....~.)..l.....dU.....F.........*.J.....b.....0..,.........{..e'NE...Fca.h.&.......^..g....y+.]....Rk...0:U..._........2..Sg..y.\qu.V%......^..)..G..y.q....1....(.;.GW@./...Oe.1....u.'.....W .Z.8....#..G...,.....DL.B .Cky.&..36.......,..t..``...u......i.b..!w5.......s.Jj.G.b.\%....ks4DTn... 2.[...6s...8..p......H.@3....sa.S?%..!.d.../.....|.kN....-.....9*....Y.>......Kc...[..Lz|Z.p......2...zvt.4.p.=.I.7z.c.>.a.I.pY.......q..6=..'...i...._.OM?.]..\..bo.k....1z.......~S3.'gU.:+&R.o..j.b....`..}..B....~....k..5~".......>....O.o...e#...06../.sE.N-M....Ii.yg.....xI..(.ncp..a...%...-....j...3PT.'Q......t.I...q...u.pR>........

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}_Java_jre-1_8_bin_javacpl_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37326
                            Entropy (8bit):7.996003372007904
                            Encrypted:true
                            SSDEEP:768:/yhwntfICd3ZizZqN2OAuQ6Psq9UIvTJte7LZhNv7VqQ53YGLgr0m:aSKCd38rOFP5UQLe7TtbCG2
                            MD5:6E51EE6833D59BAF0469EAF878227DFA
                            SHA1:99DB92AE28C976E130319BAEEA52B6B00AABDE63
                            SHA-256:B204E13E18889DE7A43EBD70CCEBB293566D0786EFB0A1A0C7ACA03F467471EE
                            SHA-512:D4B7C26C561980C9489B0E44F7EFDC58109C357F33405DA6D3E77721984FA5C98C707B4D322CA57CB8B672C2F21812C9C2510DF13F83995F9D9662EA8B5B4357
                            Malicious:true
                            Preview:.._.J.H..p..Y_.uk/;..)..M...1.&..GF...M:....%.0.g..1.z..<s._...c!.|rTC...e`7....A.0...Q...r..S.7w.{.........r...a.&...E9.=/..g.......7.Hs._v.......A.......h...B+x_i............d......D~....V?.5.*.7.).N.!.<.."....r.5^g....a/.v....c.1.T.....{.]F...K...V..|1.._...)..|r..?>..b...'$.........|..tO.g8..'...`L.W..w..?I..1....NI.2,..X..P..@..0l!4.N..C......-..T-...s.&.3..M.9YVo%...M3t.2.v...!....;.....s.v./.q.+.Q.....)..-..1..\.h....7kY..N-........'K:....}4.....P..1...N"3.f.=..Z.._0..t.k....i.qu,...|.....>.0....*..5.PR.k{..._.......E.kT.0.GJV9g.D.....9.w.....+G.G.`..~....,....g.x.=.].....XeL 5VM6..E.I.V4..`T....w....H...U*......x.......`z..)....-.#..c..l....\...>N_...V~....K.......b......".k.......H%DW...........h.9.g...t...........c..-%.5.....D!..k=...b..m.dQ...Ys...*SR....^...[+*{..<.0.\...|.....U\A.jlv.<...oo...,.6.`z.......$.D...8'~..%... ........WP1p.W./.<......=U....J..;.Kg........~..mhNp....s5.z..s.8rh....!".......9..n.mfxj..%.....%.\.sH|G

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_WindowsPowerShell_v1_0_PowerShell_ISE_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37336
                            Entropy (8bit):7.995819768600223
                            Encrypted:true
                            SSDEEP:768:6ftJyt0UE3+iyWMYdM9MzOsu7e7QrfkzOE4SRjwxxddm6A5P:6ftJ5UE3x+39Mn4zrsE88xxG
                            MD5:4AC347D1A784C80551ABC8C029A9970D
                            SHA1:405BA77B1E2C6CEABA9A4090E05E159BE39C1067
                            SHA-256:5808287BE01B65D11A0F5269A9D1F11355A6CD73FDA0AC96A1BBC5313770E96E
                            SHA-512:6A53D51C19AE320FB9F58FFE9D0C864512FC730899F6BFF0E79666C05B70247A500AEC793C37D68C6C11A1217A85B39B36E169B358684843565B34C16D99AD8A
                            Malicious:true
                            Preview:V_0h.c......0B-z|F..z#.!..v..s:..P....3..(..#..wJ....<...bj..../.O\e...X.p.D.kE../......E|.bty.. ....hV...vQ}/...........#....J|y..P..9x#..]Q.r.;...:.wwR%.,%.....|...=....S.S8.......g.JC{.i...Nn.p..E....I-b...h....iF.S....fP.c...z.o..2./....b.Y....R...$...h>g.p`.....&.&Z.}.A.w.F..R..d.kJx..O.YB"........Vc.F.4........*o=A....W...up.4....+...e+...........^K..Z...DW.....}....&...... .....:."..........e}..#..U...I..b.....&.....r.E...t.....c...-A4....qO.4..7.....Tqo-..S.....9.....jR..........4m..Z..dW.t.....gOmhV.^.>.H...d.rF.u....[.n.L..(.>.R.A.bhz...]...........e.... .k".....c..Dq...2........&a8..X..w.O......0....2.Cw... .|.ebH0I.E'p...2.d.\u."..FDu...........y",...,........Y.........Z.}x@..P.'...~......%#j..-....".....|LFK..$p.<...n.c.{..f..]\>o..U... u.6c=......"...'.~..i....&..:....UuK./...iz....\v......o...T..9.OQ`^...6c2..[..sdQ66.Q......S..E.*&N<.@.0........;AX.T.`..uL...L.......u....ReC....0........S.b.|.-c.#4.%2s*..,

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_WindowsPowerShell_v1_0_powershell_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37334
                            Entropy (8bit):7.995288035225939
                            Encrypted:true
                            SSDEEP:768:/VKKEOD3GsVnnnJHznRCT/Y39TaHGbPgFQmYP1SdELhH0QwtJ8zB:9K/OjVRnRn39TambPgSHP1LV0Q5B
                            MD5:588A7EB314F8856B0E044FEDD6BCC7C7
                            SHA1:C262A0B2AC7844E3FB7EC4CE7FAA4F1D6379C070
                            SHA-256:FAF8BFB62F77EB2B771DAA7CF3A087FBCD4889E07C7F1727D88A448E923573C1
                            SHA-512:DAE9522B85DCF85565F7E6068FDB4FF820909E6B0591EE88732D24FF8DC7F565394D284AC1EDD818D33D51E75B3CBE14E3877A779F4F997B4526DB9E44308C84
                            Malicious:true
                            Preview:..Q..8....m...@..V..;.!..?Eo.)...n.*.S....T..Be.........lM9...%.uQ...]^..<S.g.....<...R.....<Y..%.......i.v!k....=....U{^d.$.RM,....q.1~._...<.2..0....?...<.....j....Y.U..t#....a..k........}.k.*.J..k......,.j_.|z*.b......?..,h....f..UpC.WS`:...1.?..`4...l...e..E..{4.{.@..nP...3...|......A.h2.z.h...{k....-(..j~...s..f)...V.TE.}9.m.TA1...Fa,b".."..0.=.q1.r....G..F..'K....d&Vl.DB.....D..o}.).@....<...1`4..........%.....C1.c.JQm.xi7*.n...Y.).mi........./....D.`Ym.p.......p..(m....o..G...ri...JNWE].....$......^v2..nU.W......I...5...q.r....us..?2N.).OI.=..Q.X)+..]q.e~[..S.q.W..r.../..N.$...3W9.H.\.k{...:.xT|P..B.....*I>..R,O._........... ....6..[....<lod."g..".....9R....{-m(bI4.8'.&..5....Q...'..-.?!m._il1`,&I`....M9.g&9.i....[.....;..UZ..,..kn....t+R....3...&..(Y.7.......[ 1.....y..}#.j..8...k..6...V..Nm..f((.l...Gx...^........b.h\......VX..Q t.$...%...tP.%,..e.,.N....,0?..:6.i.8XxV$.....$....g.k.....=. A.....>xi...:Q...o-._.AE..M;Wm..n.....L...I.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27}_odbcad32_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37309
                            Entropy (8bit):7.994687796063533
                            Encrypted:true
                            SSDEEP:768:q9hG3EzkYNgrh3N3pQyg172l9lFrzpqtD8h2EC/Jqj6T5PHhOJhtPg2:qq3lYatfW17+F5qhWVCgUPBOJh7
                            MD5:4663A85834F84215A44A344917BFC01F
                            SHA1:4BE0CFB7EA29CF30F17C2B6716D849B88FC5ECC4
                            SHA-256:C7AEECBC4C0592ECEDA04311392B54970E7722F483827BA4F6AF49EB8878F473
                            SHA-512:BAF2775F7A99B79942CF60FEF433591BD97B3CEF0316A5725F4EF95B948450ADD09468598D95BAE0F8F8B9B90335B231669E3CADAF080B409F07C2E63CC6AF97
                            Malicious:true
                            Preview:BT..e.(.l.v.e....o.@.%...m.....#t..#..tA}..............FS.p.lg9<MfGB.;..N...9n.9R.#......'k...F....i..wGO.S..|....kH&M......v.2......_.G{.......k ....w~.Wt....d.]...m.YX_..R.N..K.i4.D.g'.?h..:....y.....i.;x._.....f.A....G3...8`.8...e._8....G=k,L.'#.jAYxL.hJ.....\s........%.1.^^6.o.KI.z..k....N.......$..|<....EaU...#k..I.-QTh&I.@V...............X..H..<...P.OEc......}.S...UJ...z.2..N.O...o*O.}a/........=S^........-......5QTKw[Ww..R.t1g...,..%........L{PP....1^..I..Q.u.,..LxJ..&.D~...5....sQ...Q......cH.Ct.Y..|.T.d...X.]q....)2.,..Z.2.U..mu.S.t.~d.F*...........*qh..d...x.w..@R.z..>Z.[w.....5.*.`.Hcd..20f..;Npg....#.0c.O.B.2I..v..<.k.2T.0....V.B..@.q|...}<.&P4&2.....9.f......Rj..X......B...........`...|.;.....Lv.FD._.........0v.C:....r...K(Jj.......J"..!...="....M'.-P$..e.6....o..x..T|P.~QgQ...!{X(.9A@8..^.$........@.il.l..G.EFM.....|j...L5.......:.L{u.CW.........<k.K..U...XV.#...........wT..%6.*>..kC.r......%E. ....(....>|L...G....}VA.}.D....

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{F38BF404-1D43-42F2-9305-67DE0B28FC23}_regedit_exe.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):37306
                            Entropy (8bit):7.995366008742135
                            Encrypted:true
                            SSDEEP:768:eKGF0oBrL7Qs6dbCDFIejPlnq26Tqyc2BMIDsRdRM7avPL4AUW5DI7I:gNysxNzJq28qyc1jRdmm3nUqDI7I
                            MD5:CFC486429D8810D14D3FBF3902E0D039
                            SHA1:DCD7F0CA1D6EF44EF40719902AA2D0530D6B9C6E
                            SHA-256:8E5ECB90477C6F09A07197DD07EADECE459E584E275E7A998E557E9A01D3CD44
                            SHA-512:D07B1A49A74D25668C0C5FAE563FF0D6C0BB27095072018B71AF582CA90376151BEA0A763451B1FB1877E6C441F69F29EECEC17772BCEF9C296830AB27A5BB25
                            Malicious:true
                            Preview:m.ZQK,Y.%....=\hHp.fh.........a..r.....{.....X..%.8...?.FyPz.hZ....l,2....3..-....".M..KI......O...p.&M:.N.....C..6C..../..+..6@.......>P.(..8..k..3.i....O3...vQ..C..C.K.......Z^^J\.\....n...+`%&RO.m..7.....Q....9:..f..+.;O.h{.;#Q.;...+....a.......\.|,-2..'.....?J.x<q..S..(..f~..uCDCG.[.-45....%.O.E.0Iy...+.89.........O.....h..a..2...O......}K.t.W.K.i..{.../...eP..U..&At.N.+..9...:...f#.0@.5....Wy....../....hN*NCzIn..JFw......|.|.r.-........&...N..AU...O...=N..j.="pW.f._..l...g3........(..=0..v...39h......x.a.^D.qT..2..H.w.....op....8.u.x..nm..l.D...!...L4...05g6.4E.J5....bN.'.......Y..l.k..j..`Y.j.i.L>..5.YrO_E..jP...\'...Fr..E.....2_..FM..g.v.7..c..3.j.."'Ti0z...=......7.U.,..Nx6.....#.g..pMp[.pYH..J.E......Z....Q.4....So.qx4@.Ux..!..V.'%9..ca!.~.i..|...i..1.99..,S..O.RI%....DL0'.e..tX!.xR.t...o....-*../..2<...U.-..r.G..Q<t..w.\.L..?.WV/Kl..t.AHR.x.]9.E4..5.>j...[...f...E.."...g"-h..Bj..3.2.n.e.D2wCWt'....}..1(0..r...eY/...,0...

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{880da644-c864-4aed-9e06-5b089e06c09e}\Apps.ft.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):50307
                            Entropy (8bit):7.996497211026364
                            Encrypted:true
                            SSDEEP:1536:YKvdk3WlvfPWGIcJb9p3DMV2kkIV7L0D/ouSdngh:Vlk3Cvfl9vMV2kJR0MTeh
                            MD5:3CBDD6EAFCBAA9BA1D8AA0098741BCAA
                            SHA1:C35332228CE2926C0548046B2E86028A12DC1925
                            SHA-256:5D2B8CC0C6A538293B4241B9C5F601AC9B227E98AB626571597D363FBC65B27E
                            SHA-512:8F8040A93C5C0BB8E552EE9C2FC2E0B1354507EA183D93A3EB54B0C76FB83DD6A4D22BA793ED550CC930C82769343A2054DB47F4D5A1EDBD076D7DE1B128CF16
                            Malicious:true
                            Preview:y...G.J\n....9..g....u.-3O..=...*..mw4w.j.rE..D.Y..VP........dz.x;]..4I.xd.P...M..E.j.....:#..(...@+...T...G...6........N.......:X.V....P#........ i.......W........}.2r..[?..zf......C..*.1..<...|.Z.}\........y6........2L|Q./...z...8..D.[..ZY....$...........7..7.#-...%._..S....o.^...,.-..&...vcB......U..T..B....`.........[...\....M0. Su&{[.G...99...WT.Bj..2..9.q......2..a=....w.Y4..h.ot..M.P).{.a:..=.1..9.}.T.vd*.=.Q?. ...U.....m..`.6.....Ib.....1}.h.."mb.>.f0$>...n`...1..y.[.L.,.X\..C....dTuAs..K.u..v.jv.#s..%O.Z...U...cu.?......5x.Gs..k...dR.t\...Q.!]...on....W...M....y...../...n.--.l...oD/....'..J...0e....~D...I....O.U..D.[.t.g..r.>..T.F.m..y.7B....P.o.......B..z.O5..@..oG....5....|. ...n%..f.U...vkChZ....A."....|)..L...Le'.........>dHB.)...4.?It.;..m`.....3...j"0.J.=.C...o.....z.o.Gn..|..~.0.9Dd.......X...@..tm..6g.z............Y.....".5.)..Se.i.g3.\e...U...@..x.....Y.[..A.[.%[....c..3....d..u-R.{#O.L.@....4w..bh.`OYm..#..EDR.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{880da644-c864-4aed-9e06-5b089e06c09e}\Apps.index.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1124709
                            Entropy (8bit):7.211539640838814
                            Encrypted:false
                            SSDEEP:24576:dvWCJFUZrFNw2Ud+iXvIUr7YfoyFxz8GhkDP:dFFUZXw2uvIUwf1xz8G6
                            MD5:94E137278B5F192E630A08204B89B3C8
                            SHA1:B9270598D84A5803AED1E163F0EED9E83BA01673
                            SHA-256:080A5551C39B72E1C7A4196210911D779915F8ACBEA81E21F19AC7A0A80EBDDC
                            SHA-512:E698E6F643947751E723FC9C0495677ED277B0DC0676B0E63072EDC626C4BFE4FA4AB558EA50FF43D3501B7A7FB00886405379F8FEFB7AD0D922D922C0FF44B4
                            Malicious:false
                            Preview:...BZ._..rt.aK..F[..........."..i9....Z.93r0...O..s:~]X.KB7....w..jf......}.....t...T.Evo.U-.<Bd.%...Vv..8..,E"."rj.G...Tax....a!$.L..v.....J..G.N....Y....y.i|..L...u....Mnn.....2..h/.h.v0g.......<m.5.@#8D.*+...nQ.....\...Y.f...+<n...l.KxN.9a.OD..*.R.%U.r..-.-...@L...R'...^.Tb'...SP...tO.f....z...Y....2B....3.JN.[..;&(A.E...g.y#..)!..g.....l...}...f.w..~jw..N.s[su..bYJ...so...4..?Z.\...k...M......[...U._>.ZV.........Mm.C..xG......,..jB&,...SS.k.......e...b...>.Lg!\.,?cN.J......6Vm..5..A.p..O.jz......@*D.5.......4..tW[y.9...w-.<n\....=*-......^^.$8.e.ZV..~.....X.[..xo....?@i}5..'.n.?.G...d....O.y......q..g5...(6]{.i...r.>iW.".^...x.*Lb....N...O......5..L~..2S.y......{..S..7..5.q..N..Mb.......`./.M..s^.NLv...UTz;.;......O|.&8q.C..pl.'.8.#.....K"..X. ..Y..z..5-....v..D...1..M,.....u......7.y<.F3 ..?...%.3.._....@PlA..^^tl.d.8.RbK..R@Go......v.q./M...pQ..U...".Cl..ux.P...1..&......+7..4.a+..^..o.Z..C... T...44J.x..a....GTF]....H..P

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{de0f148a-c476-467a-b7a3-14b0bb463140}\Apps.index.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1124694
                            Entropy (8bit):7.212206052687103
                            Encrypted:false
                            SSDEEP:24576:4reai4Kzkr1B5Rkl3ZXJr7YfoyFxz8GIjBDT:444KzkNeDwf1xz8GOl
                            MD5:6AF07E1D69EDBF210418619CAE0306FE
                            SHA1:B7A1037DC351A01CA36FE020787CA2BA74EAC867
                            SHA-256:20CE3EC7396858B9DCE8E399D92F2CEEE9DFC2EF13D1082ACF4F520D079AAC35
                            SHA-512:D466058302FE9AE82C264D456341541C1EA9B28A2D78CED4D7FAAB31FC4913D4846B4933B5729F81801058EA6754207D35465C0FDDFEFF363178642CCFBC1A7A
                            Malicious:false
                            Preview:{G.gGu.. .].9.r.if...P.L1.j.h.....;.?.... ...g..;.._....vq`.....N.Z.ZL..GW\.....V...A..\_1.WW@.J.p.Uu......}..{>k.....:....JOo...i...T..!YL.X...B.0.0]..y.+.].ah"...2,T7..C..e...."sXBVS...xjg..K}.B...`........*.q../...?]..!..5B1.n'......'....i.....\....)0x/..lP*uT[R.....=.6E..n.X.T....hUf........\sG?D..qww..0.9o.. 3..(..xz.8F.)/.e.\..waT....v*+e.j.G..#.q.xl^;..l....=....GA`..>..........>...fT.&I.&....{.W02...o..WC.|.].Q.... ....@......*O.$f..\[.)6..Th.h.3.z....'[..}NW.....Z.y2..x....o.<....KL.....46. .E...H'......w.?7 ...Gk..%.p....z.C(.....m.H.x.......m<?...+.{.fc....e..7.?>[.I..e.........*..$=...c.N........VCc}....b.O#...v.q.c.O.d..X..z.z#..l.] ....~*..V. .6..L.E..?N}.2..3e.7W.xWY..K..}.i.kk..<.-.@...T\[.u... ...)..C.. .%....mY...r..3.9!.(.f.u..x.m.'.\.Uhr`C2...%.......@..-....6jK..ro.p...).;9r?.]..y..............|..M..M.....v...`..y.......`........T..5.i.U..bQ..q..~iA..mH....p..U.......s.^>.c...l.N..X..X..../.]..z.&.FY&.u...|...A!Giwj.O..

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{ea91a05a-d98f-4429-81a9-272df0335447}\Apps.index.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1124694
                            Entropy (8bit):7.212888901029951
                            Encrypted:false
                            SSDEEP:24576:MjYDwh1zyXltF1BUk99HEanr7YfoyFxz8GIjBD5:QuFREYwf1xz8GO3
                            MD5:B0A3DFC865D13FCE497F66AB6F425845
                            SHA1:33E03FC2F436A641640C573DA8F6DB45367838CC
                            SHA-256:48E5A1E6D4270EF4568543ACB3A0052968970970A6174EBA7C2B396288096332
                            SHA-512:429D4A1BBC1124741CD7A177FD25524560117E46622D71E2A1F1113D0552CBD270A1E6FB2784E341F1A18EB0142185DC339B420A37F35323100FEB39F93D071C
                            Malicious:false
                            Preview:.o....-/L..i..q.O..[.J.F.@........Y.~M.C.E...r....../.......I_..D.*is.'.?..)...!@..F_..G..,m7......hm..\.I....B_.....h.X....@U..7...g.C:..h..sQ).c2.........8....m..SF>Dd)h+.^.k.^|./.ktr.|.y.,...V........&i&6.v.cH..<...C..QA!...1..... 1.I..n...,.I8.....|..T\.pc...".a..3/_0y|.6./.f.......%j...gst6....5.Q;"./s2i=........y#..Xm[.~....i...L.A.e..ya.-..p..D...tu?:)..R.R.v...u..[ w..T...<..X...Y+...^..!....0.D=...hl^..@Wr..6.8jG....._x..,...^..q:5..rE...I.:....:.....!.M.."...?_.I%..m.<Y..A.pg..qj......YM..S....>....v..o...Q.......H...H..*\......b..u<..6..n..."...=...W.N.....dK...T....4w.F.k..:...8...C`8N.8K.j...E.m.rrm>.>H.C...e.%...F..&.....%..%.&f.v.%.%R.....s.4......2.aj..p..G8VBl..7U.'.s...U.g.j...@R....|[..y.t<..\.5.p..1*'&...4........M]]...y5......Z.QS. C%8..2+.E|N...C~M...Q-....(......#.~.p&+nA.z.O;.C...z........3T.@..(.X..&....#EA..A}N.j.x....#5..{.P;+'0N..(.1S!..M4....y.........:D.R'....j...Gx?.....j..9......)...id.....1.;......m.]F.?..

                            C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4e763a36-90d3-4d6c-9949-dd01f7e5d23f}\settingsconversions.txt.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):533001
                            Entropy (8bit):7.99742769817491
                            Encrypted:true
                            SSDEEP:12288:z+UK2YP5AJviuHEALmYvNLwxR/yN/i4JUWZKSO:S7BxAJvPPKgQR6JUWZKSO
                            MD5:837D827C00C81FBF9C3EA96B4A4B1F4F
                            SHA1:2697100A52A41A0469DEB258DE96B8506517DA0D
                            SHA-256:8E5B9C04DF3BAAAFC5FB9008E06D1B307CEF737B29EBE15B91A0725606188BF3
                            SHA-512:35CA1141C87FAB412E0CC8BB06F71B1AFF4D064B66719EC693117997682A8F9B0957E16D58101A9506677DB40F261BDC5921EB70C5866C2D6643877AD16BBA2B
                            Malicious:true
                            Preview:.5>....b.7|....x.....L1B-N...C.'CW#..[.u.....&..._k...p............t......n..}.{..{..n.a..3r..@^....f.M.....\C..#dLQ=&4..2..$...8.E.|GV...e...&).t..i<.6...F&.0..e....=n.....s.......\.|&...e^.`!,DQ.y...L$(w..h...)....X...v.&}.....>.[..m=i'..J4..D...5.w.......5T>.N.A..q......d.g..q.../......s..9..-..;f{B...Z.....de.7........I7P9..../.P<..he.k&.(.h..H.y...1..........." .R.i......{...m...{n..D......o..8.>..B>[.....u..hY..p...s....nB.'r.x:..Mh.}..r...R..6..Y<L.U....U.:?..U..J....P..:..<@.'.-..-[.%G.y.....n}]+...r.......lN........9E..NG..;.}....y.S.-H.u.6..Z}.O).T......n/..d.........Vb......'.~..n[..;s...lG.\..b....<D......GY..?..q9....`.G.,..r..'.../.%.. ,..#,r.w<..SL...H...5%c.,:[-ru.."y@Y.B...Z...@iE....7h.`.........5.4..../.....j.R.....}.-C.,.8..dF..:$..Sf.m.......C*...#....k....m.a52q....K.yA..}.o....S....fC.."g.=o.(........D=.F..5GY...1....b.P.9...F.g,.......5U.Y.~.x...\..C_._..\DR...k4.]..7........[.s.....j.z.)......n.....

                            C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.971588402424934
                            Encrypted:false
                            SSDEEP:192:tW1APy0KKYod5542Ya/AaZoUixta0acr/ufJv//UYOQmMH:tkAoYYa/AaZoU+tacr/qv/MyH
                            MD5:332E9EB85C20D86DEA3A34B35D578D53
                            SHA1:F5ECB7C5AC3510ABAA75CC49F054236BE01D5888
                            SHA-256:427A12FBA7627FBAA6C8842BA9721EBFB910A73C19DF85C580CE08C42D79F625
                            SHA-512:B13C35BB397BE0897DFE3DA12DD4D38F304FCFD5E64CCD9FA5AAFE966720B680713E949395DAF8568A26B3D2149667553B4493A0E1B5CC1A5839A252B292BFD5
                            Malicious:false
                            Preview:(i.o..det....X.Z=t*B4.a.PR..[.2.O..V...5....d..........?.4.$..B...^.V..\..g.=]......f(..LP..B.G.-..(.'..'..u....F.<...Z.T{.p...D...;.......-.......HV..D-Qcy....,1C..9vN.#.-.5....wmm...B.n>...."......f.Q.x..Q1..Q.)...|..C....\d.R.).w}.......ss...*........M...A.w...d.o.NpV...........=..46+P+Q..0.....GG......S[.4.kN)"...a'..Z.."..FyU.....m.~."Nd7.T.".`....>.7]Sd.%".W.?U..~.=.....1..g......7e.Gf^...2.}.........W...?.....I.*...cw..G."._.Mq%uC..*.P.)a..2"......Dop.....X.fp.1C.nk....|T..vH[..B....p......ay.aK.....E.I....n.......L.*w.Y....v..(..`.e........@.Y..`Tb~i..,.s..T..x?Ss....~......7...c6H.........*4..1...v\....F..........j.a...EI.ck>At..t.....o.x..H....g......U..e..P.z.H..2.g....-..h!...1O...,.X.A........T..2...n.....~:..X..N.m...0.O.x.O.T.T.@n%.k......K.8._.'.b3!.!...y..pd........~@\!LH..?..]X6k!k '..\.6.#.[..........Qnw....2..4.\6=V%Bu....DA.u....s.0.....&\wev.<....n=0..s..4.r.4L....]..3..g]w..u<..yn....N..%.:.I..d....-.....Z.`1E..$.

                            C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.Xbox.TCUI_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.98054649668407
                            Encrypted:false
                            SSDEEP:192:LBqJjMBRiYIED/aaB68+lK4vR7AJMmWPpy4R7An0LXtKaVLR:LBKMdrNn8kCP/R7MQXwaVt
                            MD5:0E4B5BDC0CFCE9C005E786C0787339CD
                            SHA1:B60EEC33AF63F30BF7A9CB42FE614EDE3F0E9556
                            SHA-256:35C7E0F59209FE31C77804CCB1DE0E98BBA9B436DA0F30A84E4DB20A09AFA72D
                            SHA-512:2F3448FE59A54762E103765A9F775CFEB4CA13BC819C18C55AB935CCFB79F8DB07FF7E803EA369F0FE91D5224AF760C8CE84D1E4EB51404BFD4B19D4C3CDEF45
                            Malicious:false
                            Preview:..f_.1.fq=.\s...../."..jW.u.n@.g"..,..SV...K......}Y.nX..D.7!.<j...r0..53...)&.:......_A.CN.p.O.v.#.'9.mn...O.<UI-[1....(.....KX.H....[5..)..5.2....[...V...?,a.......{...p..R.$....^....^..Ul..B.}.x..$+Q.{K..\.i.3..D|>..vN.O..F.n.O.r.v..dwm.]?.l.....B..#.+86..e..{.(.. m..6...6.. ^...$.0.A....WS A..*?....bG$..Mj Nc.d....{.........+p....=PZ.....C..B.rv...?.G...hK.3...g...^..g..S.O.Z[...."..Ql.ZK9....&LN...&:...".......`z...5.`e]wlNo.-..".y...,S.P-.6..X...L..X........A.`..0..@zb|.,..r75.7...c.>.wF...RG.d"O..|..a2..`...:..U..D..`.Qe.?k.D..<.....h.....m..y..0(../.p...'{..b4..Q3.Qf9..43........T...i.m0T.t..-.juh..`..N[.hNn...2..){.=.{..l.%\<"T.g;...8F.J.....%u.y)..2...]. ...S........9=..B.....5.].C.......~.b...hn.h.....{.+..V....psf..VZ...k.7=.LY....co.C2_.d.g.....^...r.....'B..0.B....Q.x':`7..}r.. T.m..J....`.e..V.7..y....h*>w.-cg..uhl..q...q..,"<...[O(7.-.g..P8..J.w.9..m.^_..F.ng.f.Q._WY....E8.....h.a1I%..Z......N.N..Y!..H.Hq...%.Q...?..8.'V .Y.

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.977134392460435
                            Encrypted:false
                            SSDEEP:192:1rLhOLCKdE9g9LlvfsYWAgrkjmQH8y5bPv24KityA3UVACqg:dhOLiorWxkq+JXBKiUmUVABg
                            MD5:06D8938C81167C6905303B66B91C1362
                            SHA1:13CBFE66744C781C78468723079A9528DE138F4D
                            SHA-256:6F0847655141B42353494085B27CE73DB485B0352D166E0574BE1EA8CD021C2B
                            SHA-512:1713E3EA08E0AE595E5BAC9339311803AADC3407ACEC53B5C1A624E6F933F4758544FC4D30817FB21B222EDC35D193B946A519F00C06B84AB32C54864CC8E59D
                            Malicious:false
                            Preview:..."..t....P..3.....F-...f...X...\F......l@0....u...?z...Ms.YS........;p...n%q......w.U.z..g.;L...6.i..-..NH..O....i.4*B....-.{$.._E...B....NI...)..<7$...<.,...^.4{2d..8.1.A...{.5B.|E....4&...W...p.{:....[..Ae.. .R.........\.8..\..d.....G.4...E......z....8...8.pWD|i....g._.W...5k..>b...:..c.Z*.h.T...,l.g..,....Ne....|..#^.\/MM>ci}M.y..fllz.S.Dvc..h......#........q>.8N..#.c.....kbX...a,..5..0.=...H0.. ........p.7<..^....L...<..O[..>.X$.EE../.K.P......6...m..66yK...?P..s..-.\..$nYpl%jL8f....g...#..D..q..R.N..........k*.u..1...id.\C_....(5~7;.....2.Z..v.0L...a..a....%..*.V+........{..... xP....G.6...7..#.Y..6..@.%I ...\.S..w".ugw...V..ej......}...+a...._.!p.V.-..^2..i...c.x.i..<)"....[{...Yh.x.a9.0.K........p.~<...AX+.E.s..vY.~....:...;.zKk..y4.C>..`.UL.?...k....M"...-`...02(.,.I..."...~..nV....3...;.-.YE.......0...p....&....^..hGO...9..WO...&..b..?..........H..(V.B....u.6. A..1..w.S8:W.*.C[..`"..|.......{..5.....&.}..H.[.L.

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\LogFile_October_4_2023__16_5_0.txt.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):551
                            Entropy (8bit):7.607970834803404
                            Encrypted:false
                            SSDEEP:12:M6rwUmWkHPFwxNpcgNM3tCcuaYSA/HfYmJ8zlBE1QTOWdIowFCRYTT/N3tJRg:1rK9sppcuY3lGGTOWdI6YTT9TRg
                            MD5:DAC5DB18E858730223395B72C959DDE8
                            SHA1:9805BB6FA449AC591AFE72EB64A360D7A1C48187
                            SHA-256:2D3D133124127AB8B6573539159E160D9D440E2EBC8C49D4E7C152A32A8381C1
                            SHA-512:DC67B5C7BDDDF4D4238E5C3EF91DFE6A3A0FF9E74E42BF02EE59BEAE7C808DA49B28F8BE2FB35F9C30D99D791742AB66F5BED51CB6E25577C4E45D35458FE7DB
                            Malicious:false
                            Preview:...3...h.. ...|^...p.HP.......2..i...=%.$...i....c.......I.....>..4|N.&D......W.t.H3*N.GE.q......$.f.....{:..oF....$...k>F.5|V'..h.......{.=.z..o.9.W&...|..... 1..o$.a."9..f./hewe...5...".`.J8..>\U;..xYL..QC....N.........,..Q....`.A.._....{.."[.....l.czr.....P4L]W.C..nD.}...}.I.X1..%......2..M..p.S."....>.g....!.)(...&...)4\...&.".W.yn.^W.Z...9...@@Al.....N.._Q.%.T%u..B......Q..$V..K g`d..s..$......I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.97921495427425
                            Encrypted:false
                            SSDEEP:192:/bLwSBsVYrD7GAdFVaLQ3exj5qbJQyWUcp4Ng7xr8X:/ISrD7G/QOxjDNp4+wX
                            MD5:3BB62F0B81A07CB24F85B06BE3398B7C
                            SHA1:E1F6D4F18EC91B97C95B1D5BADAD5425B40EF969
                            SHA-256:42030564AB93C4E64DE05CB0B12D0D07ABC8DB4AF229ED92AC7065657D5EFE6F
                            SHA-512:E5F46C00CA274E2CB4623E7261ABFA4F62168AFA2BD678C7F3A7F4164338FF7076F854F9D8EA078CBAA71D189DFB19F69E53699053967820F4110E762DE41E9B
                            Malicious:false
                            Preview:.q........lp.4.r/MP..|.I.{.(......<.rMx.2....=1......*.e..q...j.Y+.H..G$.I.P...K.K-.<\...4%.b....^..!..X....>bK{s.,.....v......3..Z.....2.....j....d..Y.x..+...Gu1.....y.-.JG......U............B......o3}..#..O..Z. {..x.......*.....E..?.....6..?.F....1......m..EE..v..@7\./n8..$0'...n.......q.m........|.....A...<..I,.)7..0Q'......?.g.E5Fux...$.......F...4....-.S.....Y_..i.@.....?.yE%..5..9K.n.v...xM..E......7....o..5...3.=..6Ox..O>3}.Vo..J..D..;.#i..Ns....y.3.*.....{.......8.+.BR.>.,.-.0=.3...TR....P'.W]hp.....|@T.....{....~.5.........1...>...(z....P.4]X.ry...?.......v....o.R.....>..[v...w...ui.@.....`..L.?...i..it...o+i..........-ph..../V..p.w..4..?....x.....k/.h`.1#R.N..[...9...Q...E..`S.~..."....0........*i.e..t-<....r...A!52.,.,..t3KyD..N..V.>.P()..k.4..Bce.....U...F@.z-..L....7)<..i.8...V..m.b.......p.)6.W.O...(.Fp7.]m.p....[.......:.C....].#l.......T..-X..H). (.v..&...PB........a.Y..t..q..2.l:.W..5.0[)s....7l.).-....%...

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.976020413344321
                            Encrypted:false
                            SSDEEP:192:VhMsoYp6T/2NFenVQfyw4dnrxmw3YnfkjlVi+vh8qwP:VivLDVS4dt2mTiegP
                            MD5:324AF5F6A253B989C85DE675AC529AA7
                            SHA1:7ABA3B3E2FC61DB8DFE116C5B9009C2BDEDAE82F
                            SHA-256:8EF2FD82F8B6AF4FC9171660017D93A63751BB65FC33491E7C5FE69462BC153E
                            SHA-512:DCED439D882E3BB7825DEB6C31656608850B947F86C18144378DF3D32BA2E2A6FD9146BB8FDF63DF37DEA0C0FA028BBA1099156952D045D2AF8484935BF68007
                            Malicious:false
                            Preview:M..?.5s..p...>..vQ.......~q.....U..gN#.....`..%.x.&54..o..(^..t`.. ...........p@..O{,.{..wTj.....&@. .e....&6)..$..Cu...:.......^D.(.x..]..B..J.<.... ..q|.z.,.{5{X..l`.h.5AsHksy .....@.....A5....Qd..z.....H{...]Al}D?..I9....^o.....0...j..$....f..+..1'{.ys.O..R.6...2....4.).*..y..E...bs.m.;...XZ......Ep8....I.&4-.r|...6..f.c.(.o.a...U..r.mcQ.F..k...z7J.]V.....vUi.f,H.]U ..46.....c."._.{M(0yqyA..p7n.U.4....:..:Z..=d}.4..9..I^..&....V.$.{...B.}..,,@. .W....go7..KZm.. ,.P.b......r..Z..S....{J%3&\.JQ....R%A.Q...`B..bT....hz..HsN....h..Tp..'{GB..P[.z..^GV....<T..;P....{..`.......j.">..Ga._..B.:.7K..J....l>......0.....d....s.V6. ...e/........^..7.$..=....l..FJ..@Y...u&<.?..V==..;.$....c.....A.._z..9....A.x..._.j~}.....@....pU"#d..k.(....."....m6X.(......q..Q.>....U....^.W.Zc.A..u..*.....+....Pt...;]pR._q7J.o0+/#....a.@..].....h...<.....S..P...stq...b._:[.t.cfF.F.'R3"...e..,.C`..s.C."&.3.=..yi.E.D..f..,i....Axb..^...I<I.[9....@.....T..._....O.

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxIdentityProvider_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.97800424928661
                            Encrypted:false
                            SSDEEP:192:mycyJeTC0ZamnD7I8wKlKHjS3P97u3IhZCALEnmn3mhG:mycysTC0rI8wKAHW3PaIh66uG
                            MD5:F5F63988773BA8BCEC109490D2435857
                            SHA1:555DD65E84DF93481B5E83B71973CD372F2CEE67
                            SHA-256:25573FE5C49D2D2155CC9599E9710522561EF495E097B2617ACB3C1C73213C7D
                            SHA-512:47D25AC7339BA173D27C60E1E1571434F51F03F96C099C878C428C899EEF2BFF5F69AE0915084903004BF329CE7CCF7B7505432D0226FB838A67C4B12320E89A
                            Malicious:false
                            Preview:.S..W...~...}g..A<.Z0:....F.jS.v..:..OxnC..y.qd...&Z,....f....;!M...*.+1.|...:.g.-_K..,.....~(.Q..N....\.:..T..9F<......Z.6b..[AO~..Mq.:.....r3!.f$..K..F]_2{j.O....WQ.sl. .......+P-.O/.D...........&.....Od.4P.7c.+Q.].#`......Z.4.|.....!.kY<..lc._.BF.U.v...S>1.b...b../.H.PTR...A..D......X,jt....>e...q|/8..~#.r..*j7p..U...d.(=..S....Q?9N..}.}.oj.#$F..j....+..........6...0]U.x...D3-...i.......`....!.;..<..2.4.2l.....Pc...../?......P..C......7.{<...6GfM.OHZ.C..i..(_..:./.9....V..gS].D.....T.E.....(..........fZ.1...... .-.;.~.M...x.^..yG.I...`U=]kL1p.C$..1.?I`.Z:..e..#....n........mc.+"n...9Ux.r.U..6.I.r......P.B6....\.!..2x..t..&.4 G,N#..].....9G%l.O+~.Er.A.`H.....61~[..,X.......4^.t.A=.F...W...j.s.H...?.^/...j..e..."%..=.... {..X.Bb<.%.........9.g.o`B'.y..#..s.n5.Z....:..Y.N....5:....M.....M...&..:.*A1+..=K.e.}.bPI%.R.U.........M...h.-{.,g..\g..../.........Jd0.....Y<>..H/.v..p....I..4.....!I...$.J..d.&..{...1.....6.<?....=.v..$.+.]?...J......%(-..q.

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.XboxSpeechToTextOverlay_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.976953985067914
                            Encrypted:false
                            SSDEEP:192:ps0rkbuStSzq0LG1DaG1kwLIyMjwAcuRSyfgbIjYJvvWk/0H04diOehtlSidzgt:p+lj0LG12kWJwuYmbYxekcXV2tlVtgt
                            MD5:F9C3CFCAD9B7680253878F5DFE9482B2
                            SHA1:C2D7A735125D04BA417FDCACF53CD82989B91149
                            SHA-256:4014B6A68359FC88FF1195D5948D1E80A7890DB329BE45307E65C238D1671D53
                            SHA-512:560C2BBC637A0284856CA2348D2026A1F251FFD3CD870884AA9088429338D494E1234F57D19C281EA48E5D4A07571F9C833C7967D8B0A9611261A8A73EAB0F79
                            Malicious:false
                            Preview:......].._z....cb.>a...^q.xR.{._.b.Y..*b.6.PQ..*..A.DN...L..?-.....>S.&....j.l.&.N{..._..?Z..rW..W/.=...d..9f.X..8..u_^.R..K?..GnZ....m.3x....kT*\a.....1.....V..,...v......zc....,..S........U.......L>..."...K.h|r..p.+..G...L......|.1e.P:.O.@3....l9..c...T.V.C[.E............b.L..\............E........Zv.tO.....Jo8..Rc....H...*.C....H.I]........II.Z......1......{.8G.2X;.....}..zj.{j..i.>9|.%..t.M...I0....(OM.~..._.3...^#.....l.i3N.?Ht.....l..y..H.M...O^..).|...h..+8x..Ai./^)B..r.ih/...Q....T1., ...Q.0..wo. .?.M........&..Y.;D.20...8....2....B~.b.......4..?...>..u......n$..V}c.E.e{...9....I.0.....3..J%..CX=d."..X....i_.3v.....a.3Bq.$.$-.3_ .....G...#...E....K}....H5.y.;.rK!.He#...JVxn ...2.0..e1..l..0.&A.1..S.1.....3...;.C...'4..k .*..1..M.Rm.Ld.G.c7.....N..l...6P.sK%k.....T...y....'Y.c....8....X~B....I'4(e..x..h.+ .`x...qr...t^)RZ.c..&.;..............',{..-C...7.0..\-..j....z...E..).....g..y=.wq.8+.z..!=..l@..&.1.+8gg.n.&...|d1...Zee..s..

                            C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.YourPhone_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.979476832065256
                            Encrypted:false
                            SSDEEP:192:O81k3v+iZIbFjkh+687WY4dNR2eoQpQtDP9BdEdO:O8yYRI44IP9BKdO
                            MD5:0C6573BB2FAD8C481A13BC55C53906CF
                            SHA1:4E3BF57420EFA1B94064A296EDD1C64F18441FC6
                            SHA-256:057836A59EAE7F11C047935A8181139ADF940B6ABDBB1FCD25E99ADDAFEEB127
                            SHA-512:929B06165FD114C52B4222FB0307B59ABA3F4E0062E07E48CF788A1AB78E1E8ECDF38E319BE585F87A064C5B8614F6C49CCAD889745DC0555A8DC04FC2146F9D
                            Malicious:false
                            Preview:..T..S]...`11..d.6..B.Q!....b..h.......h.{....'.....!...N..+....Fe.o.|X.....?.h..S/.2.y.._a...). .......@......d~L.l.!\.D. N.}..h...b...&.I..J.........:.!..H..F+<..k.H..j.A.k.....bYu9...j...I.<..nV.\-pJ.S...(.@..2s...16...V...W..K.......'!..).1....N,Q...$G.zM.....S.......d..2...s".-r.*..Y.;.6..W.....Z.b...k.F.......E[x..I]..P.O..=ri]S.......7j......+.-...f!....jm6vA..!0.......`.k.+Q_.z.O. +x8.$J..rS...9..vB.[...mj...|..oMF.:.. /........cHyC...>...5.0.....;2l'.S...q...g.> ....K5.qk..oQn.....6R..i......C.!.7G'[....?F..786....H...{n..........v.3...h2..V#veK.2.jVa...B...2..D8....x_G..........R...xb.o9*.).......~6L...r1-1.|.....:/.~......OU.X.'.:.z..j.AO.\.{C..bV.p....o.I6....w..JUG..Ue5...f..ai....<x...o.V..!..zm...... 9$...=i2...Gp.,.I.rY=........L.Ko.Y.....'l4AA....)&:"+..Z.}..j.xlme.M.Vi..6.......a5+.)..T08.$&.0.....Ak...T.k._..t.3.2..C..x....;)..... g.-T..[u..@...f....S..i......[.SxPvJ4...|...k...k...k.......6.?%).....~..!..7..WJ....u+....

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneMusic_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.979492736667962
                            Encrypted:false
                            SSDEEP:192:U+RGVDKHl907if07JQ+Ns96GArc+R8riEMPnQEUl7Qg5L:9RGVDaL07LmwGAR8m1nTUVQI
                            MD5:F502F395B472BFE66901B0540745EC40
                            SHA1:C1460E69E825188416DF17DE0E05591C544F4B6A
                            SHA-256:8925150EDD5FF7CD74DFA6F732D6FEE1B0471931EFFAF7B0240CA16F47F6A3CD
                            SHA-512:DB3A1122D4F9041A5C08307ED821F57AF294671DEEC5479E123A5D8655542B511DEE41BED648ACC3D00452272177B7F61671FD08EBAE625480A67FE244CF8613
                            Malicious:false
                            Preview:Dy.cFo.\!..>.j`Nj...[X...Q.LS./$..G.j....EAE.:....J...?.D.....B..E$..4..%4T.F.b.IAh.....<........Y../.....R..{@...............y.[.A>G.,....+c..ud@.E5.Wb..rd.wZ:A=..w$...v[...,....]F.?k.E....j!.....E...a.*..}.C...XKh.V.u...._'....K....M.].eI|.....h...d.O...}.v...D`xh#F|a".\d....J5P}_.pM9H....7..#r...g.. ..F..|Bh:S...B.U...;...g*...i\..Lo....e#.[u.R.-y..[..."./.uP% .].2..S.....A..\..g."L.....*..K......g...:C..Jm>D.Z..i......h.U..QZ=.z#......Y....!l.(...;.9-......-.0.Y..g#.....S...y.Z%T:~...&.......L..2.uu*.IWK`.|..W...~.,K...L9.M]$<$H<.h..4.c....>3_[....3.+].Gf..,:.....Si..:......`..k....{....`...&.T .hL5.:[........<.ao..%...._.......f..7./.g..dEs.w.v...n...;.v.Tz.L5v.?.0..uS'-.5......@y_....+OhL.0![?...[)Z8.|.].g...s...d.3......@E..F0....l.b#y......"wF......QV..].I....)..@H.H...:.V..wy.Q.3.W.U.|.....9.J../..M..._.aw.9.......|...VA....1.+.. ...._.q...5.LT..Vt..Jn8......8.%..N.d.t......]5n..@.D....U..$..k(.P...8qm..........pa.<}./.#

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Microsoft.ZuneVideo_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.979087798445775
                            Encrypted:false
                            SSDEEP:192:mHLCy7prTGExSqq37Yho9ZCTvrg+rcTc1RyfOHdjSRy8Cwjj5pIJBET:jEIExSqqcu92vr9dHMfvj9ua
                            MD5:B9DF1D45C5493E7600A7A537A07A9FAB
                            SHA1:5609ED739934D63DB214A619F5B39F07C85FD5AE
                            SHA-256:A14DC8B9D532E3939F9CE71F07B6C645C0464F5483AA7C179E872CF3FEF66048
                            SHA-512:87C52723AEC532C0DD7ECD590F34263E4FAB16084E9FFC5067F433AA3FA9CDC20AB4E3CCA62B1BA3722BF9721AFCD341C52D658F120E4DEA85D5176BB712799D
                            Malicious:false
                            Preview:.*...P...N!...eT..k}..*..*\...h16....R......aSc....*YG..&.>%E...v.....ce.n?i.`.pWh.?..=$l..2Jh.<Ad.z)..^.T8.I.k..g.VJU....<.....L...>...S...#qo...M.,.Oq......../v.BJCE.QFB.4..A....gn_.)..S13.N.....G9...N.#'.+...c4.g.!^......*..6p.6Xrd-........"...A.........r.FjCw.{7L...(. ..T..O.4y.v$/.>.h....~......,..".m..}..h.qF......;w.cB.PcwT.,...2.r......p..].:~....q.<.).9....i..1R.].Q..j5....)m.....?..e...7......>S6=..KC&'..A(.T.;N.4.N....(...E.1(......{.....Fs..i?R......[.n[....8v...V...x./..u......o.....w..4s..{.^5>xX...4G.T@-..-U..b.$'.n.b...d&..t....R...9.g.......k...^.y{g'p._...l...W..`...I.qV.D.&..*2E...M......../..S......h..W.-..N..w..U.....<.....}..t...u....#$i<.t...hnW.J1...H._.!3....#ke.~_..?Q.bj.K...L...N...%27.g..M....U.:O<..K$.94..=g.{.>.x...d...z.H..2dB.!.,..........plX...4......t..K..qE5tn.&4...&...WVy..-..PVJ..."=d^.2~peW..aw..........7....a..b...W.'Zue...3AV....X.?......s..Q...C...u..et...kW....._.'./.(.....rl........

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\MicrosoftWindows.UndockedDevKit_cw5n1h2txyewy\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.978607273152547
                            Encrypted:false
                            SSDEEP:192:iq1XTG68aPAVz6klMtTuYV0B+EWAv4k2yeXoVHqJDFlmjQ:iq5GwAz6koTuYVACAVyXoVMFQQ
                            MD5:E38132D2DEA712C8D5502DA1EB8D0575
                            SHA1:1AE4AEF910F280ECAF7D52674E609BD4F97838D7
                            SHA-256:A59EB2863D47EA6BA61CBEED9D8880DA6B42F631AFEA953A74F71DCEAC1DDFB5
                            SHA-512:934AF1A51EFBCA5586CE946C86D9674607BA90ABFB42006367198B8A9539A065FF467C0C5385B2C4AFDDC1B114254ACC9C044E599EAD593EE97C8A95034D3F0F
                            Malicious:false
                            Preview:...u.e..!D0}..2....-. +i...w..\...m.7.,9.9.'..[.H5.ay`A.RD>..8..y.x.C.|...o6...4..k..y.T...F...,>X.FWzvv. .u.a...7'.t..^g{.r..2`)..w....^....k......B..,`.V.x]...tX.... ......SI.......;..>...1..e].L..4...x..>3....em...k.....&';e4.#1t.fXlu..^.bn.......0.Ug.>....2I.....J..6.Cn.).....1V....g..\.@j../L...K.D..e.A..v.n.C.GO].:ga...o...'.6K...8'W.%......wM`...}...C..6h.8|.........>K_.|...gCnKvT...1MZ..d.P...AUSs.J.V.N8..U...........uI?..3......*&1j..p../..m`0....U..P..@.x....~.j6.{....e&..r$.l.'<n..9..{...K.+L.Wm:|..`e.3c..........Y".n.o.....s...zV}.rC..o..Bl.M2....t,..Cc.Q.a.....]...*;.J..E...qj.....6..*.7.S.)@.>\raz...q>.".......l.DFOaH..j....x&.N.F.,'.n....s.mI......~....1.s~..E..O<Z...pS_.....g...z..-...,.1..}..S..4.)..i..V.......a.......f*?N-(....V.J'...w.Yf.f|wS....,.k.......0.Mr.....&+..4.l..kf.........:;..W1....M6..X..K...#4..e....-.WPa.....^..}ez......t'...|.N..{.....}..[..A.5i.....1-.pV.a...?m.D.-...ROQ.W}....F..C........&..."l.o.

                            C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\NcsiUwpApp_8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.978710905851294
                            Encrypted:false
                            SSDEEP:192:UQkHGl0ZS5mGMm9G+UUJg6F3ZLBUQooyS1wnr/H:yHgMm9rHC6twi+H
                            MD5:FF1B16929B41BCA9674EF6906D2B7639
                            SHA1:CE48E5E289F85CA76C8128CA7D9226DC5CAA27AA
                            SHA-256:56BAAA4425CCCC5E08CC5B4D02F37075EC56B2B6C49F4B1E0B0639FBA6DB69A6
                            SHA-512:3D303BA77F26C99C7D209F7D6D42E29BBD5C4DB182531457A4CFFC9EEFFF4AFF241119018C91E32DA13B42B9403CFD8068C7C7D718612E9B73CF3F842EA744D6
                            Malicious:false
                            Preview:MCOw...A........j.........v.....,..$..[*.........G#.h...T.h..}.4._....-.&bY#.f..)5.\...Y ....N....z...u7.>..5..0ey.b)."8..h.g.#."....B..f..\....Kgr......j.'O..(....p.ku...;@RR%...A.@P.2..#{.K%L.$...d.).+..1..ro*.....B../).Y.I..O.7...>.{L_...7.Ar.K......#.I..K....X%.....Y..Jg&.....;v.0.56..X(.E=. -.Ve.Z..q......C.......hS.n.....:V..>..6...k.GL,......rt..m..,"..4.............$?...J..fo......aD....8.6....;..$.u...s.}X.3U!m......z..{...njP.gp":...fp...D..V*+4...*...9....hF.c...N.B..........S1..7i..V..............Fx.p!......~.......'.....^......a.^.p>.c.(..K..Q..pn.....=...F"GRUL.s......r32...A.$.HW..f...+..C...0U.ij..q.S....K.P.8Vn.q.x..Tm.hC..G.....fl..x:AA.....f..C...,.W.A;.oB.H...7e/.mJ#L..(.V.^....=.q.B..L......[..@"]me.....#.hN.!.F....j...V.2).w;..v.........T.[.q.....g.\..-.....`)N.....K.h.}.Go....z.......AP.....+.@........Y.C'@.}..g.y[.i7..Q...{.....x0;..{..=..0.h5o@."..SB..l...z l;.~y ?3c....i$.{/.4...Pe.JP...X..g.#h4.E.g.e 9...K....G

                            C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.CBSPreview_cw5n1h2txyewy\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.981817028485223
                            Encrypted:false
                            SSDEEP:192:cLpCkofnzpR7XmZHALnb7opTrRpXshlS1LMrkJZ3D:6pFymUoJrLchlwMrAZ3D
                            MD5:DF9892B45FC538979F996B2964E1B7AA
                            SHA1:C66EE151718FE9B42536C7D56C3DF2E93735086F
                            SHA-256:346A01F224E3DADBBFDEFDD50397EA1D84DB072484D0A29CDEC717C4A4A4090C
                            SHA-512:B12BEFC9FCF2BE7F9A0497A3AEC2BC350DA1426117BD2E4AABC3EDB9EFCEEF0A9525F9AA8AB89BF4C12BBDC89C11FB32A2D053F6C8C1C01F7E7ACE3B1679356D
                            Malicious:false
                            Preview:O..&...s[.A{...EH.?K.b..t...|.1= .CBA....m/.R..ZWI.:I./....|..........)........M.5.......iU.,.ME..q3..........b._...R.._........Nd.]..8JC..\<.U...vH+W.*.N!.pC..w3.4....L.j{.]..L..mg..Y...T....N...Cj..@./......N....{.[....p..oV+......Q......c.n..v.c..U...3..!.e..p../..@......\...vb%{ ..>...FU..C..%.....".....W ]mP.........3@n......7.M-X.....X.f...1..I......u............bW.u.'.Uw4.........-...Q...`.|.8.v...i.z.x.Mn.2.Hg#].BeI...^.)....i.}4.h-{.H:I0b...Vz........!....%.:...AA.*?.u;9.OizG.).Ca...|.....,.... .P.4=.#v>.Q.`&\..q.o.T.5.n...s.mi.M.......iy.o.V!.].3|.Z8q^..NY$..l..'.d.V[......W8OH........H.;..J.o$h....!i.7...T1r..&.....U*>%..\..N.hQ.cP....2.s..^$....8....a.nm&..?....2...q.{.s.VV......Y.[s9..q<UV...Jg,...{6..a7....8........>....(n..Q\..._+.Rk.}u.....S:.~.F$&..5.*.....R.w.U_..2... B?E.O....^....#. ..~...p].....".L.......1.C.X......YG.....bR...|G...Y.<....Z...P0.>5.....K}.-@..B_...l....L..Bv.$.5.......2......6.&)s

                            C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\Windows.PrintDialog_cw5n1h2txyewy\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\AppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\LocalState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\RoamingState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\Settings\settings.dat.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):8431
                            Entropy (8bit):7.978192402142122
                            Encrypted:false
                            SSDEEP:192:DEmdfJnlYxkShWoEhBANzzCyH7XSXeJHp2zk2vN3ao:o8YRkoKBMOyHTLJHuvN3l
                            MD5:10B7939EEACDF055EB5969BC435DEB0B
                            SHA1:23D76087DF808D8498EFDA180956C751977AB28C
                            SHA-256:2F87A544F42BAC18F49C58E856F62C42CE9799237B4BF8B01869A6AE601B7027
                            SHA-512:85C7919416CDC1EAB7F0BA1A239F733B65D7AD6D57F9E0F9405EEF751FD2E4DCE5E362E2F32B2818EAB8D42CDEB61665548533F8CF0D4528E2D06714454F85EB
                            Malicious:false
                            Preview:.E..-,K...{...=.Du....%....G.KP.W...[....1...s7@|+n...).....!LU...[.m.......h..q..Xg.MWZ. ...(.>9.U."..wB.`.d.(:.y.^..p.{..B.E..9.m..W.~.'!..C .\..P~..=.Z6.lZ_h...P.9:...n.z.w........e..e....cF.:&..P....ln..6.....O....M,.....Y....U....%.8U..{..K./^.X9\.O...m.......L..i.`....?&.X.*.aeD5..ic.{..9?..p.....D..VQ.-...?8..... ..@...eK(..%.(..lz....2...sx..E..j.v..4.H..7..J...~H.1...J....].[.1..1f... ..-.u...*H.Z.E...a.y....d'Z.#...p..O5.....c?IpaD7..I.........[R.......%.*.....yc..-..R.....C.......Q6..$1:Ro..:'m%...Ws....._.._ls.K...H....W..E....[...e.R...:..+.....t...A.!..@.O...}2..Y.:..B7.w*.j.N.^D.x...m# .%..........T..h.\..UN.q.@..=0pB.W.b.H8..seYZ.F.._.zf.&....5y.(....N'.,.pAY...ok..[.r. <uhw.2K...BM.....X.-...D.f.....' t.,.#.H.Z..0..k....M(....)?.u...=K../0.Jv......;A2{[.qK.T....Z.wo....z.(y.n..H...%.P^5...pd.&....1.6Z...2..%~..pR......-b......T#$s.h2HY....._...,.Ec.%....~S.o.B4..[..mL...\...t..g.Z......?.C.~../T.....j..[..u.!_T......}*...

                            C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\SystemAppData\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\TempState\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\windows.immersivecontrolpanel_cw5n1h2txyewy\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\Temp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\AC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Packages\windows_ie_ac_001\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\PeerDistRepub\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\PlaceholderTileLogoFolder\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Fonts\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Licenses\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\Microsoft.WindowsAlarms\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\SettingsContainer\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Publishers\8wekyb3d8bbwe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Publishers\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\SolidDocuments\Acrobat\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\SolidDocuments\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Temp\Diagnostics\EXCEL\App1696428527628431800_6CD9E3BB-4D03-46BD-8615-75A902267162.log.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):171204
                            Entropy (8bit):7.998869585910958
                            Encrypted:true
                            SSDEEP:3072:4LxpWyjdMWYrv4VQ7TBIhi3YZaheXCG9uhwpqCBwt4zk7Su+tQ:CvWkM/rgVwTBIhr9njwt4ymtQ
                            MD5:9069ABFB02C54504451F57C11667FF6E
                            SHA1:AB0572C7BC016F6D275EA8714AA05F6E3385D549
                            SHA-256:5C438EED131FCE396872390F6C26531F6B246A378F0C6294CDC68BDE1B7990AA
                            SHA-512:1E230AFE3D400AC0F32215ED80581D51106BF88E0A88EB2EE3F6EF45904C3F231123A9CF7B2878EECD5AD14245DB07D7C3D0963DB4357820B2C1C9859E2025B4
                            Malicious:true
                            Preview:...H......6.......J.I.w...D...B.J5..`.c..fX...k....%vIT....k^'k....F..~..}./z.k...Fa#+...q|..5.....]...z...I.%......-.T...qh.....T."B...&.........h...h.^48f.`|/...w.......1....[...$..J....x.+..t.)...g.+A...ipz.v..\...&..o....R]x.d-.-..d.i..@G...1"..y.n...sn.Zs=...K<P...v.)J.:]%.v:....._..fiK.$.M..'...f.N,......zL...q.*.?...1].nou..j0.$.......s.....6..{.@W..tQ*=@..k....gV....;..3uz~z...,.m.@.$..Y}....*.fq[..0......|.*=..F....S2...v.9.Z .6..J=>...CB_..q..Jy.h2..g5N.$..\.y....?.eb..-<G.E..Z.......-B...*7........V_V.R. .J... .gOe...a....C?...&.n..X[q}.dF..eo...j.n.!r.I.<...]a...3.D...Y..HQ..0....S4g..9XD....R..Uv[.@,.A.....Q....E%..../..|2...$o:bu..,g(....W....].a.....,.:...BE.Y..Hr............Pw%........{r.8..........Lk..L_x@H..Z_._N...}.f..p.j...F.......?....g?.N..I.g>..C<t6.5..,.^}v.S.....>..C8;....H.,........B.Blh``...j..].......O...T...B.\.....Z.g.%OU..50.k.!...c..I"..........je.V...._8"...L+....2.~.t...|%.:...y.whc.w....KIJ|...

                            C:\Users\user\AppData\Local\Temp\Diagnostics\ONENOTE\App1713921509308663900_6D1069C2-A1FE-4969-8A18-9CD73AF4AF15.log

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):20971520
                            Entropy (8bit):0.015003507968368874
                            Encrypted:false
                            SSDEEP:384:66TbDywqrpp9QCLBV4J4q4j4wg4S4zV4QCAoj4lby4G2f477F4Ju:66TbDytrpp9QCLBOKP8wtnzOGjZWO
                            MD5:5089A6E26D97A86F8FB15AB944AF4FBF
                            SHA1:16B6F47760125AB21540D63DD342AE1CDB3BE1E5
                            SHA-256:DDB03FEB9EBA6D8C0416B06A715BA6D6F422F5092F50A83DE4808E7DE45D1644
                            SHA-512:4FF69BDECF37675302AEBB873312273B3F9FD7D43E0B7B55A201FFA6D8FE7024A24F5EAA19E74C4430C45DF47D20B602AF67D3D17B73E01C6419FC40364F69D8
                            Malicious:false
                            Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..04/24/2024 01:18:29.694.ONENOTE (0x12F4).0xA60.Microsoft OneNote.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":19,"Time":"2024-04-24T01:18:29.694Z","Contract":"Office.System.Activity","Activity.CV":"wmkQbf6haUmKGJzXOvSvFQ.6.1","Activity.Duration":647,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Activity.Result.Code":-2147024890,"Activity.Result.Type":"HRESULT","Activity.Result.Tag":528307459}...04/24/2024 01:18:29.694.ONENOTE (0x12F4).0xA60.Microsoft OneNote.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.ProcessIdleQueueJob","Flags":33777014401990913,"InternalSequenceNumber":21,"Time":"2024-04-24T01:18:29.694Z","Contract":"Office.System.Activity","Activity.CV":"wmkQbf6haUmKGJzXOvSvFQ.6","Activity.Duration":3266,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Data.Fail

                            C:\Users\user\AppData\Local\Temp\Diagnostics\ONENOTE\App1713921509310198200_6D1069C2-A1FE-4969-8A18-9CD73AF4AF15.log

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):20971520
                            Entropy (8bit):0.0
                            Encrypted:false
                            SSDEEP:3::
                            MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                            SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                            SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                            SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                            Malicious:false
                            Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2023-10-04 16-15-42-624.log.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):16834
                            Entropy (8bit):7.987400269623885
                            Encrypted:false
                            SSDEEP:384:LEirBjhBGK9l1kKJGV5HobSJVpsX9jopehw:zBjhlCK0OSSX9cpeK
                            MD5:889AF111BD6E5651FD1B644C5C133AE1
                            SHA1:8BC46AB75CAA805BB04F10FE9E1201DEFB1D4532
                            SHA-256:B70EFDAF46C9545430376328FD985AE776040669812B1060A1DE6A0087713CEE
                            SHA-512:BA80C42AD3127CBBA400C50EBE909B498CF7F73E451D4BDB3CA522929EF2FEF39F63A9B1A644D92966A78CD5BBA1730D88B86030C682ECB01C3B5BB933820B01
                            Malicious:false
                            Preview:.......'p!P...On.........F..8...9.....T.W.-...8..]!......ne.itP'...SPG9.H....... u....|..a....*^9../.....+.s_P..u]/.Y-5....M..B....z&J..A/9I..i.p}..kAAIe`lP.:..u..~.....u....Z.d.......p9(...n...8...^.`a..^....M.5..]...TJ......m".o..I.uw....<=.....0.0{......^.T..w....f1i.b+...9."..Z.}......%...i.......$a_.&..R...o..^K..d.C.h^.*FWy.`yfNj......et{5R...J.%.A.........bab.bx?n..q...c...>aIL:.u.....Q.0.|..{tWo.....<.mS=."......:`......yZ..p......^..e.p...Y.fh.F..F7.a.{..T.o.....yrr...)y.........y/.\...-.eer.U.K....#.g.o.f.q.|...B..)...pQ.2y..q|.c.!....Q.*.....4..D..AU..M!.p........A.......U.z......W.V..|?....oE.........o.......w..n...4..%u......B..+&......6{.....sy..<br..Y...rwC)w='..~.L{A.y5...Be.K......v..-VDz1.....IF?....B.:..+k@.)l.w.O..I.K.<.....=.'..{4=.@.7.*....t$2Jo...2......O..7..T.`..~....T..?X...H+Z..v).x...V)c..44...;...)...A6......'..X,.k.r.A..a=D/..y.+A....H.Z..w..[*30."g........l...~.</~............K.....)u.n.K.m......[.wM...`^

                            C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2023-10-04 16-15-55-956.log.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):16832
                            Entropy (8bit):7.987853699481354
                            Encrypted:false
                            SSDEEP:384:b3L8fNNLgxWKx/m7dBuXQChpBGmGjnyRV7wRREk+3obEVLtMn:jLQNNUD/mrrCjBJ+8VswgALtMn
                            MD5:48053AA4D8D1020DBE59BF692D8132D7
                            SHA1:6ED51A70A50A9D55C81A5F7A4F11D26C1B0A29ED
                            SHA-256:68328FF4ACF7DA8D70F3E4F8557A6D760FB7AD462D4B32EF4F0FA57AEA4EA66D
                            SHA-512:3E36DF1420DD1B2C38B0247918564942B655EF635A460BBD5F0A54837F539E44D479EAB58F7F360BA4F5628CF618F713FDDA898396F1D49407AD4D0368FDDD85
                            Malicious:false
                            Preview:K..T[.H.V....$.Fr#K.I.}.}K.K................H.h.....!.....5k...,....]L.. h...b.....b..F".........)...4."....F.v...E........*......X6....ecp......ia..q...F........Wi....h.m.K......~.....G.8L...7r.~.r/.........x.........G%..n..?.Q...V..A.].j..-.V.Y...zr..xI'.|... G..X..5../.<8hO.u?...J5...y.n.m.E..|..j...$.j.....jh........ m,],.....A.8.a...x^..;w...T..E.0N.].....1 ]-3...V..b?..@mK,8?..J..Md8;}.....41w.(.X...L....;.;..B...v....?....&*..v..E.b....w.;.L#...O..\.ly..6...<..J.i..U.....".p......lC)..E[....==...D...o..;.....).^.RfC..v.A*GmV....qw+Ix^...0..qGCg....S....=..+.w$.'1.WY..$.'..(..1....F..t}...+.|.t.....8lHbL5A.>...r~[.....#Aw.H..=Te.D..V_.b....,A.......~.lcO........R.g......a...-..l.O........J.A...#..5`..w...$u&.%W....>).........)Kc..qr........O=.D..P.....g.D%....B-lfD..iY.....$h...?..J...}......J\`.D.-o.......<l..hK...[...t..,wGX..C.i..R>Q>G[oP.b.-..@[eQ...4..../..CRm.k.......b.*..Y...e:'..........a0...e+&X,{.....Q5>.n..).....t<..w...

                            C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):16881
                            Entropy (8bit):7.987780008530197
                            Encrypted:false
                            SSDEEP:384:ebVqkgfRgeIdgQU+hgKK5XWLJ1bawi2nOoXg21Uo70FoN/:ebVRVdgFfWJVnOoXgnxq
                            MD5:4B038484A5185F5423FB1BCFCD7FF1AF
                            SHA1:5906D09D830142561F10786ED0E7394908952EC4
                            SHA-256:FD4A98D20855ACD2A07D628AC72410034F094A80E72ED9564A02209EB0D684AC
                            SHA-512:F46D515D4465FB69059FB8967B8C93208E4513CBC43349C7DEBBBCFFF20264F79DB78C31F03680F87A6B83672A45B6E4B4EE9916A3A6B6DF97642CF7123441C1
                            Malicious:false
                            Preview:...{J....y.H....R_...8..Si....."..&Y.5. }9.}..{5......M.).....z...........K..MD.*.....n........:.c./..pr....m..@8%..z.b'...F.N...7.....-$'0>?........Q....T.U...t.D~<...UY7ZR~..5Z3.(iB..b.s........jxq...'...7..9.+.W........P..A.coa..{.N...!.......)a..R S5...G.`.6..&X.F....i8....4..RY..i<o.....c4>....Ia.[W...[.L#T...X..+.Z..A...%W7..)....`.>...2...v....k...w....D>(nE...Z#..........3\V.....h..*9...R..<-.+....L..s..X.}/../...(..?>.......20R.....fN..gv.R....4W4. O..g.m._,...E.WV..4...Ye.....AX. &....<............t-...>;!......."...s/k.6.C....(.......q..Zn}.i...AF%............o...m.^...o..+..%.9...y?u..VbL...U.e.Mi}...g.....\.:2&K.'{E'O..Xw\B.?%.M..^...B.M`1..D...v.[Z.....o'L..\0.KaB..K.WL~|.....4..t..>.ct.iM7.....mH.G$.X....[..d...wI..9...z...I8..8.(5"'..\`......q..%^..TG...{.k@zv......G..=...\+....$y.y.1<0... O }....vP(..|...7K.I.....W5.,zb..E&}...<l.i..n..Iyz...9.....1.'..7tv.m.k...]..(.?.........h.E../...]@...(-;.Q..^...7

                            C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):24119
                            Entropy (8bit):7.992638293269023
                            Encrypted:true
                            SSDEEP:384:/UL31AL6RvYutRwTzFXMvDBjO0aLB4ct5joqa3QOf+tv+5EP1eTVEEs0Vya+58:M7FRZ7gSvDBy3Lh94Otm5EPwO6V+S
                            MD5:CF4A7A0BA9454B877CE30B9166924467
                            SHA1:028B577230608A3ED810BCD4AFE8F44999E5A6B5
                            SHA-256:A8D6203D38BFB1F5A3A675943740CE4AC601C73771ACEE542B3D68DF21A543CF
                            SHA-512:FE355C262CD3FB4ADC4EE1E49BA537358C8518A1FDD5F95D6CF5CCCF28AC530BC0F0C55FBD25C4074B5F9E155DE0511AD0CAF508382015D5E8B87BAA84F67360
                            Malicious:true
                            Preview:u. .%...j.[.D~c....,hh.q...+.A]..}..M.[3.d...}....s..i$c'.,s.`..."....F..6..|.....g.!{.#..D.G..x.@.Sk..E.r......xl..I.0....#.F):.u.t.w??..?5.....~.)&n.h).D..h&...s;k.-...V..v.."X...~4.....A.Q...bU.C{.}.}yJ..=,"+..!X..^.S.-.*|..M.%.....Ae#q_s.F.N.v.:...Zi........g.[-GW..e...g@..7.....M9...#.sE+2e..W.j.......b..."/..^V+mf..AfWG.#<#.c.c.b....%p....Z.5"4.l..X.\:.l.]m.~..,..9F....u.........J&...n-..i......'.u....0..(.<...k.c.I...I._..r.m..^.. ..gOe..*...:'......e........:b"....s/....=s..._....f9X.8G."....E,..x.eZ.P.....B..U.q.sxe=..JT..[..k..=.....+.%H2.q1..?zo.:-.bxz*:$.w].....r.@.S..x..DU..S..#.....Z[..T.K:.i...u..m...].@..szX+.%.(e.....N.p.... T.k06.J$V._^&...j..Y.R..?.q.........>....0}D.~...y%...d...|..K.2.RERw.J.v2.,*/.eE.h.`.tC.........(S.Z.......#...J.+{s.R55...U.[(...d..R...W/.%.l.hM..u...XcVeLu.....Sb.J...A.i....l.......9.8.R7..=._..S.Ur..}....C..pA!o.EO..K..2$.Qg.rZ. x0.......v.9.........)...C..7..q7.....P..P..-P....9.m=.vh:........

                            C:\Users\user\AppData\Local\Temp\{0130A2F4-568A-4422-90AD-62E7D39BEC2B}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):109698
                            Entropy (8bit):7.954100577911302
                            Encrypted:false
                            SSDEEP:3072:rDlmvIWr0aRtNCfShCWBxyCHMlcVG0Ezy4FR:rDliIfot8ahCWBcCHDVwR
                            MD5:8D804A60E86627383BED6280ED62F1CF
                            SHA1:E23FF14B10AD0762DD67FBA3CD6EFC85647C0384
                            SHA-256:494547E566FB7A63DD429EB0699FE41AA8998F8EA2F758D813FE3D56C3075719
                            SHA-512:0FB19F3D00159F2748C3A54E952E551B9FEA6910D67A54DECA8D099992E50383EADB92768FF1F75CFFAE82A7A157B1E0F77A2F0BE7EC64FD2324304FDCA46577
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...............................................................................................!"#.123..AQB$..aq.RCS...b..c4%..rs..D&....5E6'..TdUte...u.....FV...7.......................!"..1A2B..QaqR.#.br3.........C%...$5.....c4U..Eeu&SsD.6T..................?.....O.C.....^..R<A.g...[....3.....r.0.....nX.S....}...[.?Z.....A.?..~~I..rY|N.o...9......!...o7r../-.y...'5.3.U.s".-.0.1......SS...&.Q.j.*.$m.e..:x....`}...EP.?.7..~G(so.......O.....z.N..<....~^a.e...........p9.?<._..|......~.<@.D.9..G..?.?z.y?z.C.U.w..[.,..A.+........s......g...G.^....pz.xY.....d8.y.X...P..O(A.O..~:._.......<...o..4s..^.^b..x......_a.....|{c...:..X.....}.._...[?..NK.c...}.<......H.G....+x.Z..|....n...o....`.nk.#.%x......-|...|7......N!=././..w.8x.".8....'x........w...,>....j[w8a..}..lS..?.

                            C:\Users\user\AppData\Local\Temp\{02224A25-BD0C-404B-9F68-8E7D2FAE987F}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 85 x 470, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):11197
                            Entropy (8bit):7.975073010774664
                            Encrypted:false
                            SSDEEP:192:p9wNdtRKcVHso6zsqm06xaqZdingVzLZ7/PGSIz/yycRTbChh/JzhbEx15RGb:mdtMcVHqgAqTinMzLZ7/uSIz/yTR/mhF
                            MD5:DDC3CC30794277500EFE4BC6667EC123
                            SHA1:EFC9642C1F95B5FC38764476AE481649C016FA0C
                            SHA-256:7F5B660A1A0BF46C75AAF19B4F77A0E086DE003EC03AFC1F58D871D55AA5BA9E
                            SHA-512:25232A84604C3959634D33090238FEC8D51E40AD84EB3A08BB8522A81BE1E83378649C014E98E1DFCDF46B7BFAC92D8D2429211CD11D7EE0334C9C3DF7C1B6A6
                            Malicious:false
                            Preview:.PNG........IHDR...U.........1x5.....PLTE....................................e........................................................s...............x..........................o..............................................................................................................................................................~.............................m...............................................j...............................................p.......z......................................................x..............|........................................v.......................y..........................................................h...........................................................................P..{....bKGD....H....cmPPJCmp0712....H.s...(SIDATx^.}i@S..N....h...!..)....AI%..p.L."a..)..`U..,h..:O.b.:.j+.Z).b..zN.s..{O...&|..N}...${....~.....k}.[k}{.o^.D_..W:35ly..7rL....6n0.A...b

                            C:\Users\user\AppData\Local\Temp\{04CD563E-376E-4D2E-AEA0-BEEA11C54F53}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 700x114, components 3
                            Category:dropped
                            Size (bytes):2266
                            Entropy (8bit):5.563021222358941
                            Encrypted:false
                            SSDEEP:24:TuRCTP9rSTfIEe1HbcVY1YbDXq8eCI0bf2QQe0GVDQAzZw:aRCTN7HbcW1YbDXq+I07Ien0AVw
                            MD5:DB8A181E3F0EAD4A9472099E42ED6BE3
                            SHA1:92096AF05CC6167B1AA816811A1160B809393FA2
                            SHA-256:E9746B4E9AE9CE7B3B0068779DB3E113E2DFC9880F25373D745D0E700E69A906
                            SHA-512:A9E246E10E28D057090BA9F034ECE6131780D7F794C5C9421523388997C7EDFBB49BC32B863B6C6668911B359C304AA54969B48CB9234950D5CECD2A6F3EFFF8
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666......r...........................................5.......................!1AQ..2a...."Rq..#3BSr..C..................................................................?...X.....U...j...F.W.V]'KV.uWt.iT...{.......`.(.....V%..=.....z......V..ct+.U.B...@.............................................{.....5.........0...x4....c..;...........+......|.7E.%.9.1+}..d.........+.V#.P.HUL.E...g.li...8.>U.";0pi.]5.\..zo..."@.........................................y.6.mLN..S.....@...i..A..p.......~|V9.+.Xy.........+,L.....7Z7..p...-X...\.....:-...i....v.1...-..H....9.zk....l....^.......:.."^.t.Q.F...X..B..$............................................a.%f&3..1.5+.X..'b7bwr.).e.x....!...H...aa_..kD...b..g..p..K^.k..qX.[,.........Q...U..x...YMvj...w..:k.....j.W.8..4....c.u.}m.....o.=@.......j.S.t.|.....5h.y.%.~...G

                            C:\Users\user\AppData\Local\Temp\{0700BE6A-4A3B-40D1-87B2-E8B4A2A6E447}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:15:20], progressive, precision 8, 604x784, components 3
                            Category:dropped
                            Size (bytes):140755
                            Entropy (8bit):7.9013245181576695
                            Encrypted:false
                            SSDEEP:3072:i/aDiblRsFcOco8dofE5Zx1+NQI8Wh9aiOe5NTO:mnbM+TxaAi98W3aiOwTO
                            MD5:CC087700C07D674D69AFDFDA0FA9825C
                            SHA1:F11113DF69DACDB255C6CBCFB29C1D1CCE40B346
                            SHA-256:A7FA7F092EFF43030A56342C39A765F8D5CC48C7DB815DDFC8C1E5EC40117FAE
                            SHA-512:843202D975EFA91E73287052A893584B6E5AE601F91612B56539AA2F73D1AD3F997FCAD1E711E0F483A2E91D46D9643D0B026B43F4E94116A5D2FB6551536034
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:15:20.............................\.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.......J...\O.,......../$..........OE.m.o......T....Z..l.g.-....m.?...Y....3......"....].j.X.k.S.k.....4..R....{....?F.

                            C:\Users\user\AppData\Local\Temp\{07F5978D-A37A-4786-AE83-C7E3C6B9280C}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                            Category:dropped
                            Size (bytes):24268
                            Entropy (8bit):6.946124661664625
                            Encrypted:false
                            SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                            MD5:3CD906D179F59DDFA112510C7E996351
                            SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                            SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                            SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                            C:\Users\user\AppData\Local\Temp\{090C8C58-A003-46F5-B999-4B856B89E97E}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:19:29], progressive, precision 8, 221x792, components 3
                            Category:dropped
                            Size (bytes):24268
                            Entropy (8bit):6.946124661664625
                            Encrypted:false
                            SSDEEP:384:d2wiieoHTRh5a1HAteZCWOZIM+L7WhNjYn:8wHFHJ+/OZIKhNO
                            MD5:3CD906D179F59DDFA112510C7E996351
                            SHA1:48CDB3685606EDD79D5BCDF0D7267B8B1CCBD5A8
                            SHA-256:1591FD26E7FFF5BE97431D0ED3D0ADE5CFC5FA74E3D7EC282FD242160CE68C1F
                            SHA-512:2048CBA13AF532FF2BCC7B8B40541993234BD1A8AB6DE47B889AF3F3E4571F9C5A22996D0B1C16DD6603233F6066A1A2A97C16A6020BEDD0826B83BAD0075512
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:19:29.....................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................$.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....)......[]t.\Z..g......A....&D.$LH._..X..Xl...`....cZ.X.........>......f.Z.X...]..~L.S..@..I$..I.IO.....x...s.g.[f.h{9..

                            C:\Users\user\AppData\Local\Temp\{0CF337E3-DD7A-4DA3-9079-48B2FC91C3C0}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 50 x 556, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):977
                            Entropy (8bit):7.231269197132181
                            Encrypted:false
                            SSDEEP:12:6v/7QiFJaY/z+obuqFA4fypjQSbtBK+lcqNGSbb7XTJArRRzN5DjNRkPmu5cCbR2:x0QY7xbjy9pY0JPXLTWroeuCCbX0
                            MD5:B7F74C18002A81A578A4EE60C407A8D3
                            SHA1:70A7D4BB1B3ADF4397D168AD0D81B286F88EBDE0
                            SHA-256:95F59A0433050180D4C0E8858B83363D51BEA6752A8B7CA516A8677854D8F5B6
                            SHA-512:13186A7CDCE80BCA9D2238666D6D7A989FA1887EABFA5D8A9A63EEC304DFD4BE8EFF652205FA56E1D1CEE7D3680AF8C70A952AF73AB3C246400E8D4EBECBDBA9
                            Malicious:false
                            Preview:.PNG........IHDR...2...,........A....PLTE...................................................................................................................................................................................$.y.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^...0.D_.......cck.....%a...X.a0Y...-..!.G...[....(.r.H.$...1 .zq.4V.e|a.6.X..4..kl.%....=w....6..TN.....{.4..T/.z...../.....3..!~..t.#b..^.....E!.SFb ...-.....^...,..C.!.b...i._c...s.X.w.. lsQH..H.gKc@@...i. ....m...;Ci....@G.; V{..lO..\.R9e$..{.....P...E.+.2.0D.B,..P...56.?......K.6..TN....^z.4..T/.z...../.....3..!~..t.]b........E!.SFb ...-.....^...,..C.!.b...i._c..Y.O...?.9k2.M.?5 .n.P...,...d._..%M?....6....,.1..R.4.a.R.+..U.Q..P...vd..T........j .]@....."..lJ../.90.4...Y. ...9.%...{......Hc%.....i..%M?aG..H....o.q.......4.......X.d9.r..CI.O.5.Ri0?.s\b....w...>/k..4V.)Y....P...vd..T........j .]@....."..lJ../.90..2..MP..l..?....K.X.....IEND.B`.

                            C:\Users\user\AppData\Local\Temp\{10BAECA8-78E8-40EC-9134-FCEB6B9B40AF}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 105x441, components 3
                            Category:dropped
                            Size (bytes):2268
                            Entropy (8bit):7.384274251000273
                            Encrypted:false
                            SSDEEP:48:N9YMn9H5gXlM26vroVXWxyNnl1LmLR+rn4FOeewGhDbby:/h9SlMdgm09ll8R2/rby
                            MD5:09A7AE94AA8E517298A9618A13D6E0E2
                            SHA1:FA5181A7414BA32F816BF0C4278EC20C615E8B1A
                            SHA-256:3C68C7EE798E62A4A99C740153F3980D7DF029605C843410942C7F85E794823B
                            SHA-512:074E9A2BE2039D0AFEAD360157550B934FABD0CB86B5AF476C1FBC885EE60331F5A68EAF70BF76E23C8248A20FB900346839F4AA8892370B5889E64948DCC6E2
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........i..".......................................3......................!.A..1Q."q.2BRa.b...#$................................... .......................!12AqQ.............?..D.z.4....;.....7...3.t<!..d.O.....+O+.;.z6.4cz7E.........U.Z)-..@..y...........}(W...<.xv/...5.ew......yN....n.Tk.Tm.Ty.vA=...T..U....h...e.8.5%....'......e^......L.g.$.~e..O.._...... .F`.....xnL.<.......]jfv...}..\G..c.......-%...#.C.|.].`..^..W..c..B..5D.QSTaZ.5A=....BU..z%.4.h.6..=..U...W.$..l...7.:...........IPQT_...~..i..x....~.l.|.n.J..TV.21.Tg.....................j.z!+.-............"j.j...)*..TT...."....T.Tc.**j..............j.z!*.h...&.&.&..e.%..TksTW%G.?".l+$..c._9..[x...TU..........i~X..#'.qm?ttO.....}*.i...q.....9..r..?..W..d.w...f;..q...tZh..0.....2.......OD%Q-.......$......56.K.O...y._..*_C.k..p9.p..O..vu...'........0v

                            C:\Users\user\AppData\Local\Temp\{18F3F3CD-00BF-4773-8456-9441895BC747}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 17x608, components 3
                            Category:dropped
                            Size (bytes):1873
                            Entropy (8bit):7.534961703340853
                            Encrypted:false
                            SSDEEP:48:N9YMw9kGzE4xTdow1C3kyIkyM66KeJY3fOxJ:/h8HzE4xTdoUCUyxyD6LCvSJ
                            MD5:4FC8500BD304AD127AF4B5E269DFF59B
                            SHA1:9A5E3432358A0FCDECE86AEB967319B93A65D14A
                            SHA-256:B4DAA90D5A53FCBC85119050B5B76962443C4DD18D7F42CDC6D4E0AD8EFAD872
                            SHA-512:E5E07054A522EB91EFD39722AFB3776389632B8F5F923C1D29796716D68CEC93BE5E44F79913804CEC7ED631FF520CBBBAAB841E01FB90AF8E8ADF84DCD47481
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......`...."........................................>.......................tu.....45.!#$%1s."fr...2Fq..AQe.Eav............................... .........................!AQR.............?..e4.bbu."m.G......u.S.-Qq.b.a..'#..E.......u.|:.f[O..jS.S.&....=.....[.....S...N.~~...'...q....N.T.Oyf..a.6..%.I.1j.e~.4..[5.WW.Y..Xp.gn...u.......Gb.O.W..k.!mJgfq....~.F.......m..}bn4.5........s,F...z.b)..O..*...5).-.-\....=`.fP....%...A..Q.&..9.....QQbD.%.:u.f...r$.10..W.F.T..MI...9...ZQH._..).....D..n.F].........*.:.j...!6Z..S....0...B.6..Ga..S.O.....U8S_.J.>...i..?..<.P..........M..F.T.C..7.E...`.4BKcMh1j....4y...+.|.^......2[.WG.W..+......E..r/V^".R...."..6..hht..f...........;E..Kx....)}Le.A.x.>..$/).._S.n.L......}..H^Sw...2. .v.io...../.........x.>..$/).._S.n.t^;O.....n...[.S...h.v.io...../....:/...[..7yK.c-

                            C:\Users\user\AppData\Local\Temp\{1BF2E1EE-5129-4F12-882D-096959F747C3}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):14177
                            Entropy (8bit):5.705782002886174
                            Encrypted:false
                            SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                            MD5:7CDCE7EEBF795998DA6CAC11D363291C
                            SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                            SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                            SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                            C:\Users\user\AppData\Local\Temp\{21AABCE3-1B8A-480D-8730-C11F26AB34F8}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):25622
                            Entropy (8bit):7.058784902089801
                            Encrypted:false
                            SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                            MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                            SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                            SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                            SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                            C:\Users\user\AppData\Local\Temp\{22C29F19-1111-487D-B8FB-9E5A0590B457}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                            Category:dropped
                            Size (bytes):68633
                            Entropy (8bit):7.709776384921022
                            Encrypted:false
                            SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                            MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                            SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                            SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                            SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                            C:\Users\user\AppData\Local\Temp\{2417700B-DA80-4026-9434-6569CD3C379B}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 76x97, components 3
                            Category:dropped
                            Size (bytes):784
                            Entropy (8bit):6.962539208465222
                            Encrypted:false
                            SSDEEP:12:869YM8fij0W/xfuCp7ovv1bidiMn3bGi6AETQcdH8SADjoZgV6v9jUEvS3/g:N9YMWeI424diMn3yinsQeHvADu9QEvJ
                            MD5:14105A831FE32590E52C2E2E41879624
                            SHA1:078FA63FC7DB5830E9059DF02D56882240429D90
                            SHA-256:D0A3A1C3CD63C4023FE5716CBE2C211307D0E277E444D9EF76C7FC097A845FD4
                            SHA-512:8FC0ED24E8EC14C46EA523D9265DE28F85C5FC57AA54AD5B9CA162E95F79221E2AD3DD67D1293CF756B67F3D3DECAE122254134EA8D4D00DDED02114B5383947
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......a.L..".......................................-........................!A."1.Qbq....2Ba.........................................................1............?.....3.Ty\......vs....>.>..a.W..s89.d...Z}......rz...`...Z.r.do....u.W.%....gf.>.L..xz....B8=w...g.~g."HD...$..IKJ......nn..*ly..I....L...\q...Q;6.KrxZ.,...j$..ZQ..)f...q`.*..C1..cZ2]-..\.~..J.....^..(.f..9m?..C.NI.UL..X.fy.Z.........+n....r."Z...d..R./\.#...kd.D.5.!...h.3*s-+.......Xjt..}i..rK..y.../>u..]N.....Y..J......1.x./.....F6.......I...._3...k.sM.+..v;.%|.f.~.......:y....S....UKovh...W'........lF... .................

                            C:\Users\user\AppData\Local\Temp\{258F3E7F-D16F-4C7B-8F32-1B5F483675C4}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):39010
                            Entropy (8bit):7.362726513389497
                            Encrypted:false
                            SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                            MD5:9700DE02720CDB5A45EDE51F1A4647EC
                            SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                            SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                            SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                            C:\Users\user\AppData\Local\Temp\{28A34B27-0DA8-4FF1-876A-74E46567BC9C}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):136726
                            Entropy (8bit):7.973487854173386
                            Encrypted:false
                            SSDEEP:3072:SIXmy5Tl704vW2ZKkvV8UU0ZWUF0BJwySIdgz816YzDc1+opecYPn:Sny5Tl704fZFV8UU6LGXwyS4xohpQPn
                            MD5:4A2472AC2A9434E35701362D1C56EDDF
                            SHA1:16FA2EA2D2808D75445896E03B67A93000EEDDD8
                            SHA-256:505F731CB7707EFAB2EB06685B392DC7E59265A40B55AAE43E5DC15C0A86CBA4
                            SHA-512:5E28D8FB2AC62ED270968072A30013334461F7CAE96058AF9EAA6E10912989DC47112D2133892BF61F7A516B77C6FF71BA2A000B750A9F95C787E538B09595C2
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQaq".....2B....R#..b3...r...C$...X.....Sc...9.%'.(Hs4Dgw..T..5GW.x.)......................!.1..AQa"2.q.......B..#c........b6.Rr.3s$.&..S...C4.%5............?.........(......(......(......(......(......(......(......(.G/.GE&...)..P.x..B.({i2Y;.z?G...Yfc.)H..^....#.....}3..Sc^.H..+...M.a.P.....GS.....H_.3..<....1f........1.<.\..nn-..s.s.\9Y....=.......S.0.......N..cA..Io..r.3..........ay.....K.....,.;9..Q......xO.Fa.2..>........{4k.....|....?U....3.8..._/3....#.. t.y......yY.......e.<........#.....B.....Z.%.Y..S.ye.W4...l.......X...%.@y}>....l.yi..D..W......L..._D.Q....)...E....n.%...*..K.4#.8`..I....h..h.o..I......-...hB...3..u.(5..........n...,.@....a.t.9.....@.s.>.&...@

                            C:\Users\user\AppData\Local\Temp\{2B82B155-27A7-4D54-8974-8F14D2E2959D}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                            Category:dropped
                            Size (bytes):22203
                            Entropy (8bit):6.977175130747846
                            Encrypted:false
                            SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                            MD5:2D3128554F6286809B2C8E99DE5FD3F6
                            SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                            SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                            SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                            Malicious:false
                            Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                            C:\Users\user\AppData\Local\Temp\{2D19665B-1AC5-4595-93EF-68BDEECFA41B}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):60924
                            Entropy (8bit):7.758472758205366
                            Encrypted:false
                            SSDEEP:1536:kU7O7+CFqO6DkxTgPzo2wqggrrX8QvN1I/ZLBttB9+dPFXbc:hVuqJDaTqo2wq1L84N1I/Z1tT9X
                            MD5:D58C51D2CF586A5E14A9EC8529C3B0A8
                            SHA1:F4811A353797C29B1E3F5A61B125C46E1534D587
                            SHA-256:F927C7825851974A2149868146970706523A49165133CEE6027A43E8C9ABDF27
                            SHA-512:34B963173AFBDF07432F4B983D29F10376E4771FE666E9D50B1A81DA0B9F6001FD86B4A08B9711386DE153BF6E03C8E932E2D181C8EAF94EFF34D20FCA7570E0
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d................................................................................................!1AQ.aq....".....2B...Rbr#.s.4...3$.5u.6v..CSc...DT..f..t..&F........................!1..A.Qaq....."2....B.s....Rbr..#4...35...CSc.$...DTdt..%..............?....O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.........................................................yK..xd...6..|%....\j..e.=...Y..f..I.|-....e...$R.j.......~.W#....{.....V.k.|F..z^..:.~..f......"x.....L..K..r../.;..[..l...;.U...W...X.........8.....y?..B...m.......j..Q.g3..G.K....GL.o..n7a..Y..[.'.........x........\......~...f...0\Wc.n?k.|.....1.ww;..2..?...r4uF.MXdB6..W..mG2NJ.E........u...2.q...Z..=(l)jU.X...U.\X.......O<......X.O.Fg..{.W&u.u.T~.|r;g!.._X..N.p.4.......................................................

                            C:\Users\user\AppData\Local\Temp\{2E753830-1256-441A-A54D-8BF92ABC656F}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 40 x 617, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):827
                            Entropy (8bit):7.23139555596658
                            Encrypted:false
                            SSDEEP:12:6v/7Hs2NwBW1mtjeSfaTHHy05riYUtr8y8PQvPYzzg979Reip0QPqc:oOsotazy4rStr8y8PQIzWea0Qv
                            MD5:3E675D61F588462FB452342B14BCF9C0
                            SHA1:86B62019BC3C5BE48B654256B5D10293FC8C842A
                            SHA-256:639EADAD468B6B32B9124B1F4395A8DA3027FF7258D102173BA070AE2ED541AE
                            SHA-512:E6EA855B642ED36FA82F8E469A826DC57EB0C36E307045FF8D166F67AF9242C87840833BE31FBE4706DC54100E999D6A3D3A78D0633A3114735818874AD34758
                            Malicious:false
                            Preview:.PNG........IHDR...(...i..........`PLTE...................................................................................................bKGD....H....cmPPJCmp0712....H.s....qIDATx^...0.Cg.;......@j..2c.=~KP.[H~..@..8...?U.g.n.a=.=.).....3..u^(.....L....5..........8.}..T.f.n.a=.=.).....3..u^(.....L..r....s..8.....W]....,..9..G?.a..`c.z...E.p...)Y.P.....#....@9.7].....,..9..G?.a..`c.z...E.p...)Y.P...`b....0.b.+~{.Pu...1..<..0._.l.@O.y.(...V3%..J....s... .(g.+.qyWu...1..<..0._.l.@O.y.(...V3%...%R.L.Q..x..R.<t.o......7.............:/.E..j.da@i..`b..Z......u.>.?...7.............:/.E..j.da@.Dj..9.W....s. .....:.......L...">w..7... .....:..."...L..."..a....D..Ya.l....E.{.@&.|.._...7..D..Ya.l.....{.@&.|....0.J.."z.0s..s....=g ..>........"z.0s..s....=g ..>..l..1...y..g......IEND.B`.

                            C:\Users\user\AppData\Local\Temp\{2F5B0DA3-A6F9-4F00-8E88-21E3D4D08D0A}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 88 x 574, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):19920
                            Entropy (8bit):7.987696084459766
                            Encrypted:false
                            SSDEEP:384:DRSgtAxJx7bzvAsVSqQElOT4uHmpmvNYT9aPU+QtsC2LgfIqJZnbeyRB:DsgaN7bzvAsVdK4uGQFUZ6bU/p3
                            MD5:1BDAD9B3B6DE549162F9567697389E1C
                            SHA1:5D9C09159F07A3A9BDCC6C4B9BD9CB72D0184E6F
                            SHA-256:0908A4CFA23F93011176D47F45843E9CA2973030421996E8E27484781F54B0EC
                            SHA-512:475040779AC247BB5C3E11862FB55FBDDFA12D759EE86A33E11BC1F3B656D6CD0F9B25146C0113E43E1D8001D8867D3BC3BF7E6FE21F3A0016CB1F8B70B7A15A
                            Malicious:false
                            Preview:.PNG........IHDR...X...>......y=h....PLTE..................................t........iw..............................................._n|...Tds...ky......................................................p~.....................................................dr.................v.............................................n{.......ap}..........x.....z...................u......................|..Vfu............r.....w........................................~...................Zjx...................................Yiw............w..|....................Xgv{.....y...........................jx..............\lz.........}..z.....t..[ky........u..y.....gu................................{..........}.....u....................~...........y....r.....bKGD....H....cmPPJCmp0712....H.s...JfIDATx^...\.W./.}....Sy...(..4....D.-.....H...% .$"D.Qr.......`..;...6...N......s...^...L.....Y{.GQU`..~...j....{...-Ax.K..&.....F..I\i..

                            C:\Users\user\AppData\Local\Temp\{30742484-7F9A-4895-A497-A50543553024}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 14x341, components 3
                            Category:dropped
                            Size (bytes):3361
                            Entropy (8bit):7.619405839796034
                            Encrypted:false
                            SSDEEP:96:zDqnxqMt6gGr/Nln5ANln5ANln5ANln5ANln5ANln5ANln5ANllHN6:CxqMQr/rn5Arn5Arn5Arn5Arn5Arn5AN
                            MD5:A994063FF2ABEB78917C5382B2F5FA8C
                            SHA1:BD5C4D816B04A2B6596DFE38DB01228F553FACCC
                            SHA-256:D72900E8DA72D1A7F3729971AA558E1E9B6E9CF9A0D51E83852E567256DBBFEF
                            SHA-512:CF2279033DD3EDFE6F6F9E5C517BEBD9A52863EEFD90F57F7A5AE0E0485E705254BE7ED6B50E6CA142669687727AE85E2E6035F69930B75F2E6D3EEFA961EF88
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................................................C.......................................................................U..........................................>...............................8H........59...$%&7F#'Ddf.....................................>.................................58EG........!#124$%&ACFbcde............?...n.p..v..a.~.._.>......#....8.....w.G...&.W...i...%6m..K;...4."...=..?.~......P..O...j.l..AW.jo..,..=d.h.ta..../.."...z|).J.......Ww._..<Wp.3+8...-5...G:..2.D..I>o..K.F;-.....#...`...6..T...M.....OOgV~..5...np...P..TYr...........b..{r.2.9..].DA.%C....=.v.z......CK."..R..l..y}.i..;.{....JzS.....~.?..Z....=c.h~*..p.@(@..G.....O.]...Hsd.xf".V]..S"..w...4e>....3*U.7..|M.x...|\......FD./.cIe.;.bId..+=...w.......[.k>....}.u...j.xZ.....Q4..+.....B....1O~\......I..h....LaXJ%&.w.<C...n/`.W..U.W.U.}~...}>..^.0.J.....@....LN.b.......5W...m].Eu...:....G..:4.=4ixx..@_0=.mab.T.U.....w..~.V.

                            C:\Users\user\AppData\Local\Temp\{3100D9A8-A98E-4EFD-970E-FF235A0B1C4B}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 3005 x 184, 8-bit/color RGBA, non-interlaced
                            Category:dropped
                            Size (bytes):12180
                            Entropy (8bit):5.318266117301791
                            Encrypted:false
                            SSDEEP:96:k1bHyG/fKOOOOQJUg+g2S+kEm6alfsfsfn32:+bSG/yOOOOQ+g+gOab32
                            MD5:5C859FF69B3A271A9AAB08DFA21E8894
                            SHA1:3156302A7450ADFF4D1B6EC893E955D3764D4DD4
                            SHA-256:B4A8E9A67EE0B897615AC4CCE388FFC175AB92D9E192E6875C79A4E7C1B5BB6E
                            SHA-512:4CF518136EEBCA4F400A115D9B7BB0CAC9FA650BF910B99E15F04A259B7D3EFCFFD6796886FE09DB08C37C332B14BC8500845C09C8EAE1F2306F90E98D3C99E0
                            Malicious:false
                            Preview:.PNG........IHDR..............;j.....sRGB.........pHYs..........+..../9IDATx^...dW...S=.dL$.............-.`...'...x.7.D...(...$.?cO....9S]=.v...Z.......{..wNuf.&.....a.k5~...._..\.yk..v.....}{._.Q...5...._9o.n.....}7.].1v..t......q....3.<..0<.p.......0....s...... @....... @....... @....... @....... @...X.'..U-..... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%@....... @....... @....... @....... @....... @....../)m.. @....... @....... @....... @....... @....... @ ....`.)....... @....... @....... @....... @....... @....K.0.....J....... @....... @....... @....... @....... @...`.....\.... @....... @....... @....... @....... @......,I......+..... @....... @....... @....... @....... @........z...r.. @....... @....... @....... @....... @....... .$.C.KJ[.... @....... @....... @....... @....... @........&`.=X`.%

                            C:\Users\user\AppData\Local\Temp\{3374CECA-E99A-4971-9855-A007E5C6CE73}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 780x107, components 3
                            Category:dropped
                            Size (bytes):2898
                            Entropy (8bit):7.551512280854713
                            Encrypted:false
                            SSDEEP:48:N9YMTXc4gpw+EIWnqQ5G+NE9VTzRFvS4+Xh+AKrNx+JuCluc3Eeky8etajhDCFex:/hDc4rPIoNEzbS4+XhOrGJu1cUHeoVey
                            MD5:7C7D9922101488124D2E4666709198AC
                            SHA1:00CC44A1B84D4D94A0ACE8834491EB5F65D04619
                            SHA-256:20016E5FA1A32DCE5AF4E92872597E36432185A7BB2E61C91F362BD68484529B
                            SHA-512:882944B2CF040485899128E03B7499C540D481E45FE8017DBF4FE0330157B2D8ABB7334DDB31C112BA0EFE3722A554883917C54155A7F60044D2D7F3D848260F
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......k....".......................................2...........................c.....TUb...Sa...QRqr..............................!.....................Q...R..!..............?...$.)m.1...%%bV.J..H....-.%a[...I"WJ..:.X.:TT.$.......N.-NR.E..-NR.E...9..E....$.k.....B.I,I)..J...kr..+)..I,Yj..YbI..+,J..e..Z..V.e.$V..TV.X..V.YQZ.EQ..U%PY[.[.R.EP............................| F.. ...j*...!m.!j.I%.j.$...YeEYYEEUE..eY[.hEEUeEil.....%..el...V..TUYA.U.UTTUT.Z..UQQUQE...V.,...UlE.U[.lEP.P.@......................................R1...AR1m.....#..$:.T.p..IJ.t.....A..AH.,5..]F!a.XJFaa. ..a.!*.aa. X.e.......bB.b..,HX[,!..,,.c0.,..U..X..(,,...B(.,..4..B.`..".a..-......"...........................>D..IKEb...t.....)u.....)K.%+L\.J]i)*b.JR.IIL\i)u....T............T.....qs.it.iJ...])ZJb.....X....U.A...V1..B.R1....X...,.c...,%X...,%#0...,H

                            C:\Users\user\AppData\Local\Temp\{375BBF80-705C-42DB-9949-AFD7D1F03C64}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 176 x 513, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):11043
                            Entropy (8bit):7.96811228801767
                            Encrypted:false
                            SSDEEP:192:YyroOCsBI9pkCFsHHX2RE6VOlPuIqmBtJNBfAr+ADP1IATaNeTyZ4GF+WQQ6Qwq2:BUOCsB2kCGH32RiPDtDBfArPDP1I/eyM
                            MD5:8E9AB9C28B155A66BC5C0DA5E2A4EFB5
                            SHA1:972E61F162D48F1CEE21963ECBB2FE439105DB55
                            SHA-256:B243A24FA13BC8523450E22F408F9EFF15301C938F8CA52A57018B58CE6785DE
                            SHA-512:12062D69E676B3B34AFCEF25AC17B40294282D5BAB6C0110680293D7CC96EC17EBCFE104C284E64A30EE3C483E319E9C37C03F6EE82C79632180E45C7A684E8C
                            Malicious:false
                            Preview:.PNG........IHDR..............`....`PLTE............................................................................................... .......bKGD....H....cmPPJCmp0712....H.s...*YIDATx^.]...,.N.8.i......0..e..y.......8.6....Fo.........=...F..._..........O..{..............3.|.L.|.............>.....v..n.1J...k...."....7........J._.5LQ`..k...._Z.W.x:..k...g..._.....u<.Q{...1...q6.cs...l............30.g...< W...a.5..>O....9}..c..........s|I.).>.fo4.<q......>...c.:.u..co.#.7,.O..G./.K.|..q.p...(.(....iH.......m..+.7...../..{W.l....b....?.`^.q.9L&.>.hN2`1..m...]$.0J....rBy......{.._...G....;.r.Q..;..,...9..F...t;.+..2.Ub......V...8.k..5.........'[..s.H..).......%j._.&.....BN..V..q...T...#..........0.E&.o7....$..m..8g.f._$..k.8...5......HgQ...L..\.........)B.I.r.(..8.a..$N.9.=..o..Q..(.e.a..O.....c.= .......$0..X.S,..(p......$..l.c.I...=."......g....^..#~,&.a9iK..ZNE`...pFJ.@Wd?.<..Bt.E.......e...i.%d...}.!..B......9.........B}.....5...;..hL.D.....4z.....|.)

                            C:\Users\user\AppData\Local\Temp\{38678B9F-7EF3-4350-BEC7-50C9D2F80298}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):41893
                            Entropy (8bit):7.52654558351485
                            Encrypted:false
                            SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                            MD5:F25427EFECFEE786D5A9F630726DD140
                            SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                            SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                            SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                            C:\Users\user\AppData\Local\Temp\{3AF98CC9-1BB5-4F10-B19C-B043E30FFDE5}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 728x77, components 3
                            Category:dropped
                            Size (bytes):2695
                            Entropy (8bit):7.434963358385164
                            Encrypted:false
                            SSDEEP:48:N9YMsguOZgKAz2vcaQU4R8r4BU0/Rc4nbIQdsohw13ZmFLY6KsVvMdBL2mr:/hsEgNz2v5T/rQC67SoWniHK4EdBH
                            MD5:B23DE98D5B4AFC269ED7EBFDDECE9716
                            SHA1:10AF507A8079293A9AE0E3B96CF63A949B4588AA
                            SHA-256:646586CB71742A2369A529876B41AF6A472C35CC508D1AE5D8395D55784814F2
                            SHA-512:BBACBE205EC0A4F4E3AB7E2B1DEE36FCF087DDF77C7D18B53AEA4B15984A47C64E19F9B8D8FA568620619CEA0361D94FE7ABEA6E502EC6ECAEFE957F42ED7EE8
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......M....".......................................,.......................1....!ABQRq.2a."CbS.......................................................Qa1A............?....{............i........l..-D.q.~..|cS.S...R\..d.8,!.....]f$....Q..di.;~5......vj......MqCe..=.*.f^..=.}.Cm]qCd..s=..u.e..v..t'.,.....S.s..N...>.d4'.,..k...N...d..9....G...y....6J.Y.l.{Vf...^B..i.3.z....:5W#4@.S\fj.%..Mb.5.v.5......S.E..#.v.I.....I......m..H....D..|.Y|...W.Wf..o..U.0.E..@.T.....................................'.S../...Z......!J..1K..rI...T.f.>.+.N..o.....\..^u........e..q.qK.GXP..-...F8".;5J...]Y......j.a.,R.......J.N........z}<qu..J.)`.}X:..}.............B...[. ......,B.).b.......(Y.O....c\.o.e&.W.#Bo..N|..N8.#J.>1D.1..b.&....q.#..UT%,.d.....m&..^...VXA..b.nbTV~.....^........q..#./.I..=Q..=..Y.*.Ib...VZ+......Y.........'.

                            C:\Users\user\AppData\Local\Temp\{3E584006-4F2D-497A-BA48-211FB8751967}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 814x45, components 3
                            Category:dropped
                            Size (bytes):1717
                            Entropy (8bit):7.154087739587035
                            Encrypted:false
                            SSDEEP:48:N9YMzO6BOfqH/dAIWpdAIWpdAIWpdAIWUtr/SD:/hzJgfqHaPYPYPYPUt/i
                            MD5:943371B39CA847674998535110462220
                            SHA1:5CA79B7BD7E0E93271463FAEF3280F1644CBA073
                            SHA-256:9C552717E8D5079BBB226948641FF13532DF3D7BE434C6CE545F1692FA57D45A
                            SHA-512:812541836C8B6F356A4D530E5CCF1CFDCC4CA54AF048CAC19FE86707CE5EA0F41D73C501821AC627AD330291EF58C040DFC017923A7886CEEC308048DA2CE7C9
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......-...."........................................&.....................U.....1T..S.R.Q.................................................R....Q.a............?..d.. ...............................................+A...Z+E...V+E...U..R.....}........Q..Ah....Ah..b.AX..b.PZ+A...V+E...V..J*....Q...b.Q..Ah....Ah..b.Ah..b.PZ*.(.@z.?.`;2.......................................................Q...b.Q..EZ*.(..Z>.G.....`Z+E......J*....F+D...F+E.......b.Q...h....PZ+E...V+E......J*....F+D...F+E..............[u#...a-...f<.9^[...l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m..0.....l0..H..6.Kn.t...&..3a...GG...[u#..8.y6.q..%.R:8....6a.+.3..a-....l0..H..9^M..f..m..3a...GM.q..m..6.Kn.tq..%.R:l.W.lg...[u#...a-...f.r..c8.....f..m.

                            C:\Users\user\AppData\Local\Temp\{3F13C43B-7490-4095-BBD0-6FCCFC0ED283}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:26:15], progressive, precision 8, 216x792, components 3
                            Category:dropped
                            Size (bytes):64118
                            Entropy (8bit):7.742974333356952
                            Encrypted:false
                            SSDEEP:1536:ORG4azGOKXzkEmR4bdRSbxONOoz0khbSb4J/5GZK5SWUlRwUYdv1M:ZXzGXzJdhRmgHfIb4J/5GZK5SWUldYdq
                            MD5:864EEA0336F8628AE4A1ED46D4406807
                            SHA1:CFCD7A751DFDBE52A20C03EE0C60FDFFA7A45B93
                            SHA-256:7CE10D1EA660D2F9CF8B704F3FAB2966A4CE2627D9858D32C75D857095012098
                            SHA-512:0CAA0C54C14571C279A75F0D5922F78A17803CF6EE1724D66819F7F5944C0F5B25CB586BB686A52808CDF2F8FEB3E4864052A914884054EF7DE44124A8CA951E
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:26:15.....................................................................................(.....................&...........s.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................#.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....NC+n....<.=.7..&.8A56..@^.Q..\\...E.>..".&G.......J .'....$.I)........0.../..mv...D....<v0=..ugc+..l.o...=.c.......x.&D..{`8...v

                            C:\Users\user\AppData\Local\Temp\{41544495-B078-4D68-8C40-A1F6C3C008D0}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                            Category:dropped
                            Size (bytes):59832
                            Entropy (8bit):7.308211468398169
                            Encrypted:false
                            SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                            MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                            SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                            SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                            SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                            Malicious:false
                            Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                            C:\Users\user\AppData\Local\Temp\{4AB89337-7F6B-4F71-ADAF-4888A1DD04F0}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):15740
                            Entropy (8bit):6.0674556182683945
                            Encrypted:false
                            SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                            MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                            SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                            SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                            SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                            C:\Users\user\AppData\Local\Temp\{4C14EAC4-BF4E-4109-9116-97A2672BDC4D}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:11:38], progressive, precision 8, 577x757, components 3
                            Category:dropped
                            Size (bytes):84097
                            Entropy (8bit):7.78862495530604
                            Encrypted:false
                            SSDEEP:1536:cgHTEuD99rHwA5MSadIV2MApVmfJkAKOQ/Z1I7ngpDDyHfKFVITrU:HHjXidIhApV88/jIEmrU
                            MD5:37EED97290E8ECB46A576C84F0810568
                            SHA1:18D9FACB4CFA3CBF63B882CABCF30B203EDF4126
                            SHA-256:140DD943D0F0CFE6AAA98470B7D1A7CB62CA02CB1D8F522DD2AC77433232EF41
                            SHA-512:E0F57314C136211B8253EB2AC0093DED82198E7170D4F97C40D82FD4EC4123D2AAFE3EB4EBC3E7523C4DF4D77619408773871BDE15B6DC6C4049C71D5B9D4222
                            Malicious:false
                            Preview:......JFIF.....H.H.....hExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:11:38.............................A.......................................................&.(.................................2.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................z.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....b.xH......T..I...S.q.~..../s.R.x.....8.a..vE.5...-.G.A.4...._......$K..d.@NC.q....J.....>e".I.%...I0).R.I$........M3.F .

                            C:\Users\user\AppData\Local\Temp\{4E295A1E-E8A8-4DCA-9D39-0BA1C40CFFE0}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:06:24], progressive, precision 8, 38x792, components 3
                            Category:dropped
                            Size (bytes):22203
                            Entropy (8bit):6.977175130747846
                            Encrypted:false
                            SSDEEP:192:5q3R1VBvq3R1Flrk6Q0QPJJrR39joOVMJ25d1NkMhIwobbtAAAqYnLJZMJYZ2AC:xw6Q0WJR3FoOVMJIIlAAAqYnMJdD
                            MD5:2D3128554F6286809B2C8E99DE5FD3F6
                            SHA1:FC42CB04151D36F448093BDEFE33031A9B8D797D
                            SHA-256:14FA2D16310485AA1CE41F6D774A3D637E8CF8B03C4F72990155DF274FDB6BD9
                            SHA-512:D8531247A6E89ECABEA9C4A78F596CCE3493334EDF71AE4F7998FDDD0F80705948609C89756AB56FDFAB6D04DEC5F699A693801A772CA2EE2465BDD2CE5D2D5A
                            Malicious:false
                            Preview:......JFIF.....H.H.....XExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:06:24............................&.........................................................(.....................&...........*.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...H.....Go.Kxn.b..g...........%?_....O......q......7G......%%.V..8zm.].v?...jJ~._..>.......O;........o..rI.A.....n.a.........

                            C:\Users\user\AppData\Local\Temp\{5224BAFB-0D59-4142-932C-315C28B30681}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 70x626, components 3
                            Category:dropped
                            Size (bytes):3428
                            Entropy (8bit):7.766473352510893
                            Encrypted:false
                            SSDEEP:96:/hdu7isPwAp7zesusUyYAatNG87llTONQYS:5di5tfuQ9atNZlaC
                            MD5:EE9E2DF458733B61333E8A82F7A2613D
                            SHA1:A86704C969F51B86D6A05ED51C6C60214ED9FA89
                            SHA-256:BE4F0E6C89FCE91B9EBD2623567F7DFC259E0E3C77C9158742B8F64B724DF673
                            SHA-512:BFB5D6DD6B66EE21E946E90D1E482384CD10244308562DDA814189602681DADDE5752B80519E5B8515F115A71BD6BB4317A59BE65B8B5E3474AED119F8303569
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......r.F.."........................................H............................!Qaq.."12.....#3ARbr...$B...cd...&CSu.....................................+.......................12..aAQ.!#q.."................?...#...3.Za......rV.5&...../"..i.t...j..W........d.FL.V.2K....]t.f.d.NK..:.....f...... ......2.[...#..D...ZK....p.z.E.N..T..L.-....1....2.\.6FIr2..zS\U#..........fB\t..5J..~q...D....A.......!....MY..../.HY..../e.M.Y.n.~..,....'..Pc...l...d2..m.f.it$..qx-z*...._..].cOO....n..&.....FIA.....2J2..d:<qc..6.I.G.N....f.K..Dx.-.......`....2.FZ."K7.r}..<.P.Z.da.Y.....8..s....G.....b.e..g .S.......FL.Z,&..q.MG.J+..x\..m...qN=.....)..`...&Y...S....u6{.z.g.....@......FL.ZL&.Iv.w..8....U..v...*.q.B.v_./A..#.#.g.j........*J;...u...W.Ao...%....#$.....M..^\{W.SO...s,.N.....c).,.B.Gv...."k..z."..S]H.

                            C:\Users\user\AppData\Local\Temp\{5706FB81-BC66-4DC7-BC07-B1F742B859FD}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:05:55], progressive, precision 8, 612x618, components 3
                            Category:dropped
                            Size (bytes):68633
                            Entropy (8bit):7.709776384921022
                            Encrypted:false
                            SSDEEP:1536:tapXpSTJDOkFGdJdBk/slsbfsw1imaapnbvD8:U2OjJr6b07m1bvD8
                            MD5:41241EE59AB7BC9EB34784E3BCE31CB4
                            SHA1:98680761A51E9199CF3C89F68B5309FBEC7EE3CB
                            SHA-256:035B26DF61855A3F36DBD30FDAB0C157C04C9E8AE2197EA4D4AEB3E82E6A4C2B
                            SHA-512:3EE331D5BCEE4AD5D3FC9661D4AB4053F7D351591A094334F963C33C9D0E32CCCABE9334AD7C308108CE99617E064FE848DCD469ACD8D83FBE5C4452DE523D8F
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:05:55.............................d...........j...........................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?../$.W:SZ./...9.....-...u......r.....].c...@W_.7...+......v.+PD.I..-<1.pDn-\.....p.$....0.}V....\..>.~..XN.o..l(E....ik..o.

                            C:\Users\user\AppData\Local\Temp\{58EFEE19-235A-4772-93B1-6E665BB412AD}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 95x498, components 3
                            Category:dropped
                            Size (bytes):3009
                            Entropy (8bit):7.493528353751471
                            Encrypted:false
                            SSDEEP:48:aRCTf+0hagMrbAZMJShPdvF/5OzlQFlDF7npkDdWvVBTEnBLT6NrgCX0:D+0YgMrApL553JtEdEVcL2NcX
                            MD5:D9BD80D40B458EDB2A318F639561579A
                            SHA1:83BA01519F3C7C1525C2EA4C2D9B40F28B2F2E5E
                            SHA-256:509A6945FACFB3DDC7BE6EE8B82797AD0C72DB5755486EE878125A959CC09B59
                            SHA-512:C368499667028180A922DD015980C29865AEF4A890C83E87AE29F6A27DC323DD729E6FB1C34A2168A148E6A7A972F65A5FC8ACE6981AF1D4E7057D99681CB366
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................... ! ..''**''555556666666666...C......................&.....&,$ $,(+&&&+(//,,//666666666666666........_.........................................:.......................r.!12BQ...3Aaq.."CRb.....#4$c.S.....................................................1A............?..p..-.....u0$.......l......)..o.FTd..DG....... .t*e..jO..Z.U......r..j.O.,..VD./.....V5D.&......A..Zi....E.N....*..........#..M<|.2.Y.../QO.x.cTM4......+.F;V.x.de*....]e..O.x.c\Y........r..j.O.,..T...hw..k.^.[B..J.sEl.w.x.m.5%zzt0..T.......b..<\.3Q..W</..!.xh6..Z..\.+M.o.Y..1............#.........|.a.l.KR>..U......e....@...\.1Z...Y...[....F.6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....Uh....FkYm.m`P...W .V.g..FjVj.\..1Q6.t.#..Z,.x.Q..[`.X......#........W</..TM..-H...V....Tf..........r..j.x.df.f.....#..l.KR>..U......e....@...\.1Z...Y..Y.us....D.)....

                            C:\Users\user\AppData\Local\Temp\{59333DCE-1175-4B0C-AEA1-106E4B9D1D78}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 77 x 627, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):5136
                            Entropy (8bit):7.622045262603241
                            Encrypted:false
                            SSDEEP:96:djzuNKb3XHco17p2wolIxIx7lpskdsC/ddWNKeabJbMojpxLDTu1:VzuNKb397pwlIxKp7qs3bJb5FBTw
                            MD5:FA38AFA965141EA3F17863EE8DCCDE61
                            SHA1:2B4611E651AF7549C1AA73932B1136B561A7602F
                            SHA-256:E1CB1A0EC9BE62D5445C73AA84DF38234002A7E164EE830C9DF24997802CB5D2
                            SHA-512:A372674F5CA343321BA9C413D346070709F7685706C9C6C3DC7F61846B59253A5E6FE800DBA10AE870FD3887439B2AA106FBBB51751E92A163938A4393C43E28
                            Malicious:false
                            Preview:.PNG........IHDR...M...s.....}8nv....PLTE.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................z`.....tRNS...................................................................................................................................................................................

                            C:\Users\user\AppData\Local\Temp\{5E8FE9E5-2EE6-4E4E-8B38-3A7F9CD03C16}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):40035
                            Entropy (8bit):7.360144465307449
                            Encrypted:false
                            SSDEEP:768:MQhziQo1RKGlyyzYjlxuxwRUj/BN837xRmwH2uDTCn8qXFQziN:ThzrSzalg6O563l4uTC8q1Ig
                            MD5:B1DDD365D87605F96D72042CB56572F6
                            SHA1:ADF71DAD1A62B8A58A657C2EDBDD665A19EB846B
                            SHA-256:06E09DE80C3F32254DA4FE6B2CBAD7C05EF144DD54B8C65745E195BBF7317A2E
                            SHA-512:9C686092CC9524F34EA6CEC9AAE936A6225BCC54DE38DE1786EBA8F532959A80FF885E8664A09E4C318D7CA4B278E807D3D1F135BE55F30979B844FF5EC9699A
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!1....AQ.aq.....".3.5...2B#s.$%..Rr.CS4&6...bE'7.c.DTtU...d.eu...VFfv.Gw.....Wg......................!...1AQaq........"2..4..Rbr#3$...B.s5Cc.S%.D............?..^.f....R*.N{.{f.....O.r.V.;U..~...U.(..>M._.yI.{8,..^.t...s`...j.O..U5t.&&..h.G.6Da.;.....J.......E..QD...C...}..N...tR.....~..].J:.V$.*.r......]...W......4.[.)6..Y_.....4...........m._'HR.a......]U=.....n...0.W..]..K..){.+...w...f...<|..1/.|.....b..-..y....]U#Ctn.7m.._.|..2I;|....tM....q.q.}.N)....'...9&...nR...R..}.........m._.LZ}u.../K....9.~..?.{....V.#..dx.Zk.:=..:.j].....E#....E~w%....J..[S..[......gr...vb.r]..<..ut..i...[P.w....:..Gkn>......#..m...9km`......t).up.....w....VOR.{&.nQI..}...wD.7Ey#n....MO.

                            C:\Users\user\AppData\Local\Temp\{61438B52-0E42-45DD-AD20-747C1EF5A356}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):25622
                            Entropy (8bit):7.058784902089801
                            Encrypted:false
                            SSDEEP:384:EhK81gTCyJ/Gf9Aw3t8w8EtdPeGDh6bEi1Ie1u4ZbvgwTwrSRh7ZKNpIGY:IjcRXwdJvtdGsUbEi1IeY8vgwTyC1+Y
                            MD5:F8CCFC24DEB1D991EBE085E1B2D7D9BF
                            SHA1:AF76C22A765434AEDA134924C517C84107F4FED5
                            SHA-256:7354001527AB554C44E7D6981B86DD933B7DC2E0D3DC8512AD3EECD843245C52
                            SHA-512:818BC3690B01B30BC571E4CF45EC8D1AFCAECBAB003532644381F1CF730A5B3486862D08F7579B2D3D89167AD7DF35028881245C9550B0DA23D1F81A720A9704
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!...1A.Qaq.........."2Rr.#.t6..B..3S$4..v.b..Cs.%5..8..cUV.(.DEe.&Ff...T.d.......................!.1A..Qaq...s4....2r..S"BR.3....b#C$.....c............?..D.."}:......&&...?3..W.q*.......]...m.Y.k1......K).J...uV.b.../.0.E.H..4..W_T.[t.V.w.9.x.qe.L..o.oL.....d.\.....6.|.o...}..H{Yn..E...6Y3.l.e..D.:,.n.%...t...m.........,+,..|..n.....6.*...f........6.../$../Vi..H...e.f.F.zn.).n.E..2sTn.i...Yb?6+H&...Bf..*....z.o.^7[..u.:o....t.s=.....(.s.....f.g....q9o.u1L.N...smzE..[>...+\O....j.<....j.c.W.............U..+.F/.'..W...T./W...>i01./....j.s."..Q...{...a._~OW...Rp.)*.e..W..Q4)<..'..W...q...'..U..z..g......U}...O....w....0F:.N..V.3W.|..'z0.]...j..U[v..g$D.Lc[.e...UW.m0+

                            C:\Users\user\AppData\Local\Temp\{65E65215-6773-4F52-8E9D-1951A3DD6993}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 69x630, components 3
                            Category:dropped
                            Size (bytes):11040
                            Entropy (8bit):7.929583162638891
                            Encrypted:false
                            SSDEEP:192:u99+91V42ho91V42ho91V42ho91V4235z9pUkDCyixxo4PS6b8tEy3BcWWhhSy0b:ubKD4/D4/D4/D4uzX38u4PNYJ2zhhmb
                            MD5:02775A1E41CF53AC771D820003903913
                            SHA1:2951A94A05ECF65E86D44C3C663B9B44BAD2BC9D
                            SHA-256:83245F217DEAE4A4143B565E13C045DBB32A9063E8C6B2E43BB15CD76C5F9219
                            SHA-512:5A1FCC24BDD5EE16BC2C9BACF45BCECF35ED895EAC22D2C4EE99C1B7E79C8E8B9E5186E3D026BA08FF70E08113F0A88FBF5E61C57AF4F3EA9BA80CE9F33410E9
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................................................C.......................................................................v.E.............................................S..........................Aa..!12Qqw.....3568rv........".....4Btu.....#Rs.(W..bg.................................D.....................1..2.!4Aqrs....Qa......t..."3BRb....#.$S.Cc..............?...K/h._+.N6.-.a...5...;.r....,...0B.s(..zp..4.%r|q..E.Q^.../...C.R..?u.q8XN.>.e..:..gJ...._.n>.70G,..(........3b.&.5m...Q../...7Ie..k....e.l6..&..`Gt.P.Y^r...=..Y.e...N.B...O.#..J+........u.V;G.'.....V.]8..C.]..........E.....c..w&lX..f..\T.J?...F.,..m|..93........,.....+.R..WG...%.....(@.....p].iEz<.8.^...J.h.....a8P.1......(z..y~.........H.Z^.>..<.....L.k..IG...R.(.%..m....&u...B|.....@]ey.W.J...!d..R.8...[..>8....(.G......!.)X.....,'..F2.Z.t..Aw./..Z..#..i.kK.......b.i...qR.(....RE.............O.XP.#..(...9J..]...,.2.[w....KrW'...tY.......{~.:.+..

                            C:\Users\user\AppData\Local\Temp\{686787BD-3153-4164-B706-61291356CDFC}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 357x69, components 3
                            Category:dropped
                            Size (bytes):5465
                            Entropy (8bit):7.79401348966645
                            Encrypted:false
                            SSDEEP:96:X0cZneDWlIKmXwxacOHHI6EhzNlSSDDgafbofgt7mGrw:XleDWlIJwQHihRdgu8imGk
                            MD5:8470F9A96B6C6CAD9EE60961E96D19B2
                            SHA1:AFE1F01FFA4E4CB06B1D770C9C59DA75B434D1AC
                            SHA-256:2DF453410796AEC7B9EFEC00059B6CE64BCF67313A95AE458BA600EA5DE14811
                            SHA-512:CAE5C2ED091BA49761F0348516D53491E578FB165F32F93AC7DAD927383E9A398B06229FAC6A8233777DF708E5001AE0037A1FA960293BDA49892C40B37F2240
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................................................C.......................................................................E.e.............................................8...............................!"1...2A#Qa.$34bBDSqt..........................................................?.....`0.....O...3Sd..@..5.0....Q.pw....;....!pN.DR....`0......N^...k.=.u.e.7{.b........?z....zV...M.....P:a.SPj.....WRK.=x.2.h..2..AS..s..A..|.Z/f$D.YX1pr......}G6._.~..)j...+.s.r".{..q..-.^@...#w|.H..*.K)....g...y..`0......2.w@.Ro.d....@...K....}...&... y..f.y.0.|DC..>p.[E.2......v..N.)Z..4.RF.D.8]..Z.|f/..+\ID.r/.o........0i..*.G.O..uj..RN. ....j...xnF...Q.Ls.U.c.D0m....z.k.P;f...b.=..L.hH.,./;.U..`sa.I...?*...I....M.0<.u....!..C..U.T.....s.Q......_..7K..*.....?....R\&=.<.u..oQ}WZ..Yu...{Fe3.h...@.s..mW.G..^....1.W.#[.q2.&u.c.G......`J./..X.C....M;.....3k$}.i.3...#/x.m.Oh.}FH]. ..5NNDIS.-.M~...6..w.d....P.;..k...........v*..T..L.P...s.!B.4..w

                            C:\Users\user\AppData\Local\Temp\{68C8B3DF-009A-445D-A71D-02352CD017E7}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                            Category:dropped
                            Size (bytes):27862
                            Entropy (8bit):7.238903610770013
                            Encrypted:false
                            SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                            MD5:E62F2908FA5F7189ED8EEBD413928DEE
                            SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                            SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                            SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                            C:\Users\user\AppData\Local\Temp\{68E0CA21-587C-4FE1-942C-D2D0DB909B87}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):14177
                            Entropy (8bit):5.705782002886174
                            Encrypted:false
                            SSDEEP:192:EbgGcV/hlvpfal7rgYa8S7auAxwfuSTmCSNoFQ6NO7L:EbgGcVnpwimnd38FdQL
                            MD5:7CDCE7EEBF795998DA6CAC11D363291C
                            SHA1:183B4CC25B50A80D3EC7CCE4BF445BCFBAA6F224
                            SHA-256:DE35AF949D4F83E97EE22F817AFE2531CC4B59FF9EE6026DCA7ECEBC5CF2737F
                            SHA-512:560FB15A9C12758D11BB40B742A6EAD755F15AD10D6C5DEBA67F7BC8A2AE67C860831914CBCBCDED9E6B2D1D5F26A636B9BCEF178151F70B4D027316F94F27E1
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!.1..A....Qa".q..2.....&...B%6.'..R#3.$E.r457bS.DUFV.Wg(.......................1...3.Q..2Rr....s.4.!Aq.S.aC5B$%............?...n.Liq.}.{#....3/gg.1.M +..~3...q..+=..:.g.i1;P)7.....q..n.s"p...wx........v.t.f;..L/..~....y.r[.r.....n.n3..6i..g..}../........3..x.L.i?We..l.......~..<.;..6..o.....N.t.o6.l..~.......<...m.V...Q.7k.u./wq.t..;.I...}..{...>.L..3m..a....yd......6~.f..~Y..}+..<.[w..'-..?.v.7...v.u..4.......1];..u.MO.......s..p..ms.'.O-o...O......m.k.e....)t....i>..E|....,iOyD|.{......g.n...cu....=..........h.\.Q:?g/?.I.3._...t...d.n.0.%y....S.Q....S.&K.w..&wY<....%.g.v.....$y..#,i;.=...t...I6..yO..o.d..w\k...~......)..rK.......].u....N....e.s..kU.u..'}

                            C:\Users\user\AppData\Local\Temp\{692F6339-FBED-46E9-8A7F-7890B427EAD1}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                            Category:dropped
                            Size (bytes):32656
                            Entropy (8bit):3.9517299510231485
                            Encrypted:false
                            SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                            MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                            SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                            SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                            SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                            Malicious:false
                            Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                            C:\Users\user\AppData\Local\Temp\{6EE11E5B-EB0F-4151-A965-80403F0BEC9D}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 30 x 700, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):1547
                            Entropy (8bit):6.4194805172468286
                            Encrypted:false
                            SSDEEP:24:dZeDNYbS+238CTUFPA6SXG5qSacX9q73eXu0vC3dU+OB2gbwHRuZ:dykp9FzBBacXQ3uNC3n7xuZ
                            MD5:0BA36A74DFBF411FAB348404CCEC3348
                            SHA1:4C619790E517416E178161028987DF1CD3B871CC
                            SHA-256:2E7AAF26BEC32148B96442E8FFF1BD2CEF2D72630969F23B9A2ABEDB6CFEC93B
                            SHA-512:90AF53DB7C413E2ADB970AC345F73E4ED8AF626E179C929E6560118F7A9E98DC7C5FF02B2B3F6C98D397E0FE2D85F3427C6928C328872149E176FA8A99E91F54
                            Malicious:false
                            Preview:.PNG........IHDR...............\....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................D......bKGD....H....cmPPJCmp0712....H.s.....IDATx^.WSTA........b.0gPPP0..E.9b@L(.c.N.U>..@......;...}..B.(....$......5..XS...I....).!....D^.uE...\..5........F."o..-...m.n. .^.....q= .

                            C:\Users\user\AppData\Local\Temp\{6F143FBD-CF00-4743-8879-BB2E96C39007}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 40 x 650, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):647
                            Entropy (8bit):6.854433034679255
                            Encrypted:false
                            SSDEEP:12:6v/71rwqZMXVs99W1YvpLp/Fvl+f43ocLtuplb+CrGotLRd:+wqWXVs99rpLpNvr3pIx3b
                            MD5:DD876AA103BEC3AC83C769D768AD39FB
                            SHA1:1833603AA9B6A7E53F9AD8A336F96CCE33088234
                            SHA-256:1262DD23AD54E935CFA10FEB1BE56648E43BEF1116696CA71D87E6E033B1CA7D
                            SHA-512:946DB2277213104A3B29EC4388578B05027B974A3093B4CCAD8847397AA51AE308BC6A199E5705E1F901D6E4B1BA34D8DECFD6E5B6685184A307D749D7CFAEDD
                            Malicious:false
                            Preview:.PNG........IHDR...(.........xk....`PLTE.........................................................................................>.S.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.)..1..7w....6.*.H`T6.ha.k.............b!....Ba..C..P.4K..@.....h.E..X....PX+.P.-.....@@"...o.O4....xZ<...B...B..,A..y.s<......b!....Ba..C..0_p. .......=..,...i. ...=.j..N...........{4+...xZ<...B....|.....$.K<.vyE..X....PX+.P.-.:... .'p......\,...i. ...=.j........K.....%J..S+.....q..k.H.@DD.s...:..J.K.DDL.\.@`,.DD.:.(]..N....KD....A M.....F..S+.....1.sq........\.t..;..../...~k...4.DD.:..]..N....KD........@DD.s...:..J.K..[...Q....V......IEND.B`.

                            C:\Users\user\AppData\Local\Temp\{772124A0-9ECD-4BC1-ABC1-9B51805CB92A}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 613x144, components 3
                            Category:dropped
                            Size (bytes):29187
                            Entropy (8bit):7.971308326749753
                            Encrypted:false
                            SSDEEP:768:RwjBOlCk+nYnGagKJWJhwMJiRO22ZIm4VXvXx1tA6BQs:i8snY3JW7uROlEfbtVL
                            MD5:DF99CAAAB9A7DE97B63343E60A699AB6
                            SHA1:B84334135CFB73BC6EF55F85926770D5AC6DFEA8
                            SHA-256:74C131777E7C437FD654427417097BC01B0813BA8E1E50E4B937BD50A1BEBCDB
                            SHA-512:5D15AAAA8B71DDFE01A7C0ADE16D9E1F5E9AAE484BCD711B38CCB103ED9564CAAC23A0031471167B660E15972D70179C2A387509B213C05D60261042A0456025
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................................................C.........................................................................e..............................................`.............................!1Qq...2ARa..."#.....3BSbr...$4C...Tcs......%&DUd...E....56Fe....................................H........................!1Qa..Aq..."b....2R...BSr..#...3..Cc....$%4...............?...b.d.8T1.;#.S.DO...~.R.......3.xe...z.6..."m..k...;*.'.f.5^.....m..<$....8.R.j.D.v..>...*dT..vGbt...I......sEWp.r3.. ..G...6.....w...l.S..q...b.....-R....^Zu5+u6...A..Z].:...5..Uzn.,l.L.....?%.*.S.+zVg7.=.s.Q.....8..:,c.......ZE...>'IF..W.0.d.......c.e.d.V.t..S$.DNR.[....g..#i.$. .U.SK2.....k...J5u u\R.....T.[4..A.O..,.T..................] .i...B.m.^f....._...{S.....<......:..|D...+...NA....Y.^f.1|..%K~1..B..^...S..v=.c..g.tX[..kTJ..t.gr....R..@.F....5j..2.K.9..g.1N.....*.U...^w......>+.l.v...@N....%Qd...t.Ni.....0;lggm...K".+!.,.....[J...>..?f.]._;

                            C:\Users\user\AppData\Local\Temp\{79F0144F-BFBD-4F83-93FA-06A942677D9A}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):84941
                            Entropy (8bit):7.966881945560921
                            Encrypted:false
                            SSDEEP:1536:X3sWfhTVd+xu6rA6SOONM0/YFXnviDwoPCaNSm+z/ze/fWNj7GfigeKyCGzw+QKW:nsOhdDJOwY1voPCaom+z/zeHAfGihCG8
                            MD5:CB84C108A76C2AFFCAC2551A3C1EAD56
                            SHA1:8BB7C2A12B056C1ED12EBBAE5BC9F60CCE880FFE
                            SHA-256:139BB0E79F89C3DDEF79B1716A5FBAB4C07DF5785FB3CDF6B4EEDDBF6C078452
                            SHA-512:6EF85144E9A7ACD0FF2E52A5FF42093153EFB69127B1C8549EEBC49B6CC196A46B65EE39A2CAD0206F6A41476D8B5B35D29EAC9942B8F84972B32E14CAFEED27
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d....................................................................................!.1A.Qa..q...........".2..BRbr#.T.3C....S$.cs.D..4%5......................!1A..Qaq."2..BR....3...b#.r.C4.............?.......m.q..'O.....r......_.1....8h....?.....O]~..k......GO...''._...!....o........''..g..H?k.......1...?.....z......>...+0..................GO...''._.........}.O.Z|.L?...........?.........[~t.......}......NO.....v.......J.......?..g..H?k......GO,m..r}o.z.....}......dC.9?..g..H_..........?.....O]~...m...C?.z..f....W.=u.B..m..C.-?.a.....3._.?.......o....np.M....g..H_............9?..g..H...../..kO...''._...!~...o.....0.M....g..H.........../......O]~.~...o.......7..+.... ..l?.}........&....3._./....?.........W.=u.C..m..C.+?..o.W.=u.A.^.O....:......_.........}..t

                            C:\Users\user\AppData\Local\Temp\{7E040583-562E-4644-8B79-16FEF5B919B5}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):52945
                            Entropy (8bit):7.6490972666456765
                            Encrypted:false
                            SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                            MD5:AD003F032F32FAC4672D4CE237FA5C5B
                            SHA1:AE234931B452F0D649D91291763B919CF350EA49
                            SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                            SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                            C:\Users\user\AppData\Local\Temp\{7FAAA409-5C37-4B7E-8B12-A401B29BF42F}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:09:29], progressive, precision 8, 609x675, components 3
                            Category:dropped
                            Size (bytes):65998
                            Entropy (8bit):7.671031449942883
                            Encrypted:false
                            SSDEEP:1536:klZtmExaFrtWgpc+Sg+DKeplHClpHfRtPMbe:VEWWl+SNDKqlH8p/vse
                            MD5:B4F0A040890EE6F61EF8D9E094893C9C
                            SHA1:303BCBA1D777B03BFD99CC01A48E0BB493C93E04
                            SHA-256:1F81DDE3B42F23F0666D92EBF14D62893B31B39D72C07AEE070EAE28C2E6980E
                            SHA-512:8F07E4D519F2FD001006BB34F7F8274B9AF9EC55367B88D41D24E5824FCE4354FD1290CE4735E43930829702ED53F41DF02C673904A7091E9354C28E029AD4EF
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:09:29.............................a.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..-O..s(...gO..@...[..+....+...H.'m........L.......@.......[k...S..O..p.'{X..3......]W..w.+.V....[.-.....2..i..i$.p.

                            C:\Users\user\AppData\Local\Temp\{83A8A000-258F-4050-AEA7-680CD123692A}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):59707
                            Entropy (8bit):7.858445368171059
                            Encrypted:false
                            SSDEEP:1536:k76rvGc8WKC2/UX1uEgVRY/jvv9CblyL/T:k77Z5C2/Ow1e9CblCT
                            MD5:47ADB0DF6FDA756920225A099B722322
                            SHA1:851946B8C2BD0BB351BAEECA9E5BB6648A87D7CA
                            SHA-256:EC8CD7250F3D82E900E99114869777EE859EC73EFFABED108815F65742078C3A
                            SHA-512:85A9920E1CE4A2FCCEBAFA425C925DF33580FA3C3C00178F058539B2FBC0163866DB8A41B320E2EF2CD217F00FFA06A1A831C728D3F9F910C9EAC58B5DA76E2D
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..A..Qaq"....2........B#..R.b3$..8xrC4&'W.%e.(.c.d.5E6Ff..h..SsTt..u...Gg..H.....................!.1..AQ.aq.".......2..st.BR..56.r#3.b.S.4c%...$d.CT............?....3.7...G:../P....z..K.:6..w......6....... .z7...~.....{gdF60...9....{...'[N....m.........z...g{.......7...4..1..=.z...._..p...m..Icd.~.v..9.P..0Z(.<j.......R6zm.....v.z...>x..)=g........zo{..w..f..y.t.....%.D..#.}.I.>).H.QM..cLD..x.../.^y.{.............y.=^.......I.T.......U..0_?...u..og..3.ky..K....6w...Dc......~........ik.z....N...en......_.....x....._u...4.{..P...>.....}.......>.R.....m.....[mt.....}.........|.....m......~....B.F.]C.36..q....yg...{]...+.DZv.9<.o..;..N.n&im.,....w.3...V.s...Y..e#$.

                            C:\Users\user\AppData\Local\Temp\{84D07630-AA25-496E-B056-0533CCB98304}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 262x277, components 3
                            Category:dropped
                            Size (bytes):3555
                            Entropy (8bit):7.686253071499049
                            Encrypted:false
                            SSDEEP:96:/h3JeYCQV5Hn++9HBdAjU78S/mjLLwqnqahJD:53Je8b+EBdAjm8S/mjLLRnphJD
                            MD5:8A5444524F467A45A5A10245F89C855A
                            SHA1:ACE68D567B02B68275E0345C86DB1139C0EC1386
                            SHA-256:7D2B01F17354D9237A6AB99D5B9AFDF0E1CC43687125848B0C2DEDFB44CE3843
                            SHA-512:8151B447B60D110C32EC1EF286B941FFC09B99140F41BBACF5A1650A385FF4D13C0DDB2878E9A470FC7CFCC95A1AB6E44F6DE72562B0FFE093DC8A3C3C7FCC14
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................2........................!1AQ.a."2q.B..#R...3C................................ .......................!1.AQBq............?........)&vD.)3Hn*..X+....r...tmL.k..(.E...R. .Z..&...,fJ...!...6..S\t3.=...g&..Bqe.)_U.....1......-..fl.................J...u.i.mU..K..v.w.0O..E.h..D~K.(..9.,8..E.}.............i.\.....t."v..q..C............<..|3.........................*Q..../c.....f.}8....D..|k..Z......0..~..c..e..m(...|.c..'.5.5............==bx.5x.8...T;....=.--.pc...I;.V.m..,(....}...NH.ho....Q..U.E$.~...w.t>.S\....'f.{.+.g._.t....;>.....P...........-..G.h..2...J.% !.E97Ir.D..N....j...oE._...._...".?.......#".S.........Q.Tc.I..*I..k.......=$.........sk1Jp.\K.....F.3.Q..q..J....N..[l.&....OR4bB|..2ul....J...B.$&H..9#j.f.n./........?R~....B.I.@..........m

                            C:\Users\user\AppData\Local\Temp\{889C48D6-8B27-4820-853E-ABB1B4BCC281}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                            Category:dropped
                            Size (bytes):12824
                            Entropy (8bit):7.974776104184905
                            Encrypted:false
                            SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                            MD5:2628353534C5AD86CBFE57B6616D46DD
                            SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                            SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                            SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                            Malicious:false
                            Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                            C:\Users\user\AppData\Local\Temp\{89EF7AF7-FE66-4B4F-9D36-4D739DB0AD15}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:10:32], progressive, precision 8, 594x773, components 3
                            Category:dropped
                            Size (bytes):242903
                            Entropy (8bit):7.944495275553473
                            Encrypted:false
                            SSDEEP:6144:YVxOYlZX2kCWfYoFMXC/sBFC9r+4iEGM4rrcPoWmwkU6FJ:+OwZ2kbFMC/L99ifvokU6/
                            MD5:C594A4AA7234EF91E6C2714CFE1410F1
                            SHA1:C0F720D4CE3196852814D0B7347F0CAA0C6FD526
                            SHA-256:10C833E47BE1C8496F949A6B059C2D79212A4DD66BDE62116EA337FA4FE0B654
                            SHA-512:7313F6545A334F9E2DE5430B2DB5C419C4C8A40E075338DAFCD74970BCC6309786946E5DFB57531612BF4C6269495655706D920FD99922FDACFF9796710DA9C0
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:10:32.............................R.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...v&.F;-v;}FH..Z...N..)Y.......h;C....G.0W..ww...MI..Z+..\.........c..4.1.~.Yo.Y6.&. q...............l.A#.~s?yYg..7ky...r

                            C:\Users\user\AppData\Local\Temp\{8DE33DC8-A5C2-4F7C-888D-60E33B0848CE}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 60 x 336, 4-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):347
                            Entropy (8bit):6.85024426015615
                            Encrypted:false
                            SSDEEP:6:6v/lhPtnlx/QulkWNY2V18A6Akp7eee1VDjMHCyLezyKUX5Gp:6v/7RrIubiA6AkpNhiyKe+
                            MD5:78762C169F8B104CB57DFF5A1669D2DF
                            SHA1:9638B71B584CD636834016A635ABF8D9C0887711
                            SHA-256:E64FDCD0B108737D8B8F7B677029F924031D6BBAA50585D9C3DEF7C7E92ECAF2
                            SHA-512:5ED899AAF73B72DEC32E171FFA112382667D5BF3FBA98C92E313E66C0A6975EA97068F4CD32B62283F18DBD5345C11E3610F7EEAC2F2DE71FC44593180B9CEAC
                            Malicious:false
                            Preview:.PNG........IHDR...<...P.............PLTE......................=l......bKGD....H....cmPPJCmp0712....Om......IDATh......@..aI...B..C..l...^.%.`....>.]..|0.....a...hb...0......q.......p"....;...K..x=...p...y.yy~J....|...\.......y..X.......'...>1...Ky..f....&........N`..f0..b...3.......`Z.3..3.....o.......4.&........SV...4.....IEND.B`.

                            C:\Users\user\AppData\Local\Temp\{8EEB8621-BDAC-4C0A-B17A-0E35BD52599C}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):41893
                            Entropy (8bit):7.52654558351485
                            Encrypted:false
                            SSDEEP:768:pZvVQkUbOHxx3pvVmO5rsP5gUdXwFMuv53knzyncaXgRDqPU:pZkijV5wScXwFMYknzucaXgRyU
                            MD5:F25427EFECFEE786D5A9F630726DD140
                            SHA1:BC612A86FF985AB569ED1A1EA5FFC4FDB18FC605
                            SHA-256:5A36960DF32817E8426BD40A88F88B04FB55B84BAEF60F1E71E0872217FDB134
                            SHA-512:B102F34385196D630F198667E874F25ADBC737426FDAE0747EC799B33632E5DC92999C7C715DC84D904342738930267AB1709870BDAA842243E4C283FE5E1554
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................!.1AQ....aq......"......2...Xx..9BRr#.b3$..&..g.8....%F'G.(H.Ss..D5E..v..W..Cc.deu..7w.h.).....................!.1....A..Qaq...Ttu.6..."R..5...2B..S....bcs.Dd%&r3C...#$...Ue.............?..R...%.R...t.MQ*.l...v...V]..n...Zw....M....4..F.&&bb0.:]l......ay.r<..3.l.Q^.........I54.N2.8..2s...w..r6.......[1Zh....O...9..>...B......x]...r.\.\..v..~....y.QT.3.......=....r..}.l.....o;....M..C1....w)...+o1f.]...MoA.E..s5..i.\....miGsy..m\.Zj....I'YU.\tU6La5v.>.K..m.]1.......k..0....</5v.V7lY.e.vV.+./[....f..u{....s.}.Rb.Z.....Y.6]..m....V.\...Mr.=r...K...l..%..m^.......X.(..fG..[F*ly.jL.a4..vs..o.e..q.9km..w1.yg.....r_.*h.n..5i.-.{Y.l...<...'Or.s..Z....../JP.....\FV.S..............m

                            C:\Users\user\AppData\Local\Temp\{8FA8A989-75EE-4151-A989-C4DE9DA2E2B4}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 171 x 552, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):10056
                            Entropy (8bit):7.956064700093514
                            Encrypted:false
                            SSDEEP:192:edmu1fpj5DVHuooK4EpGLbAdT+dBXYBR8D1V2p6KwoPR6KUX9ojwRpgA:2Pp/B4LbAF+dBo/1E3S6JScpgA
                            MD5:E1B57A8851177DD25DC05B50B904656A
                            SHA1:96D2E31A325322F2720722973814D2CAED23D546
                            SHA-256:2035407A0540E1C4F7934DB08BA4ADD750FCB9A62863DDD9553E7871C81A99E3
                            SHA-512:BC7DC1201884E6DAFDC1F9D8E32656BFAEE0BB4905835E09B65299FE2D7C064B27EAA10B531F9BECF970C986E89A5FD8A0B83F508BBA34EB4E38B3F7F5FC623A
                            Malicious:false
                            Preview:.PNG........IHDR.......(.....!..t....PLTE.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................4.....bKGD....H....cmPPJCmp0712....H.s...#.IDATx^.w`......$..B....... ....fz5..6`l\.8...Nsz{.//y./....{.7}g.....e.....~.......s...f.....%c...6....O.PJ...Y.oi...9..'j.2..6.-

                            C:\Users\user\AppData\Local\Temp\{966655DB-EA38-4928-B185-347E3BBADE7B}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 814x105, components 3
                            Category:dropped
                            Size (bytes):12654
                            Entropy (8bit):7.745439197485533
                            Encrypted:false
                            SSDEEP:384:JheN2cq6MLu6MLGu54cHeNzhcmhcDu53eNE3UPkhrxvu:Ji2Wix7fzVsbE3Zm
                            MD5:4BCCCDBB4273ECEBE216C84930A8D0B2
                            SHA1:FFBF617787E27BC94D9BAF89F2FE34A2BD42794B
                            SHA-256:474F9A8C25D5E21192315397EA995B1E11E2C1608157C6E0277688091BFD136A
                            SHA-512:DAD73A8C0E293B88685C0C71EF15E0DC95EE39B7FC9F849DE5D634173FD9FA0AF0AA96742D9E94BE03556AA4A817D5001C95A6736EAD5D5DF03661876785EB74
                            Malicious:false
                            Preview:......JFIF.....H.H.....C....................................................................C.......................................................................i..............................................E.....................U....V...f..ASTc.......de.1Qq...!Rb....Ca."r.................................B....................b....Ra.....!Qc.....AS.1U.."C...2Bq...$#3%&.............?......3.....~......:..g..s"......:..g..s"..ic..Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. :..f..h.....Vk.f.. ..0...Q_..X..V5E~..c..X...@u...cTW...0...Q_..;.m.....@w...Q.+....*.4W...lUFh....v..._..wn...dW....y._..v..E~...*...@wn...dW....y._...v..U..@wn...d..{`;.|U.2g...*.3...:.0?ViN.z.@w...4.M.:m..`~..i7...q...I....J.`l...W..n..PQTiB...6....+..sj.*."...6....+..WA...x..A........(.N6`..AD.q.....'S...t.Q:.l.......f.]..N..0.. .u8..A........_W..Y...}.C...~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~....&.E~.v..?U..^.r..}..Bep

                            C:\Users\user\AppData\Local\Temp\{9A3842A4-12B0-4F4A-BACB-4F040DFC0529}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                            Category:dropped
                            Size (bytes):33032
                            Entropy (8bit):2.941351060644542
                            Encrypted:false
                            SSDEEP:384:ofmqvnCfmqsp1Ue5xzMq+Qh0dffUmS0w5xzMq+Qh0di:AGAp1rmSl
                            MD5:ACF4A9F470281F475EA45E113E9FB009
                            SHA1:B20698DDA5E5AFDD86BB359A6578C9860D5DF71F
                            SHA-256:5DC2367A80588A7518DB5014122510BF0FD784711015EF83A8718336584F82D0
                            SHA-512:998B7DB9DB08FD15A293267E2371052E436E024AF8D34F96D3C8FF04B1316678DFC1674C921CB404121FF381A4FC39DC759E6698F19D42A6261CBD39469B0A08
                            Malicious:false
                            Preview:....l...........................Ac...... EMF........$...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC........................F...(.......GDIC............^...........F...........EMF+*@..$..........?...........?.........@..X...L........................."B...B...B...................?...........??.....n............;...<..@<...<...<...<...<...=...=.. =..0=..@=..P=..`=..p=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...=...>...>...>...>...>...>...>...>.. >..$>..(>..,>..0>..4>..8>..<>..@>..D>..H>..L>..P>..T>..X>..\>..`>..d>..h>..l>..p>..t>..x>..|>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...>...?...?...?...?...?...?

                            C:\Users\user\AppData\Local\Temp\{A4F648C5-0AEF-4719-BCBA-DDCC2DB7371E}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):52945
                            Entropy (8bit):7.6490972666456765
                            Encrypted:false
                            SSDEEP:768:cjvqR0XvFaGCTJffi0tgybmWDoTw71kHUAnjvawrlp2+NUO8dWSNl3PF2PjK/q09:cyRffflgybmWoTw1UUADHUbU21MjpAD
                            MD5:AD003F032F32FAC4672D4CE237FA5C5B
                            SHA1:AE234931B452F0D649D91291763B919CF350EA49
                            SHA-256:ADB1EBBE18D6CD8FF08AA9BF5C83CDB83BF9AA179698E34E93DBCDDE12F04D32
                            SHA-512:ECA25FA657ECE3A66D3E650628E0F65D3BADD38864C028AB6553950A1A66D7D55482C85E9E565573E9E5AAFA91C2D53235971C644A266D41EB69F8E72E3A843B
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..AQ..aq....".....2....BR#r.b3$...C.Sc%...s5E......................!1.A..Q.aq"...2...#...B...Rb3..$..CSr...6............?......y_N.e.H7?........W..w....k|...S..d.4.>.RW5z.$.i.)V.O....>o...c..*&1.D..O..".ufbb..1...t..u=..K...m...~.....F..-.fb:i..=f..C.w.[{..~.7k....;..:..3....4.....$..m]...}....~q...9T.#..7.~..8...q.N;c..ffo.w...W..d........../t_........lWJE..).>..v;:=....Rrw#.m.n.n...E...vm.J}2N*..|.4...80.#..e....t.J..ZQ.x|g/....F..e....k+vK...M..W.X.e.L..~...j.....kz....=...n:O.:..[.L,.+R...Y..zKNI....,..{e..U.'...}.......|..t.]...~...b4......_.i..../.......m...a..n...v.j.?..Rc.$G|.31..#..$?.........h.w....-... .a.%z..u......u.A....Fm..J.......G..[...w.....:....w/.

                            C:\Users\user\AppData\Local\Temp\{A64481D4-90C8-447E-8E76-960CA399D6F1}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):34299
                            Entropy (8bit):7.247541176493898
                            Encrypted:false
                            SSDEEP:768:BrSX4V3P8AIc4KLkHeXRUer0zrhOmXfvG0yH82I:tSXuIc4K2eBtswKsHg
                            MD5:E9C52A7381075E4EBC59296F96C79399
                            SHA1:BE295AD24D46E2420D7163642B658BF3234A27EA
                            SHA-256:D56CEFE9EE2FAE72E31BDBA7DD2AA4426EA22E3CEB22EF68C8F63F9F24D5A8BC
                            SHA-512:95CC96DD4459EBAE623176033BA204CCDC50681A768F8CBAE94C16927D140224E49D5197CAE669C83C77010C5C04C1346CF126BEF49DB686F636C5480342A77F
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.......................................................................................!.1..A..Qaq......".#4.2r3.$.%...B.5U&6....Rb.Cs.7..cDTEFVf'...S..dtevw.u.........Gg.....................!1..AQ.aq.2....."#3.4....r..BRb$CS.D............?..5..............#....v.q.m.}\..{....;...r....h.....J..q|..'.;\..6..v......e...../.k..|.8..i..|..]..3e.m....n..Z.GS..n".y..w.-...[a...7A.....i.4.)9\..~C...=.........s..\V]c.D1<./.g.l.&v..~.h..]....zb>G..y:vNS.\......LU....t.{*..Z#.?..v-...wn.rR...P.....y\=.v....../..9_...m4...V.|.+.o.#.......xj....}..>.s.>C...m.[;.>.p...=^.i.X.(..1...{.F#N.W...xi.z...4..u[{...yO.....8..}\..2...KlX.nbya...2.&.F...R.b.k.7.GV.x.h.y\.Q..O<\>......-...=...r......\......Z.Z...Jf.'....z..Y.q>.p....o..K....h..R..c.lg?......A.Z...Y.q3.L|.'5...

                            C:\Users\user\AppData\Local\Temp\{A8B4E846-877C-4EFC-AC36-061B37E47F36}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:44:07], progressive, precision 8, 611x163, components 3
                            Category:dropped
                            Size (bytes):36740
                            Entropy (8bit):7.48266872907324
                            Encrypted:false
                            SSDEEP:768:3nwDxjTvoE0Rjwit4rjucDILWg7/Da0JgGQ8e1S8SA/Khos0:SxjTmZw7nucDILj77a0JgGQvScb
                            MD5:9C205C8D770516C5AA70D31B2CA00AF3
                            SHA1:9A1002F0CF7F92F1BE2BB25BAD61CEBFAC282482
                            SHA-256:E111F96490755C7D71E87C88ACAEA38AFE55BB865B1A14A83C5BD239648D5E2C
                            SHA-512:A3E105208B32831265428572B0937DD3C17B793D8611B2DA8D4939F1BEC6050999D375E3F6B87D53AD49DFA0EAE737B0141D37597AA42116C310761973D4A134
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:44:07............................c.........................................................(.....................&...........n.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d................................................................................................................................................."...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..o...4.gP.~.c...K{...V.=...].<.........vS.........s....(.t......X......kk7....~-...yF}^c.Z.\.G./.?t...>....:.>......./.ib..).

                            C:\Users\user\AppData\Local\Temp\{AAFECD4B-C2F1-45D4-9253-0B8E0DE37B19}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):15740
                            Entropy (8bit):6.0674556182683945
                            Encrypted:false
                            SSDEEP:192:Elv3GG8/OOs+GouFdxMlxjoPyerzkpuOo2vPMc62PaJseZC+BJoS/:EtNiwdxMlZoPhzkpuOo2PMc6rX8+B6+
                            MD5:FFA5EC40DC9A0FD10EB9E6355142D6A6
                            SHA1:3D3D6A7E086B3C610C08F1F3E3F883604F06F2A4
                            SHA-256:D74C3973C8D1F7C77274691AFB1AA934940674341D7EEE563BE75E563281BDFD
                            SHA-512:6FAF2A24D06E6008F3579C7CEC90C2887462BDF83FAD7372FBB74B8DE90340B580E9836F309B68A9794597A598F7DCDA661C9A58DA6D8187C69083B7A17C9CD9
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!.1.....AQ..aq.g..8...."r....2.FG..#.E..7.Rb..Cc..D.v.B..3s..$d.%5Uu..&6fW'w........................!....1Aa...d..5e.6.q...Q..."2b.c..r3DE..BRs4U.#C.S.T............?...u.&0...cV.T.I...1..=4....Ce_.g.q.=F.M:>)...k..pm..h..=........S....)Ja8x...b.).=5.q..0......k.M.....1?-.G.b&.5..Ep.8t...'...R)..ta.F$bXO]tW.b.6#.t.XWN..ZW......].....G....x&&f..'L.....7...\...'.8...~`.sa...............................................X........qo...SMk...'.V...i..hb.}&?/.k.:>l.^....>Y...<}...&.jY.Gn.MKejyV......D......gf.0....t.nw..XQ...H.B.....=8.UkR.....Hm..w..]...k...#Z...F../.gjWvf.....w.aZ].2..5..^...VZv..._.7..a.|...:.B...,f...............~....m.;_.....-.e.y.w.[m.].bu.b.f+.E++\.....Y..7

                            C:\Users\user\AppData\Local\Temp\{B081F8D7-C08D-4421-A433-A4DB52EF5817}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                            Category:dropped
                            Size (bytes):32656
                            Entropy (8bit):3.9517299510231485
                            Encrypted:false
                            SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                            MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                            SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                            SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                            SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                            Malicious:false
                            Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                            C:\Users\user\AppData\Local\Temp\{B18F05FC-15D3-49D7-9678-4FD54033BA23}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 50 x 500, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):2033
                            Entropy (8bit):6.8741208714657
                            Encrypted:false
                            SSDEEP:48:P37XYSDTz+UUl7DHt7Ah8l1+4ZfFclFUXwobKXlZr:v7j3z+UoDN0h8ugf2AwobMN
                            MD5:CA7D2BECCBC3741D73453DCF21D846E0
                            SHA1:E34B7788498E33FFF0CFB00125E6BA9E090F6CED
                            SHA-256:E9EAD0BFC09D32CB366010CDFEDE1C432A2D1D550CB7332BADAC1BEE9482BC86
                            SHA-512:7FE2C3654262B1EEBED4F6D83DA7D3450E1BE52500A3964185FC0092041506A237A2728E5D7EEA0A3814E413E822B803B789C49CF744D51816A2E4EDE5B4247B
                            Malicious:false
                            Preview:.PNG........IHDR...2.........H'......PLTE........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.\.W.G...=a.ewA..a.!r( ...%Dc..x.x....N.OO...3=...S...........~.z.D.0...g.2P.7.*M.#'....z.......3TPj.Z.[5....V..z'L3...a.j9..C>..9.z

                            C:\Users\user\AppData\Local\Temp\{B2FE624A-1361-4601-A67A-812BB99E44C3}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 50 x 600, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):4410
                            Entropy (8bit):7.857636973514526
                            Encrypted:false
                            SSDEEP:96:E/pQuIhKZ7u06dICH3AroiTe8DGTl55poBUmLNjpH7MvDHjfm:MpdZtPbknnRPpkLNVMvu
                            MD5:2494381A1ACDC83843B912CFCDE5643B
                            SHA1:98F9D1CC140076D1AE5A9EA19F47658FD5DF0D66
                            SHA-256:5EEBE803E434A845D19BC600DF3C75E98BB69BD0DE473CEEC410D1B3A9154E28
                            SHA-512:0E64CC3723DC41D94910F7ADFB6A0DFB5049350FD15A873695614E4A89ABD78B166BA4E9C8CB95E275FB56981539DECD2A7F28FBC25E80DD5E2DEA8077CC9489
                            Malicious:false
                            Preview:.PNG........IHDR...2...X.......E.....PLTE...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................B..(....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.].\TU.?3"...(..L........q.Q...H.*j......W..Xd.ie.f..%.XT...em..m.m.vkik...>.}..}|..{'.U..~......}....s.............,CVu.x.:C..5...;.

                            C:\Users\user\AppData\Local\Temp\{B3C8F9F6-60A6-45AF-AAE9-3D05F389FBA6}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):53259
                            Entropy (8bit):7.651662052139301
                            Encrypted:false
                            SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                            MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                            SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                            SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                            SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                            C:\Users\user\AppData\Local\Temp\{B3DCF927-0687-4AD6-8695-7CB095CB9B4E}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):47294
                            Entropy (8bit):7.497888607667405
                            Encrypted:false
                            SSDEEP:768:aQ10VrIBdBvDpQrQ7P9/FUOLG2vTSeG9lkCsMKzXeMBk3CBp:aC0JIBL+QsOLG2+ZAC1KqM2I
                            MD5:7A450E086AD14BA7D89BA5DB3D3AE6C7
                            SHA1:E7AEAFCFCE476390E18C19456BDF6529D863D518
                            SHA-256:BDD997068701ED3A00A224EB694B003C01AC69B857FE7B4147D6C34875B1632B
                            SHA-512:9B6D50A6CDB6081DA107A2CDDB1BD2811A5764994C8E3F67D56CA81084BE0D068C27435154E867199F38688EA65E8DE02A56DCAC47D0F5E55F0FBB6598814938
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!1..A..Qa"..q..2.......B#...R%.r...$&b...3Ss.4dU6F.cE..'GC..t..5eufW......................!.1..AQ.aq..".....2BR......r.#3.d...b..Ccs.t......$4T...SD%5Ue&Vf............?..M.7(..).:.a.q.......>..[:O...afQ.uCO..U.....go.l..p..YqVklQ.{i.w&.]Z.\+JQw._.n.'.h..,.bj..X.].k&.Q.>gU..f...1|....[...jQ.%Zb.......t..........*..V..j.6....Vj..i.....?...IY.P.....$.j........[l.....S.4.J9.U\.......7I..[..=*N5....xW..../...=?n....uG.D..S.>...8..3........n.S....]k.*...4.>.R.o..{..l.H.#.^....<amG.m&.......,....wDY.W.m.X....We.IR.Nu...y..Z.l.._S.mr.m...y.]m.R.MT...6.5.5}.K..#%..k].7.Y.q]...%.r.7.R^jR..z.K.T[t.a..d.)glW.r.v,.`....O..^..o:.Uc.\..D....f..D......yt.Q...Y.....

                            C:\Users\user\AppData\Local\Temp\{B43878EF-1786-47B9-9C3D-D248E7161898}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):40884
                            Entropy (8bit):7.545929039957292
                            Encrypted:false
                            SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                            MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                            SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                            SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                            SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                            C:\Users\user\AppData\Local\Temp\{B51705F9-6597-461A-B46F-3899A612A643}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 40 x 623, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):1569
                            Entropy (8bit):7.583832946136897
                            Encrypted:false
                            SSDEEP:24:KArPoy/sSfmBL0EGEsRgeTLLXFnViAAEslVorlP0i8OmO57EnGAkYelBKMN:9oQPTgeL5ViAe8rQs7HAkrlc+
                            MD5:07DB3F43DE7C1392C67802E74707DAA6
                            SHA1:C173ADB1999065C5E1E6DBEF934B4D4D7AF0CC23
                            SHA-256:51E05999A1C9F17DF28CB474E57DD8E64BDAB824874A532C20A23766A01F8967
                            SHA-512:E509255519D4E521E82332FF418DD5A6BBBC8476399A0D9C3D81542C1CABA535B2D79E5BC90F73F9EE8468643302137671934ABD600FC696F16161C91FEAC111
                            Malicious:false
                            Preview:.PNG........IHDR...(...o.....>.c.....PLTE................................................................................................................................................................................................a.o.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^.Y.. ..........}%.../].`<..y....V...m.....<....)..;Ki..'9...2.:.c...t..V..d.t;-y.Z.=K>B.."{Lj.~G..|..ENC.!Sw,....";.p..g....E.B..S.-...k..P."..E......l[./D.-.....Q+.G<>.+..b...#..y(...{a.M..J...<....v.W..F.qm.`.....(.mk.nX....l.Px8.0\Z....7G...$*.....&..Z.VJ.~......J.2|...2H..../...=.)q....ZT" .,%..h.p....Z$.!........r...Hh.f. ....P .d..1d....2.3h....;.A.... ....d..g4...A..^.....2.ew..."h...y/..j.h..B.......%.2.%..{r...+dG.=9h....P1...A...c...^h.]Q0.8x....q .!3....ZW"Z.!3...G.vC.GG..".&..X!3.|xB..V.P!.+zS..NX!3.....Nh.y(.Z.1.h..B...Z+....l8Xcu.B...K...@U..@Q...mB...x...&L C....mB.....@kC...Y.,.... ..e\F.B..........y..e\..:$(....Z.a...yn...f..z.~Q.{o...].ln.r....^.@.{..c.7..{...

                            C:\Users\user\AppData\Local\Temp\{BBADC476-05C7-44BB-8201-2DF07B2952EC}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 39 x 600, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):2104
                            Entropy (8bit):7.252780160030615
                            Encrypted:false
                            SSDEEP:48:2PPEOtz2P/LJtVRaqBG8qFOPvHlcEXgkuwf+j:2PZFSjJDjqFOPPlXgG+j
                            MD5:F6C596F505504044DF1E36BA5DA3F09B
                            SHA1:BCF17EC408899B822492B47E307DE638CC792447
                            SHA-256:EDBB86F160050FBF1F9860276802BAE292DBFD0BC98E3EA90D43D981E9F0C54A
                            SHA-512:E8D067A1932CED8746FE7D665EEC34EA92A98AFF3DF26FFA9DD02742DDEA3C5654124A88A649FA33DB596F96A5FC9CB2C693D03132F1C8B254ACB56DB4763BD8
                            Malicious:false
                            Preview:.PNG........IHDR...'...X.......:....PLTE.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................{.....bKGD....H....cmPPJCmp0712....H.s.....IDATx^..c.%i.F...m.m.f.m.m.m{&....X...9.....M.WUW.d.N.O...E$...$...)H....n....N.k..v.....v1L[w)w.}..!...Y.X.V.D.......[....;..[..;....

                            C:\Users\user\AppData\Local\Temp\{BCB4DA61-3BD8-4CC1-A0B9-3F14E551705C}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):40884
                            Entropy (8bit):7.545929039957292
                            Encrypted:false
                            SSDEEP:768:MCBOA4d+ElOXJ/3pI7cRBiL7L6qERqGz65WXzZqJsKQSbIsTT6XB:hIAU+2cGdLX6qBG4WDZl4Ihx
                            MD5:7379775A1E2AB7FAB95CFFCE01AE05F3
                            SHA1:3D3DDFD8AC7E07203561BAE423D66F0806833AB3
                            SHA-256:9301DB6D2D87282FCEE450189AEACE16D85F64273BF62713A3044992B6B7A9E9
                            SHA-512:4B5006E620E80D3A146944649CF4CA619782CAD7E8C4CD0D1DE0EBCA0FA05EACB7378DAFCEED3E26F5698B07F19604614D906C8F51F898660E2F129D8DEC6F62
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1A.....Qaq....".....2....BR#S..br...3T...C$.7(Hx....4D.G..Xh.cs..'..t...%...8.....................1...!AQ..a...q"2.4Tt.......R3S....Br...#s...Uu.bc.de..$D..6..C%E..............?...z...;sB.yv...........]t.\...n...../....m....M.=.3G+..x+.....S).*&.J../..8..O/+..sG...p...<!....~.c..C.w..,[oHom.wc-.J.~.......L[..6...'..i_..S;...!Y.z.q].EK..M.x...i.x.+.;.+...}....#......f.)........e6V..p.;........s.)..Ml.J......IU.6...<9+9.^..l..Y...[._...2..^..j.ia...._..3.;...~..<3...;......z.^.......]..Qk.,...Yk...3.3Jy^p.}....q...I...&..t.......;..9.g.GH;..'...%...)..[..y..../...zCn..>...'...1e.Y..;....]..7...N>t..m-.j.............H^..T\.q.ru...}...eTn]I'r.^].#..wOY....v

                            C:\Users\user\AppData\Local\Temp\{BFD66ACC-F76D-495D-B333-1AD57ECE42C5}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:18:09], progressive, precision 8, 164x641, components 3
                            Category:dropped
                            Size (bytes):27862
                            Entropy (8bit):7.238903610770013
                            Encrypted:false
                            SSDEEP:384:LTawAZvhbrXzDc6LERLQ/b5vXOl6pXQ/wD5OUMrdRUUhCplQg0ESSz:6wm/vT/b4wxoqbdUhWnSs
                            MD5:E62F2908FA5F7189ED8EEBD413928DEE
                            SHA1:CA249B4A70924B73BDA52972E9C735AEC35A0C5D
                            SHA-256:20ABE389C885E42B6EBE9E902976229BB6FD63C8C34CB61AA70B8B746209F90A
                            SHA-512:EE8D1821A918BE8714F431895E7223D08036E88A4FDB9A5485EFF246640EE969A69A8AA4E2E9DDC35BA75FB6D4E95092A286E90B477BD6998C313639C2C31F25
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:18:09......................................................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................!.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..P.v..+..n(a..Q..S\6....Y....D......} w#.b..]l.5.RU..k...... ]$.$.........f........?.z@2uU...7....?..|.Q..I.&.. ......"T4)wdH.

                            C:\Users\user\AppData\Local\Temp\{C3456023-6327-4364-B61A-FABFD8161061}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:13:06], progressive, precision 8, 570x779, components 3
                            Category:dropped
                            Size (bytes):129887
                            Entropy (8bit):7.8877849553452695
                            Encrypted:false
                            SSDEEP:3072:QS1x1rXglsteJ79wHi4vNQR5yBlUdOSILe9hSj9jeWMPjdlOJ:vvglst1HiwWR5yBA2LeS9jd1
                            MD5:737E96E41D79D3BDACE7AB4F8CBF6274
                            SHA1:E6202A41A4F86B27D9EBCAEF7670B16C0ED67CF2
                            SHA-256:7966F3D8A2D61ECB49A35E163781858E052C0B122A18A1238AFE27B57E2850E8
                            SHA-512:D398C8521DB2FB3F8456FE792CF37472F3B851DD7298DB20E2DB79144F8E846D051878E77E5EF5D00E6840EDB90C6E2D97935BC1023A15FC45038CCE731E9895
                            Malicious:false
                            Preview:......JFIF.....H.H.....iExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:13:06.............................:.......................................................&.(.................................3.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................u.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?...W..I:..*....a....Aa ...w.T.M.v.........3x.......8Y....$.."-..m.I.0~sxB[@..=...:..\.Y?....@O.L;9i..U....?.5">+9.s\Z..vN

                            C:\Users\user\AppData\Local\Temp\{C3D97AA5-922C-44B8-B2CE-33ED75F7948C}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):55804
                            Entropy (8bit):7.433623355028275
                            Encrypted:false
                            SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                            MD5:4126992F65FE53D3E3E78F6B27FD49DC
                            SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                            SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                            SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                            C:\Users\user\AppData\Local\Temp\{C3DC5FFF-F7EE-419E-871D-DB84BD05814D}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:modified
                            Size (bytes):53259
                            Entropy (8bit):7.651662052139301
                            Encrypted:false
                            SSDEEP:768:dCiCBBenRYWDBCipMYGTbYGLHbXxoP/qEF+MU50qyJ30h2W474S/Aq/xc4674bi5:dCiIQXBCiwbDLHD0/sFyVel4Pi4UgE
                            MD5:2EE369ABB7936F8C28FF0ABDD224EA05
                            SHA1:FE9D304A7B49E31EAE439369ABC548E265149636
                            SHA-256:FB12D59B8BE911247BBAFDD416852E8B74B028005A141CB4DBBBA109B4B6ED2C
                            SHA-512:5CF396CA472C32AE988600176114106CB1619404DD899A3867A5AB43DC90583B771EF69B14EF50E56A21F038BF51D8463C6ADD2DE9D4CB523F6290E24A4DECB3
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!1..AQa....q........"2..R..Bbr..#S....3$.....C.4v..(X.DtEUV.....cs..Td.5uf'Wgw8Hh........................!1Q.Aa....q.2...."R...r..3.t..U...B#S.4ub..C$d.5Ee&'7c.D%sT..............?.....?...k,lk^...M".Yo5.Qp.&s}b.m.:...W.x}.*.a......N1..d-n.-..^..b..TZ.W..."....F....^......ve5...^...2.:i...........~u2pK.z./&..u..L[I....Y....@y{|>..MN=:....Q[..H....a........|%..4fV....).....^.9b.f...F...p.=.W...aZ.........Z.t.n.....z3..[..lVh..\.N-.._.sK.y.._e.G.jig.a.7^....u...*.p.5.a.].........u/u..D.yl.XA..f.z..~.x.....N.....b=.uv.2.t.'.N.-.H..n.v.a.A[.Z.....T2...._...:....h..l.E..sm..a.3I...RE...fWb.Ek.0.#.)..Y#T...........u{....U....s.].7_H.2.`O6...P......}..4LR....]4.mid...

                            C:\Users\user\AppData\Local\Temp\{C476B4A1-7761-40E9-91D5-9392383A0DB0}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):39010
                            Entropy (8bit):7.362726513389497
                            Encrypted:false
                            SSDEEP:768:6tCjwO+E+KW0ZtOgepcoWW4pAWQ6/KWcR474HOAZaDfK:68j+E+KW0HOgep/72/NKWcRNefK
                            MD5:9700DE02720CDB5A45EDE51F1A4647EC
                            SHA1:CF72A73E1181719B1CC45C2FE0A6B619081E115E
                            SHA-256:7E6A7714A69688D9FFDF16AA942B66064A0C77FCD9B3E469F89730B4B9290C3E
                            SHA-512:5438921467D62376472007B9EBF3C35C9D9FE3EDE04D99A990129332D53EBC8EE2555C0319A4F7C0DF63516F29CEDF2171D8B6DC34C9FCD075C2CA41EB728660
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.........................................................................................!1..A...Qaq..".......2BR#...b%&6..'w.r.3f7W8.s5EUeF.g....CS$4.Vv..Tdt..G..(c..u.Hhx.......................!1.AQa..2.q....".s...3.4BRr.#......b.$c............?........uf.....t...;..[...W.h.....-.k.f..i.u..KQ..b.F...rM%/.8n.S..=9.....G$O;.f.}L..N..U._i.[.X...3.~....S.~..+t$...c.5......{..X/..#.G...}s....6......^....o~.$.\WA?...^*w[O.~..6..~....a....~..:..0.......{O...|.s.u._w.........i...........{K...._.?.../{.....A..8....<g.iu..<..................X......|]v....D..9.k.w.|-IF.Tv.-.&.........."'.4.b....z.._.Z.....G...u.xyt./_.q..m>..S.V.Xdc.bw.T.W......g..........}s.._..?....U]_.......`......>.|'.~xH....,...?........?.q....o../..R..;...Y.G....A"?......?.<..1...w..o.M.........tco.

                            C:\Users\user\AppData\Local\Temp\{C9D95B7C-B422-48D6-BF62-B05DD6A1E9AB}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:08:07], baseline, precision 8, 595x450, components 3
                            Category:dropped
                            Size (bytes):59832
                            Entropy (8bit):7.308211468398169
                            Encrypted:false
                            SSDEEP:1536:HS9SYFtN0+CRa9mfJy4zBAiIJhzrkHDV2hJK:yAmta+Tyy4zBIJW5WK
                            MD5:DCDD543A4E0BA2C1909BA095D46FFBCB
                            SHA1:B86C89537138FE07255354202D3EAD0B53B3C54D
                            SHA-256:28F334B77068F71F5F92A95695433B950610204A0E5580CE567DB8FAD4993ECB
                            SHA-512:5408C3259B7F3288A4BEB04342799AD5FE3A6F0EC7E92353B29B7E7E538DFA9903B39637226919E0421BC422635D25F5F8069DC7441864DC03E1B909BF5C2C84
                            Malicious:false
                            Preview:......JFIF.....H.H.....fExif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:08:07.............................S.......................................................&.(.................................0.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d.................................................................................................................................................y...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?......;R~+'....xh..~.n-}.......Te................^B..IU_....._...S......h.......!....9...A}6V=J......C..c.....Ug.Wh......

                            C:\Users\user\AppData\Local\Temp\{D2220BCC-335A-46BB-BDE4-345798F2C421}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 177 x 123, 8-bit/color RGBA, non-interlaced
                            Category:dropped
                            Size (bytes):65589
                            Entropy (8bit):7.960181939300061
                            Encrypted:false
                            SSDEEP:1536:2Hlrjw3xL//DPgff+9j6yPWvHMHjkbfnwHO3AW3GL:2H2zDUU+yPVHITwNfL
                            MD5:8B48DA9F89264D14B83FF9969F869577
                            SHA1:E1BD58E2D80FEEF56DC514F3F0B3AB9669F22F95
                            SHA-256:62AD3C277E54F03F1ADB44062407346F789E63859B7AFABFD64BE6AF5E9F66EC
                            SHA-512:03B783EC968DF3F648504D068D64DD1AE110E28110FE5B3401C9D04F44897DBE0CBB5680D42CA4C665FA94A6CED4B559106EB3C06C9BF2C5B14951ECBFFAC8AE
                            Malicious:false
                            Preview:.PNG........IHDR.......{.....;Za.....sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..Y=.+I....t.y...,^vv....;. "|. .i7.....$.2g..']pH@p..]b....H.H.......d'@ B...U.xm..3{3k?..5n.._}U...3......~..>...g.....f..t...t:...p>..Si..d:..k:.Lf..t6.K.i....d<...x.8\.8.+lc...)i.$.r.....x.t.BG.R.cm.c...p.:&.6.4..K.......^...~b].0....oBYv..u.'.=.K.Q.g)6.....4.!.M......4.=....G.%.Sr........nxC.F..t.U........1...J.t..eQ....".... |...81.$D.!.>...........$...^.vY..EY8tb..'.P.g#O....S*..0'.V....x.W..........k.......s.C.S...J%.iVb..].........3....j.}*.z....+.s..@..K.....\x.C..e.Qq.....;N.....;....,....^.*..$F..{G...8.#....8'..&....8..5.....3(P._....S......|".....u.cr....+a-....&V..x...iI-<|a.{E.c.X.......?..&.C....'........(.x....>...M.?.9..#X......l...0...Z.F..<.z.0}Q..Z1..........?h..`E$K.2o.A*c^.......*..D..uL=.}.#*0.. M!.A.C......|_..(.Y........!E... .O...`;....M+..x.u~g...q>...N."D^..K..x..D.`.!.

                            C:\Users\user\AppData\Local\Temp\{D414CA28-C446-486D-86A2-DE1B25CFDDE2}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CS Windows, datetime=2004:03:12 11:12:29], progressive, precision 8, 598x766, components 3
                            Category:dropped
                            Size (bytes):70028
                            Entropy (8bit):7.742089280742944
                            Encrypted:false
                            SSDEEP:1536:ub4bgbB7g9cKCmSzaNF0jAdAzQKTEFBQqUp/i0yG1pidLHTVX:ub4bIB7Qg2OjbzjgWp/i0yGCZx
                            MD5:EC7811912ACA47F6AEB912469761D70D
                            SHA1:C759BC2D908705D599B03BDB366C951B11F99A4E
                            SHA-256:FBB4573E3BEE1B337077691BEBAE15D6FAC52432405D31396D526D7694A8283D
                            SHA-512:881828150993A8C56E36CDA2051D89C1F6E0322643902C9506392C163E8734A2933A46486F40E5BC8C8D0164E180605E52620EF22FE14540AEA787A38B22E98E
                            Malicious:false
                            Preview:......JFIF.....H.H.....7Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop CS Windows.2004:03:12 11:12:29.............................V.......................................................&.(.........................................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................}.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.....H.yM..? .Z.. .^.x..p.8.A...K.... .\{..)..y....t..=.^y)..v.@.W>. .h.. ..p.:.\)(.$....$.I).....!....E..Z.....&.5.).

                            C:\Users\user\AppData\Local\Temp\{D66D2951-DF80-4937-BFBB-503B126A25EF}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):55804
                            Entropy (8bit):7.433623355028275
                            Encrypted:false
                            SSDEEP:1536:gVvci05lhVbfBcWvBLeynluexaWqzww/u5:gVUZhHDljaHww/u5
                            MD5:4126992F65FE53D3E3E78F6B27FD49DC
                            SHA1:BC0D76B69310DA9B909D3EE4CECBFE5F386BFB45
                            SHA-256:3FBE3C1C238BD7DBC67F8CFF5F3BDDFD513C96A9851B9616477947D21DFF4B2E
                            SHA-512:624853F5E56D224C8188F122B2C4724F867D4099E7FAAFB9C945BE7E2907900ADCF4AE97AB08909CF94E96FB6F381E3B6396D560D93EB2731E4E69CBFE628F10
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d..............................................................................................!1...AQ.aq"2.....BR..8x..r#..9b....3....CS$.'.cs.......7Gw.(.4%5&..Wg.h......tEVfv..H..........................!1A..Qa.q...."2..u6....BRr.#...b..3s..d...7.Cc.$Tt..S4.5Ue..&..%.................?...,...8..{..S.y.N....%..q.8..H[5....o..xg........)c(.eO.YO..._D..x.U.....%.S.r.r._.^..Su.h.Q.t.:.#?....x..B.S...Q.....oqF..%..8'.qx....%.2JKjF..{y.w0.*a.RMb.c.Q{%....eW'..[IV..'ZW3...[...MN.....rO.:....$.i..7....Vrrr...I.r..M..Qo..j....q.^...N...J......%.J..)F...>$.....u........o...+......[...*..t....R}.I..R..S..GB..:......).6_[^Xft...F.1.....zP....,.#....MG.T..Q.F.....)Fi../.I...,%.voEb.b.Z..V3..FT.}..[Z{....wd.z.e.....QwW(.).t..\..'....:)<W.<..&k...caRT.X(..K.....:f...]...q..

                            C:\Users\user\AppData\Local\Temp\{DA112A63-291F-4D53-A5B2-1A183C44B2C8}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 813 x 99, 8-bit/color RGBA, non-interlaced
                            Category:dropped
                            Size (bytes):99293
                            Entropy (8bit):7.9690121496708555
                            Encrypted:false
                            SSDEEP:1536:Moq1jVORV5NO5xLCBaaNk4vhpCr1CH/DATOQlWvHMHojiaAMrxArLFRZPj19AWFz:eVEbouBaIk4T8uDGOQlVHvaAMkhDh95V
                            MD5:EA45266A770EEA27A24A5BB3BE688B14
                            SHA1:9F0B23B3C8EBA4FC3C521E875EF876FBE018F3C8
                            SHA-256:EDAD0F03E6FF99FEF9EF8E8B834CE74F26CD23C5F8C067F5CEE66F304181E64D
                            SHA-512:D4EE36BDA897BBD643A699A0332DD00DE9CDCC6F46D861789BAD259A4BF87868AE3B4CFAAB6DFAF29941C7055B77A95D76BAA86A4A0DB2BF3BAF7E3317F03EB9
                            Malicious:false
                            Preview:.PNG........IHDR...-...c............sBIT....|.d.....pHYs...........~.....tEXtSoftware.Macromedia Fireworks 8.h.x....tEXtCreation Time.05/15/06.8.p....prVWx..[Oh\E...y3kv........`.%m.R..6.1.4).o..Ki...D.......P!.].=..K...C[....f.}o7VPJIg...{3.|....d.....i..=.4.u0...n y......@j..Q..f)..mQ...4-SJ..9.d.?..5\-....:b.W..i...c.5..{..pj#.....B1C/.I.......].Su.k?.2..:.9Q...5.U...UZ...e..U.c],..2.}...1..)W./..Epr.Zt.....K.=..{......e..."...v..B.4.#....A.V1.".V}t..[..2f..Y..V9.".6.......(..gbm.P.....Y%2.c.z.:Q.2.<tYF.....u.@..KJ.;u.q:.].....$.....V....Hqk..DW.l.e.j.Z.YP?:'R..*.<........6...m@..r..j2..HK"|..L.Nc..D..y.9..B4$.......`.3.m1LE....7(OU\+./.O...%6T..w......h....).I.&n...*......#..W.41...5.#.`..I...<.?.|..*+Q.....#i........$,..n...`.s....[..E. T.w..j.,&-.r..;a....#.>(.P......f...MU\3*..;B....)..5....z..(....-...a.....}y.l..E...z>......&..g.$.....*T...N....E:./.>..#...^..E.0..%......(..@..W.X.NDM.<~.]A.>..fW.O.y.'...Z...h..).F..

                            C:\Users\user\AppData\Local\Temp\{DAEFD9A6-4F9D-4B56-8CC2-CFF1888EBAF5}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.01, resolution (DPCM), density 28x28, segment length 16, baseline, precision 8, 276x139, components 3
                            Category:dropped
                            Size (bytes):4819
                            Entropy (8bit):7.874649683222419
                            Encrypted:false
                            SSDEEP:96:/hnQiz+ET2/hDi+tv34VtpWfowTHgegb6hhLT1NTS:5nQ6TAhLtvIzMvbi6hhF0
                            MD5:5D6C1F361BC04403555BE945E28E53FC
                            SHA1:00C254F7B3BC0289590C2BBDBB39C8EC2E2B2821
                            SHA-256:131D637CDC5D0B094FB9FAD17F4D2A1ACE0D03613588155AACAA2D1CB4E16DA9
                            SHA-512:34D2C0929FCC3CC10D0A2121BD55BFA9A07062C2A7B8F101071164C946895DBCB2777641E79DE4193D57A3F0778DD4F1351FAF333B7E4B4DBE31A32DD69C51F9
                            Malicious:false
                            Preview:......JFIF.............C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222...........".......................................<........................!1..AQaq"...2B...#Rb..r..$3CS.cs..................................................!1A............?.............u....p.p($.Y...9,j...V.*..S86yh.G.#m.5..9...6Y.."C.R:.[..-.7U3c:..].;.....f.?%..<T...&F.Lh.N...m]..x.D.g<B.....k..S........>j.K....#U..Z....<e.:..8....o..xq.[..4v..U..y...k... k....A#..A...pn.jJ.I.7:..{.b..ns.t,...8.Td.I....m.I.5Z.).-.. ]..X.Do%.....?..4jV.`llt.E...5...u.|..\F.=.F.r<...5dV....xc.%..&...4,...f...3..H.<......eQ...P.J....7...lLc..?..-.fR..7.#.6.......}:.]'.ny..........e;u.Y..$0...i..-....f..9(....}..T,.Inb...+=Cca7....WULA1@.s...4uY5.N.f.c..].ks.....3v..~..k..m)...f gNE`S......#.....Z..6.uc.m...#k.s.f*.l.$6..?..xC.Cm.`...N2..&H...._.&.E...[....f.Z./...!.a{K..#.V.5..v.B....1...9..B.&....%s.

                            C:\Users\user\AppData\Local\Temp\{DC8D387F-83E6-42D2-91A5-460E42C30A16}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):67991
                            Entropy (8bit):7.870481231782746
                            Encrypted:false
                            SSDEEP:1536:3PC0XJjsmsKuZRG1pXuZ6z3wARnV9AEnieCc7cllJcHJ:qyMBzkUZ0gq25c7Z
                            MD5:1271B1905D18A40D79A5B9DB27EE97EA
                            SHA1:9618608FBD7342DE6C71220A36C3F4995BA9C13E
                            SHA-256:5B321A4D81BD499B289B1755F6450A42047C494DFBC112DBD56DA4CED2C15C1A
                            SHA-512:C32DD26047F6B8AA061085B38AC2B8335868E1BFD8731DB65544309223A955FA4BF45B06AC8D244408658F51A1775B6F19FF0FFC804989DE706DE8EB36F1436F
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d............................................................................................!.1..AQa..q..".........2...BR#b.r.3...$.'...)..C%7gw..(.S.W89.......................!1.A.Qa.q".....2...#....B.t......rc.$%67Rb3s&'CUu.v....S.d5.V4T.e.............?...?..Wj.e.e.......w/..E..eOw_.....6......u..C6h.,..;.g.D8Z..-)O..jy..e;.u.g..w..[.L""k'w.......'1'.[......=..P...S.9a.V./O....q=8xk]...........9......F...e9'....9.O.... .&.....p......c.4...mr...?.......L..'.....0....+..|_...POM=7.?.2.a....};.Z..y./....>./.C.<...;.....|.1>...........S.8.o.O...+..n2...k../.X..9...Y...:.....\...Dk......q.K..\.Wuh.!Z?.mu...R.5.A.S.h.0..[..v..+M.....aUi*.k..?#..._...X..R.&]..[..;../]L..f..V......*.e...ut&.#.J.5....c%..o.$..v.<K.6..T.IP.....6X.*.uf..t0^..-.)m$.!.q(.j.f;..WB6.b.B..R.

                            C:\Users\user\AppData\Local\Temp\{E5D19B28-B2ED-4B26-AB67-3DF639EE797A}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                            Category:dropped
                            Size (bytes):12824
                            Entropy (8bit):7.974776104184905
                            Encrypted:false
                            SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                            MD5:2628353534C5AD86CBFE57B6616D46DD
                            SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                            SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                            SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                            Malicious:false
                            Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                            C:\Users\user\AppData\Local\Temp\{E5E8E1BE-1338-4947-913A-0BC55C8E6C37}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):95763
                            Entropy (8bit):7.931689087616878
                            Encrypted:false
                            SSDEEP:1536:EoES7mhTyzabUaE77xAOmq0zVruQlttNxlipxVWssMU2YhRy2v6pKKYhQzwMc2:zz7mhTyzabUa4b4xuQlttnlGx8x9h02M
                            MD5:177DD42CA99CAA2CCBF2974221680334
                            SHA1:35FD86B3DD082A6D4930C67BC0E05D3B5817465A
                            SHA-256:525A857D0EDA855A64D3619DF58B1C2D013A73E60FA0D49B155ECFCB2C134C7C
                            SHA-512:6FB6D9A6C97B1115C3246690A2F339CD612899AC25ACBA00296EAEAA0A1D094E7339D670969764FE23EB7C08FCDD01C6F78FBC0735D504D5E02AD342901719B3
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d........................................................................................!..1AQa...q......."...2..B#Rb3..r$...6..C4....Ss%5...tu.c..Dd.EU7....................!.1.AQ..aq......"r..2...4Rb#3$B.Ss............?..H..dV....U..-..0]Cp.%O.Z.Y.e.=/.q.....j76.w@s...5.&&&5...n..w..>.1....;.vR..[.......=.......KtY]u3.g18...).r....&.IZ'.....g..4kY..X..b.......y<...r1........e.._...X...w....op.m%Jr31...S.Vo.._....OI\]....F..V-....\...2j..X.....y.p.$4.....&#..]..n.V..x..P...F..C.f....])..~..Z\.....,..#..v..v...2V.k.SuaydO../[.*c._..oTV<Z.s.[...o.x..>....-....v...#....-.X..L.Z./#.XG.-.0......%w..H.@aZ....C.}...N~.;..R......5.D......I.... .R........s.>..ks....(...S...9....2=. :^.. p.+?(....$..Q..I.........=|..`2. v..t......U*.8.u.. ...'...*...2;u....& 3..$.

                            C:\Users\user\AppData\Local\Temp\{EA4765E5-39DD-4655-8599-B20B6789D42F}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:Windows Enhanced Metafile (EMF) image data version 0x10000
                            Category:dropped
                            Size (bytes):32656
                            Entropy (8bit):3.9517299510231485
                            Encrypted:false
                            SSDEEP:384:qR0eV0V6zLq8fAy7TtS1O6VILpjH5og6NJgnIuu57aqP+Tg3QePV2P6hqaJDyjJg:qlzzaRpbd1
                            MD5:DD4CA4BC0A73FCB71BEBAA3C29CB8F66
                            SHA1:1A7085771D7941540EC94A1BD24D7CC8EA556D4B
                            SHA-256:0401451E1D1D7DFDC29AD1B2B68A6C8AC0B706E9868BF22FAB26A01CD48620CE
                            SHA-512:5B7D386C46EC75E21DE94DBCA922FB9A6E5358DEB3D60FEEE7B197D739F15D11050825D9323502EDFAF60720F1074DE896B23E71C44D07C9C7E943C31FDC078A
                            Malicious:false
                            Preview:....l...r...1...*...^...bX.......^...... EMF........h...................`...E...........................(...F...,... ...EMF+.@..................,...,...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........F...(.......GDIC....s...2...+...^.......F...(.......GDIC....s...2.......N.......F...........EMF+*@..$..........?...........?.........@........................(E..HB.'E..HB.0'EI.`B.0'EU5.B.0'E..B.'EU5.B..(EU5.B.(EU5.B..(E..B..(EU5.B..(EI.`B.(E..HB..(E..HB.................@..............!.......b...........$...$......>...........>............'......................%.......................;.......U...P........................T...S...S...S...S8..Si..Ti.@Ti.qT8.qT..qT..@T...T..<.......>.......r...1.......N...............%...........$...$......A...........A............"...........F...........EMF+.@..........F...........GDIC....F...(.......GDIC........2.......N.......F...........EMF+*@..$..........?...........?.........@.......................}*E

                            C:\Users\user\AppData\Local\Temp\{EDB8E88A-0A04-495C-8500-32CFE6E6AAD8}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 39 x 579, 8-bit colormap, non-interlaced
                            Category:dropped
                            Size (bytes):515
                            Entropy (8bit):6.740133870626016
                            Encrypted:false
                            SSDEEP:12:6v/7su2/c30mqkg9VgFHe7Ll8UmJX/N+1Zmkk8f3lbtI4:4mc38gFHe18lkk8f3lbth
                            MD5:E96BE30D892A5412CF262FEE652921CA
                            SHA1:8190A0BFE21D04BC6F3A406E91B87CA69C03A2DE
                            SHA-256:0E31DA4DFCFF4A36C64C1CE940362D2309769F36369E4C43C317D5F2FA15658E
                            SHA-512:D647F51ABBD013226A6ADD0D551D058C633F867F9AF5A9E099B85D6E291D220F7B85958B07381CD4C7C4F72356DBAFE2A86932AE398E28C56CDDF0744E92EE24
                            Malicious:false
                            Preview:.PNG........IHDR...'...C........b...`PLTE..................................................................................................bKGD....H....cmPPJCmp0712....H.s....9IDATx^..I..@.C..<..?mo.#C((.J}...~..B...b.I.i.\<.e.....(p.I.EO...q.x.......dRz....K..b0.:.<c.o..0.x\:...F....I&..ap....."P@....DO...q)p*..@Y.CL2)=......1.........4....._.G..^`..lDO...q...X....SL..z....K..#.L#..I6..ap.Ls.,....7&..ap.p..lI...,GO...q.....k.n1..4......3=.f.x.$..4.....o....x.$+..0.x\.,&6...............IEND.B`.

                            C:\Users\user\AppData\Local\Temp\{EF701356-C3EA-4348-99E2-A62D08615E32}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):79656
                            Entropy (8bit):7.966459570826366
                            Encrypted:false
                            SSDEEP:1536:2kuUliOeU4os8ii3nF3Hxro/qxXD9u/kjYgMZqoEs6ZUldm:3uUsOXYIAixR2k7WAZV
                            MD5:39FF3ACAE544EAC172B1269F825B9E9F
                            SHA1:2D40DE8D90BD21D56314D3F99CEF4FBAE3712C0F
                            SHA-256:70475431CCA3C91A4EFA3B8F04864371D2D3A45696674A1A0562FE9CD8DB287C
                            SHA-512:3B9F3B32696AB7779864E83DC0C45960114A130BEE0CF4D0643DE57FF952171E5D775AA49141EE31A28A9B5D052B26EB421F26EA736D7EF4B3A7EC812CA411CB
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1A.Qa"..q.....2#..BRb..r3$.Cc..Ss.4...D%5&..T...'7....................!1.A..Q.aq..."2.....B3.r.#..R...bc$4..D.s%............?..Y..T.o.\......=.a..j..'^..s..[../........Y.......<...(..4.....7y..Ln.[9.cK.ilN...u@$.V.9.V?3..s.KL.z..w.jW.C.............@.~+.o?o8...k....,.m..9.".....q.....d....z.W...q...~...'..e..>..f#...S.....F....pU.......7..N.vfK......S..G.#.....}.c.........RXt.bq1.`.....[+8\.*.N..:......}.....r..........')......Na...&...m......c...a4_%d.............co..0.n.L.Q..E.Lt..y.|..F..4.i(>.._..\.eNL8..?z9I:hLgC.@.p....g.t......'.I!d..?1f..R..........|..4.wJ*..%g..~0bt.....*...v.......O...:.~.>~..o.x...9.@>...s.&.E.0/G.c..t.<..F.t.A.z. ......;.........Gp.P

                            C:\Users\user\AppData\Local\Temp\{F1E04C83-82EC-4C44-B1B7-C432EF65EE68}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2004:03:04 13:27:10], progressive, precision 8, 102x792, components 3
                            Category:dropped
                            Size (bytes):52912
                            Entropy (8bit):7.679147474806877
                            Encrypted:false
                            SSDEEP:1536:DB/nIviNJD9C8kfJj6TkVr4q24FsUpjPc021si:DdnIvi3D9C8Cl6Dq24ayPCz
                            MD5:1122BF4C2A42B4FA7F29D3C94954A7C9
                            SHA1:3750077A830FE21735A43ABD35C63BA9A4D4B0DE
                            SHA-256:423B0DD1A93B391D15B1DC8D8757C3BF5725FF2E7A59E6E3140033E2876B67F6
                            SHA-512:4626EFE2EDED2361D6296B57F994DC434CC9D02357A8A6A67D84A544FB8A1CFE0005EA98F846AB963BED7F2B6CE96BC9181182C9459843A52A98D3A731A4FE73
                            Malicious:false
                            Preview:......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2004:03:04 13:27:10............................f.........................................................(.....................&...................H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d......................................................................................................................................................"................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?....]+\.9.9.P.d..Z.?~>.-...]6=....*.......S.9G...b<$..Z..........>.v.o:.o%.e...z.F`...[.wo..z.....k..E...5....G..7.......c2..

                            C:\Users\user\AppData\Local\Temp\{F6C9FAFF-35AD-46FC-A15C-BBDFFC59E39A}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):179460
                            Entropy (8bit):7.979020171518325
                            Encrypted:false
                            SSDEEP:3072:oiKXvL7lv0am/R1vrdH+9dK6zPQ6bbnGDpcGGDNMIOIMAT8q9Vc02Q57S4A+vMFz:+vlvC/HvgA6fGqGGJlO1qZ71W6CzDn
                            MD5:4E131DBFEC5C2462273CA7B35675B9D9
                            SHA1:CA037F444D819A118AC37D7AA3782B9BF94C1616
                            SHA-256:2A4A3530D652E227DDD5ADC096A95F6034718F7C380B07DB622022D768815059
                            SHA-512:C333ECEB1439D0238BF44FB7896E62DBA4C645B70413AA0F99C1F10E8DCD20C2EEE5C83F2E9DDE9A2494C85A6D8D13CFFFC4160E2F598E17867015F5244D656A
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d.............................................................................................!.1AQ.aq...".....2Rr..Bb..#34.....CSs.$5c.t....%.Dd.6.T..u.U....E.7w........................!.1A.Qaq......2."r.3....BRb.#4......CsSc...$.5..%.DT.t67d..Uu...'............?..c.......p..z..i.....z......kj........F>f......3N...M....RM.&..-.~.Q..'.....q.a..w...-~......g.{..&.......V.n.D....>FS!n.....@..)...W..q..Wr{..J.gf.{.M$.P@m.,..9..&m.D...w.._...-.O........s.....h.k~......(.K...V..l.-...+.9.k......*......#.p#.O..9M..mF...C.......7+.AI....4vw.;..H......e..Q.u[.eUK.....z.....[.Kt...s..Lf.4..l{.....sh.............=..;..iqkj.m.a...NH......v..H..$..q.y......c...U[Mcf.......+...S-...^....4..T..YtL.x.v.;.....<...Ik|B.$.s8......3.+.8.l.. h.:....%B..W..I.QRS..,*x.

                            C:\Users\user\AppData\Local\Temp\{F80B6311-9021-4201-A44E-3B045D7400E5}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 612x792, components 3
                            Category:dropped
                            Size (bytes):86187
                            Entropy (8bit):7.951356272886186
                            Encrypted:false
                            SSDEEP:1536:AbmHwD7za0syWMetp3TdPFzoJamVdAQZCiUit9qbYN6LerhWMzIWgN1EeaYhJM:1QnzsyTeP3TPAdAQZCi5qbYEKrhWWMNO
                            MD5:FEE4785DF76E93A9DC2F4501CBAEAE12
                            SHA1:8FB4527BDE05EF208FCDB168098A07707C27501F
                            SHA-256:F091DED5E283AF6848670A3172E7C43C6099875D39B3FC69C2BDBA914F609602
                            SHA-512:7E99D33151A0D3873D6A819C98EA8E62D928C087B7BA2080F11C7BCF746AD60A44D4FF6EE3D2D2E8DFA4BF1FC6285ED56BB83F91C2FC6FC4FDFF2000105F10B1
                            Malicious:false
                            Preview:......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................d...........................................................................................1.!Aq...Qa."...2..BR#...br......6v.7..3.CSc...$4.s..&dt%u.f.......................!1.AQ..aq........"2.B#....Rb3..t.5u.67.8.r..$....C4.cs.Sd%.DEUe&.............?............w.....c.....i.A.....3...7.......7..P......%.........?Th..l./?.;.....$}..=5Oa...F.c.A/...D.D..]..y..3e.5\%.fo2.X.*]q.5Ee.}..i..md.T....#...-...Mu...9...-+..~w5O.);..G..'.;..).....A_...M.vV..y.q......,<.3.(...._K:..XM.......w.......9..T.......?b..a-%.c;.}..>....|.,lZKCEB.t...fw|.Sw^..Y..:.J.................t._P..v..j.1.R8.R....G..W*H<(Xi........i..xcu...WM.dqM>'W..g....M.q.....+.....b'..~....>..T.~Jc....fj.X.x..9...N.w.6:..>.......&.(h..u...t._...)_k#7Za...cZ....P...Y..;.V.,..xo.....f........Y...\6...M'L._

                            C:\Users\user\AppData\Local\Temp\{FB749491-E48D-4A99-8675-30977D32BC94}

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:PNG image data, 189 x 305, 8-bit/color RGBA, non-interlaced
                            Category:dropped
                            Size (bytes):12824
                            Entropy (8bit):7.974776104184905
                            Encrypted:false
                            SSDEEP:384:gzPrAZvq82AP0/DHbSczEegiAh1Hfgr3ZO7EFKWHaXIXqu:erAZz200/TbJzDgiWgjZO7EFKEaXIf
                            MD5:2628353534C5AD86CBFE57B6616D46DD
                            SHA1:244B7E39D6CEF5B07FCDE80554D31F7DA240BB0D
                            SHA-256:69BDB000AC7E030B0B28E6CE78F19547D235355B3B841146951AD1294429FA51
                            SHA-512:2529F97BE62DE038445D1C86EE2C01404FB1A2D83A5D16C7B5F4E21723C17EC86FA180DFE10342536CFD7D334EA3AF1FFE151B77F2FBFFFE8E7B2A0C2A3ACD59
                            Malicious:false
                            Preview:.PNG........IHDR.......1.....).'....sRGB.........pHYs..........+....1.IDATx^.}.w\.n...A.H...E.J...l.......p...\{.w...e.-K.%..d.9..DN...^}..p.L...._$.t...n.=U..ID..]~(.?.)J...-.../.......0V..........'.)1X..c..D..2..A'f."...Ru..R=b..\....\.n.0...7.~".'..s!bd.|..p.u....-w'.....R.........i]..r....A.........r#...W..f{O.2~C.O........{.....3..W.}e:...~.....4.......t.Mv_....}*f..I...x11....d..6.@..O.......f.e..K.....L]..gohj&D..+.....#...#.J...n/]...8~.....zx.'.LI6..W....p...................V.F.. ...y.[.kl<?.^....N..$..7j.biU....c.51{S{.....q....c...<..x..............zG.F*.........U.w..fE.....DU.......WG7.5uC...7.....j..7yM...~jU..;J..a|LoG..x..<^.Z ...Z.....ip....._.4......f.rg..[...z....x1k.....z...K.l...;6.\..Y.#.WT.p.@{W....>.+..*..W....'v.nV...YA[.q!\.\...9..3.[|....7...HO......2<.....w.,].T^eN..XB.....M3...I.k...e..8...lZ.R...T.%......|N.w..9..!..O.-p..NA.eD_.d..nW2!...N...z>..;....=t#....H,.N.|. ......EC..............1.\

                            C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):256
                            Entropy (8bit):7.134031873011516
                            Encrypted:false
                            SSDEEP:6:5USnXXh8uXg3SBnPo8aC6ztDsY80T/f/9FZtOoRg:xHh8uvwFCRYTT/N3tJRg
                            MD5:64CD5D1DF3AE97F8517749FE81D8FA6D
                            SHA1:DBA0D31141C413DE582D575828383FACD7EECA09
                            SHA-256:B9EE513FB15BF6E78C26B7D1A47E279DA5DBF52B472E2FC74F09FC879196454D
                            SHA-512:4B32A31847B8E79E17CE034715491C91D6D21D6EED14746412E23110125765378B6B0819C4F7798DCF52ADEF025277AD65F3CF70E2CAB683025294F15E2E1906
                            Malicious:false
                            Preview:.B.k.A.....{.]..9H.o{7eD.}...P.I.cg,.`T...w.@.$z..BC.`(/...3.U.W0d.....(%v!h......._ {..q....P..^_......E.!... ..d.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):266
                            Entropy (8bit):7.141005685450912
                            Encrypted:false
                            SSDEEP:6:M4PurIqOLh8nQe5RupmDRkwdg3cWvSyjzWcPo8aC6ztDsY80T/f/9FZtOoRg:MgqOLh25PwmDRJehvSyPTwFCRYTT/N36
                            MD5:C4618BF5A27842091A767EE59320B3F2
                            SHA1:57031CC5C383C80EA3331A038F93E5FFC7E2B222
                            SHA-256:B20AD1A693B3EEA971A734E16F76707CBE5EB7B892EDAC4CED43D3DE52FB6580
                            SHA-512:D3AA50D23CAB78501C9AC3C3915B4C64FE96EDB8B4230760E025EC02CB9CDDBDB52FF485C3E25747A768FA9E58A35AC6BD72D379A7551409A5508E3CD773ADF6
                            Malicious:false
                            Preview:.`..N.k"..v.I.4.8;.-..+.eD.}...G.I.vkG..H|...u.@.$y..B@.`(4.....R.=.\..i.Re...'.w.w~...>....E....5.~.|'..d.Cv.........r.N..Z.&.l.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):10483
                            Entropy (8bit):7.979650354996628
                            Encrypted:false
                            SSDEEP:192:yLBD8CAVO9o+F+AuBxXf/MkK7u/ywks7+XPbo3E3tsl3TqnhPIo5mByNw:MBMUWe+z/Xf/M9saXjo3O4qnhPv5D6
                            MD5:F3A72085B79EE43B8632A83D4160847E
                            SHA1:9E310C9665C1096F8438D102A899FAC1AE558360
                            SHA-256:D2507C0FEA78B2E1AFC9D6A0FB99C834BDC238A94F3E11C9454C675421605999
                            SHA-512:B98B120E2BCBE12A6DCE9EBF4C8F2C49ACA20354FD158329EA79798DAFDCCDA261449348106D94BA00F8AAF021D0AFD03A5673A29498DA49A91BB987516F5AA6
                            Malicious:false
                            Preview:.......W.....g.4..I+........S...C..c7u.NZ..Jz.R.......X.aG.n.Pn@....q..X.._.... vQ...Y......o.,\V..V..n.#n.K.hS..l.......Q[.+D.0tu.s.ll,Y.&l...n.6.J.7..$@..#}.O..f>.t,SL.W.uzj...A..!,.B.....6.....$D&.....u......8....`...G...ap.c..D.bu..gb..u...xt.r%l.N.~"*.../.&c.F>..Xw.%.t..s....S\..1G..x...W...+.:..H#.xAk.)...._._..*di..V...9..9M3..9.b...7.9.A..(...}hm`2+0...o8tM|+9.R..,....'.]w...>......n...&...}..)...wF......sKWG.=.w...ej..x.0Vk.#/...R...Zb...FC.v_.C...udT...O1......K.....c<.:..~H./%LD(..J......b.7.cS....`.:..1..|1....C.S.g3.........)..;.X..B..j}a...s..u.r.....K..!{.k...74..._...F..HbLwh......<........Iz;0.^.5X....R..k....H.b..<$.......X....f.?Y....BXD...z.`^l.=.....T.y...._.I.tJL.p..`yCc......p..~..`"v...4.I..??.[...C.0........M..p..P...>A. ..i.3.........O...dXF.....st....n*l...7....=.|....n...%l*...P..-..}.o.S...nR@.._..JRr..X.K...p..R..r.W.......4X....Eq.0.p../.5..h......b.v0.A)......F...%u..T.Q1C.m]...4.@..I%..Uj....r.gZ

                            C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):24396
                            Entropy (8bit):7.9915300861962715
                            Encrypted:true
                            SSDEEP:384:5/LbpCJ78E9TIAxZxLy2jnqvt7NZuVCCb+mttHjoSIxYOj6Z68IRG4:BpCr9TIADxVnqvt7Lk+mfjnIq+6A8IRV
                            MD5:9BEA751F2304191FC625052C773C222E
                            SHA1:558115E1DB0A81E9B1B685499F3C387D44CEE558
                            SHA-256:02C78DE49188FDA5F9F0C572C57CE83E2AFF0CDA56B7724CB6DB492ED92162C9
                            SHA-512:ED21698655FD9047E18D83D16DFADF3D52040ADA062570E9D33C72FD7AD090B18CB5CF7F55517658DC4F67F8EBCF55EA738AD4C74E6B29738E3755DFDAA125CA
                            Malicious:true
                            Preview:e'oY^t..V>.*.K..C$.S<. &;M.|..h\...........J.7..m.a...o..<=se|'..c..F_s...s&?ie...6...J...IU....J.M....Q..S+.5(..,......n!M...M....,}.T....FV..3`....6.A.....d...*.....[<.....Z...%i.eG.$.V3O....N....a.......SE....8ZU.|.P.....i|.......D.......FlW}.UV.,.rlC....m^.s.../TJ...hbz....$N.n..dcX+.\.5.\/..0.....n...V.&J..(.^.....*.q.^)+..sCK..0...e...d.....$.G.../...Aq.._v..&.\i.u.i...B..+a...1.oW...Ip..........XnLj.t....3....w.Q...%:.=x.[..I...4;:|....K..8...fv.....5hi.*.'.&.~$..#.....J.....{.1>..].R........RS.2...y....,...z.../.;.....M>.f.......m.SPA...S.]E..P..}._...ts.o...J..."....' f...c..Y./.8;....?...x&Cb....-..>I...........%..*.^6...........=..NSL.nX.C._n\U0....$_.{.....M.,.lr.<zby.>.Wj...d.q. G[.&.@A..v...E!.b'.. c.....__R.v.....e.......Sw.MZX.Q......'.H...X.wg.....xg.p.d....la.\.gY.*.2S...5p.0..c..@..Ll.D...."@9L".i....P.;..-..6.Dy'....B+.......X.>..Z...c..c......a...b0.. hov..Ex.E.R.5.....c.X..Ubf...C....w.ff...8.....1F$....S..-.1<.UO...#..

                            C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storek.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):509
                            Entropy (8bit):7.556907747259441
                            Encrypted:false
                            SSDEEP:12:Swk7E/uW6ri3d+5wmQ7+VWqDfMl4aMzP/jcwFCRYTT/N3tJRg:STY//kTPolK3iYTT9TRg
                            MD5:D160C35DFF0EB6A8AA620697DDA016BC
                            SHA1:BF223C1B645761B76F96DBA605A4B1BD55A199CB
                            SHA-256:AD86B7465C8A3F8D70C98CE3991D90187B043BD26EECD0E4799925D82504247D
                            SHA-512:C539D0854CE2C93999F42287982D1A3897C523EF3CFD89FD6F5BD504029A20B2EACBC541FF46283521539C2AE22C1DB102BD227A4F049F003008CC152FBE09DC
                            Malicious:false
                            Preview:{~.....1..R...v..s........>....g..X.3....._?j..}3;,....n....-./...r2v%KY.......'..V&.K...f.`V.....[...|..Z..OYp....J...#.m .FYj2.z2_...._...7d.l.D:.."........(.`.......C+.k...&.c....7w........%~.//P}@...v.c~.,_..!.\...q...>..E....F.#..b..v..a^...(.gD.}...q...y...3Vo..Zc...y..B@.`(7.....Q.,gH...q.+&.L...\..a...Qj(..W"Xv....L...#.S^$.@..y1.?.V..$d..]o.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):274
                            Entropy (8bit):7.197640146764503
                            Encrypted:false
                            SSDEEP:6:Tz63FjyYNvUDjbqO86wDVPo8aC6ztDsY80T/f/9FZtOoRg:TG1DvUT1jiVwFCRYTT/N3tJRg
                            MD5:EED7449DAE99B0AB8190B1288057C6AB
                            SHA1:E468C74B6214E115B98309DB2EE91B164D450585
                            SHA-256:35FF1CB32425B4DA322D89973BFB593A470049F6AC16985F893BD4BD21C8C741
                            SHA-512:80769D6D7BA8694110252AFE0C39A054DB5BB94470FDAF01A8C2A73A5B058E4AC2E0AEEF599A32648A5D561AF788548B91CCC0A5D99BF74369CAB9138B52D199
                            Malicious:false
                            Preview:..`..j.1...S.{:{.Jv.P..8.}....8-..vD.}...w.I.vgO..]....w.@L$y..BC.`(4..6.N..F..XA..Sa.U_.....K...... ......oI.q.t....'.Q..u.\....:.h.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):296
                            Entropy (8bit):7.263535787815248
                            Encrypted:false
                            SSDEEP:6:uA2labYnwf1eOP2547SpmDXqCLyHFzR6jcPo8aC6ztDsY80T/f/9FZtOoRg:1waxf1eOPN7MmD6CcddwFCRYTT/N3tJ2
                            MD5:5935C04876A03200946C2AA3121DE594
                            SHA1:307C331A8FCC44723651F172DA612702BB1C884A
                            SHA-256:129661B8122076197A264D71D76AA76FF873CD8AF83483403EEE34F067B46B1C
                            SHA-512:1BC962FCD81AFC3F4F02572FCC1305FD114B06C30CAE2A3D836ABDD1BB426C1CC4D501B371929FBC5349E1D6A8A3E3AAAE0A0AC84D0FE2526D78FE98AA1D5C2A
                            Malicious:false
                            Preview:...........b.I?<.R.<f.8.d....1.i.8fB>.\..h.a.j.)..{FMvD.}...d.g..`...Hz...u.@.$y..B@.`(4.....RK4b.Q..zi....X..i..;......$.4.k...7..Y.I.#sQ6......X...O..p.l.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Adobe\Acrobat\Preflight Acrobat Continuous\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Adobe\Acrobat\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Adobe\CRLogs\crashlogs\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Adobe\CRLogs\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Adobe\Flash Player\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Adobe\Headlights\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Adobe\Linguistics\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Adobe\LogTransport2CC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Adobe\LogTransport2\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Adobe\RTTransfer\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Adobe\Sonar\SonarCC\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Adobe\Sonar\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Adobe\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Microsoft\OneNote\16.0\Preferences.dat

                            Download File
                            Process:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            File Type:data
                            Category:dropped
                            Size (bytes):4456
                            Entropy (8bit):0.43543000067684795
                            Encrypted:false
                            SSDEEP:6:zJuWtPnMtYyfhcD1RRXUn/cXmDXulxtIq+J+/KRujslll:zJLEYyfmJ/U/cXmDLFw/6/l
                            MD5:529386D3D4D3BE720DE87CB8BB710C15
                            SHA1:5056ADFCDA6BA7071C05BF7C955AB0B112DF30F8
                            SHA-256:46A8EFA9539DC12766A36A38788B8F9B9F5AA3DFF87749105E0452F26916BE37
                            SHA-512:3DE5DC36DDE25E869AE16C66AEE111CF929A9EF31960B945201A2E9D3F64279D60F2E83CBA3869B8D73DF9551A2033A2F750071BF54DDFD676D1906C118DC570
                            Malicious:false
                            Preview:.%c....L..=../\..z...<G...jj../................?.....I.......*...*...*...*...........................................................................................h...........................h................6e .w.N...x.y..........O..d.S=C.e*l..oO.............................. :.. :.. :.. :................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                            C:\Users\user\AppData\Roaming\Mozilla\Extensions\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20230927232528.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):267
                            Entropy (8bit):7.1352361936977715
                            Encrypted:false
                            SSDEEP:6:j4Xc71Ykq4bBuMScPo8aC6ztDsY80T/f/9FZtOoRg:b71jgMScwFCRYTT/N3tJRg
                            MD5:E52B3A186AF6D4F3FADBDE5D4CE3C5F8
                            SHA1:F068F4E976A7C390CDF3F45514E24D63BACFAEAB
                            SHA-256:D4A782C0C83CF0B19A91F0141EF94A11098FFA7BF2F93A6B1E02BBE5A22F71FE
                            SHA-512:BB8724C9150F168F15652E41F67617B602FB22CC890DB749FEC36EAFEF05BE79284E2D087BF6CAC733541511BC9D6D959B9269428A75DC8643EA3EBEF3A390A5
                            Malicious:false
                            Preview:..U]......kD.}...u.g..`G..H~...G.s.)@...L.h.G.3..!.R.~g.t. ....%...T.@..;...?.....V.z...p.h8...+....D.U(..Z).Ajs.<).K....E_.V{.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Crash Reports\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Pending Pings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\bookmarkbackups\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\events\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835635.a669692a-f9c9-42c0-a803-7b87d3ff5834.new-profile.jsonlz4.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):4096
                            Entropy (8bit):7.95899411557252
                            Encrypted:false
                            SSDEEP:96:5teKvLBZQYo7eUnAVm3CaosjyRm5K5xsrYixTQ7qBc:5J9ZQdSUAc3CGGRnxsrzg
                            MD5:097FC097B178E4E7C659873A24385F06
                            SHA1:1E67B1AA16CD62ED287AD1DC93EAB308C126DBD2
                            SHA-256:114047994C1C905C1DBA99395A48B050895F83493E28EDC03E2301BD9E7B6D0A
                            SHA-512:0012C3C10038013DDAC02CE6E28C0EC603508D67FD9F59F859E2A1ECC2E2F370797E2E4879C3B8C9654BEC771A13452A42A70573AE1D79AFD8D8A3EE92A97A9A
                            Malicious:true
                            Preview:....u......Z...Q.6.]...A..Yi.3...!>.n..x.6.....;.......1o..aQ....!..<E_.....f...b.o.#../.[.\.h.=u..\.5.X.vD.}z...|....I<[Q.V.~.........(:.]aDy.-...9D..S..c.....B,>.. .BR..O..#..s......<H..>.....$8...F.'l....FU.S}B.......,.G..x.Cy..T.=..0.'.c.+B.wc......#|.@w...f.f~cAH.n......|...ko[.)..5..m.6.........._8.0.....j.............91.)..54.....l;...Pd..g..7....o..M.+H.'.Y.I..}y\...k.q...7.`.x.v...$.y.L%..y.M.I.QN.....9?.~e....7...i....}D.:...O.2u..8}.xL..rZp.<.a6.z..i-...|..g..e.4[9F]D.@.J.....!&....|..4.&.fC..&w..q.'g.....`...[plV..P@Q@qA..T:......u..H..^....%....Xrh.J.%.....u......!...2.6.....v.Lr..e..0q...........AO.KPN.+....X2..H.7..u5.CO.3..i..k......_3...)Y......S.yn..t....Z...D..../..,+..(6....].pSjR......C.DC=.....*.mjT7.Y$.{..@.......`.1.0.g.8.".b.\..).5Q..,.9.d.....)....(~...#....L...O.0.`m>\..+!...8.........)...v@).....j .{.(.?.5w.T.....(.V7.W3....._...G.5.`...).c...xv.#.917Q.^Y....._....-......c.w..Q..}5v.R..0..E9..!.^Ik[..k..{9..9n=h(

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835643.9a3c31ca-35e4-421e-91e1-5f7b9bd27492.event.jsonlz4.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):4451
                            Entropy (8bit):7.964342886402067
                            Encrypted:false
                            SSDEEP:96:jZmA0/eEOZGIztKxU0ZUpUxIQW4qtKoodpDo3Ci2SZEFhnM:jZmA0aZGKfEpxIQWXiTi23XM
                            MD5:3EE147EF2B3E493901D9CE4649B85E5A
                            SHA1:232C0B83FDEA546632B6D07518067884088EBAF1
                            SHA-256:4E617FEA71ADB52392754B02F08BEDDCA38704CB9A974D896F982B4C41DA9F93
                            SHA-512:0EC311E2B51537772F9936ABC9EE90F7B56C48FCD8B7D8D30028F81DA9D624E5162D8962F2197AD54E83F4534C288AAE85F2B2C92B17FFA73DCD4681D27AA085
                            Malicious:true
                            Preview:.....u+..b1N...GM.R-...T.Y5....c..u...[~3)\...a...../......&.&.r`1.P.Q[.J....J..?..WN...f%y.o.......V..?..!4....1..,.........Q.^....../]...ym....~TslN.m...Q.'.E[L.....;hj.Y.{.i..N..9K".~...5..k(... .t.N..v..,.m?.?..4...H..|..S.".;l..w.D..S...b..p...e..B..5........U.M.........!.at...nN..sb%.W.Y.D.~^....8>.0.^.....*.q.....i.}gQv`j.Wt.#.,0.y.Y.Pv..M.=>.LZ...1....d......4[+.....6..*../t.s..].N.<b\..Y..-...].~]i-[...-t.\....peR6.ZYJ..@...m.H..#..-....ZGf..F..1.(.S.i.L../..A.y.Jo(rE^r.J...c.....lM.....!.4.<(..}6S.4:O....Lk.......t.F.&n.4.n...-...[.<.3uC....&.....C..=..m..Ke.!.r...Q...Y........Y..V..~tT*YY6...u.^.s{hj..a<....1.ecT..<W.d?.5E...gu.p...D..Q$.E....... Fc09.kx.p.......9.....h.....^Z...B....QJSWb.......@pz.%Z..[S...$I}..|.'..X..R..f... ..z{h.r...w.....0..o.....a..wU.dV.O...-.....Z.f.e..Z......V..<|*......Wh...U....j..#..w.a.2...f......4......Y..B^.....8..h'1...i.T...^.....B..{..a...8.d3.[..wu.....F.0...j...2b{...s.u..m....*...H

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835647.a83301c6-790b-49f3-adc7-55a855f7fe79.main.jsonlz4.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):18681
                            Entropy (8bit):7.991545593173205
                            Encrypted:true
                            SSDEEP:384:LXFRjMcJT4zMmOmOEJj0TMkdoHydJQqSJZa7Zf5pzOpAsgUD8goK41D:LVRjMcyzM62/ECpzOrgU4K4x
                            MD5:14ECB8106BDE33F2E9824838A8651F29
                            SHA1:235055394889EAAE3EAE0FE8701ADCC8E817DDA4
                            SHA-256:0092FF86D9373561B228FC1FFD43D3C830A947DDB96A92AD2A48102A8B9A3EBC
                            SHA-512:5C7122BDB92A7584F9BCB90F09F1699FA8CD3B9C51994E39FDB0410D6A87FFDFB64927DAA2528DE339368B5A648DEE35725B2E96BCD0B0785CA5D80E5463BAEC
                            Malicious:true
                            Preview:...Jz..5$..r=)......._}........<..'.d..b......Y..HA...'........l..v.@..!....6.)...B(l.....X.p.z:..}./X.......M&LE..<3bO.KA..xW....~.e..W....<...P./..Hd..Y..Z..jx..o..O{4..n..]="..g.}C..:....0,.?0..9..B....#(...a..L"...0...:..Nd9^.....I.y.j.D..v....../.n...e..b.....K..*.|..Au.^.z..u...6..f..tj.*g.....@.g..X>..+:....^...Q............#x#..}Z......<...fl..iL...v:.R.I>gWb.p.....5....|...q.....j...K$.. .......l...7..S..0....T0......].../U.....Q.n.I.2.=Gq..-2........pOy..w...J.c...B..d.=........A...o.................d.E.....C./.}....x1.N......%..'.0-a.(1..tY. .f..pbH.....h.?.l)cmK .^.%..2Te-....).8..(.....K......,{Y7..m?.....8............:+.O..w....f.kK"4.D./...h.....\*.......)..(.b*o....NI.S.x...".A.=~c....!:x&..(Ppt.H.12..=....N...e.....yg..$...=X......!.Y.d.`}8.....Y.^*.*.../.G........d....C.!.... ..Y,>*.5.[^.b..Ld]y...Z.L2..B..y....f:t.B.ru.5i..b2..#.5S...u...hJ+...v.wB.gD..mm..-.^.#qA9.H..............x.......j4..?V!1.....#.-t...I....B.r

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426835649.b06d08be-79e8-4bfe-b6aa-988ea3d35cbd.first-shutdown.jsonlz4.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):18711
                            Entropy (8bit):7.990957025930845
                            Encrypted:true
                            SSDEEP:384:WRmpbluvjHIQX38ZET2a+bXtFtV4EUkJqnVFWle24c:WMZALIQX38iyaW9FUaJqnSltp
                            MD5:AE62DDCFFF6261D744E285794FCC5B59
                            SHA1:DE0186630A581526D7446595F14C6E0501F665AB
                            SHA-256:2A0F4CFC714350C0C7719ABEA04F98A21295D8AB0D53B869C600811FCCDD6C66
                            SHA-512:AACFD61CE279DBC3C75C43EF8F0EB7AC64FA06723932AA48540FD10FDEFA5F931514A1E7489AD5A2C0A0F365D4B0A82C09781798313D35B298BB85F9963AF117
                            Malicious:true
                            Preview:.~.....I../.J.C.^j.e.....I....m...p...U..M.V$..."1...... ..T#]w../..../....(..f/.x.h......3....0...kx..n..}...|...j0...D!2..dn..k.O.zb.`2Z.<..>...,v........n.'5..'P.<..$d.&c<>.Q.<..O..Q.dR...^..."...-)..'.Z.......M....S.Jc..+.H...a.i.<...a..|G.....8.O.N..i..8&......)....?^.Z.'hw}\K3.p.Ed....e...g#$."..Sjh..!..B.Q.2......5..>C..LO.&&.Wl.=..R.)ZQ..:....w<..6.%.&..3W-L.N.K.N6.....n..^.....V.!.p.5..fP.&u.;)..[..!.....k.B......A....q<.^7_..@7..Z...Z.+......-..K.....g>..h9p...M.\@.j.G.xEe..s.'j.D..=.d.OR=.yhG9....i..\.(.^ I..Au2j.]....~...|..W'..;....}........ r...KH.k.I.......j..|...<..<h4...#.9....+.@..%>.SPi2..|O....^0wcS.:.D..t{D.\>o.g.`.,BJ%.u.-R....>.ds..o..5....){....U*5@.......:.[S.k6&o.C1.y....Z..44.Z.hV.k.`.N...Pt|:.....uJ6.g).bm.z..an.._..p.d....8.R..Ul.HW.j....@JAN/..8.....](.I....).W.....t.6.P.5..%...8".t>/m....9+..../jP<...!0.kr..I..K?...k..17...2...HR<.a2.....!.......4.Z.r.....'Y......q... Y.y........4.=....O..Yp...... .j..WUQf..~.-..*

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840708.3c7034d6-bc52-43bb-9a23-5da34ee205e0.health.jsonlz4.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):751
                            Entropy (8bit):7.739479900096192
                            Encrypted:false
                            SSDEEP:12:dn5jpB/SdtwBw9pTDoXqEsMVqz2X1RtUYFLHbbfiiqpCJawFCRYTT/N3tJRg:t5jX/+lpTc6VI3tV77jqpC2YTT9TRg
                            MD5:6EBD81DDFF280E2450908FDE3637F8AC
                            SHA1:B0B5799FA79C15D40AB7E7F6DD41839AFE6FB1E7
                            SHA-256:DB9E7653D9AF7232D1CCAADA1AA4E4136FCEFF65391C96B64437B14527C35E6D
                            SHA-512:1ACCBAD27C36AF6E799CA335B0A8E9C9C825799C726A0DA2F664C824ED407478AE73F7443459ABDF10CC906D379D9D89B02EAA6D039A130A5C334817ABAAE6B4
                            Malicious:true
                            Preview:@.U.)..A..>.."k..aKL^l..&t.....Z3....W.'l..pO5.v..B...{.8...v...oJ..*u~.<g.Q.....>..D8....#rb.i9...L...Tj.. .zx:.....I..S._.d...0.R...9....~..F..^.ax....\.7.,~~.....G;.mB.@".....%..AH.%..K...u.g!.f.....4.J...1.dS...@..B.MF.I....7...Dsi...^.p.^..^..u&M..G.|kG...g.7..f..a..WG...EC.{..8...p...i.\J.=..;....).W3o.Ge.&..}. .#.q...zm.RmO}5}).*|..(p... ...K....!.Z.....h.~......A&.WB....n.....A...n.8..s...Q.f.o.QJ/..#.1..D..,....01sv.D.}.....<.<.^#.i.....bkLf.T..o.........;.....QS5..o.,..!.Ai..4N.0.;]o...ZD_........`m..A.~..y.....?o!C...*.p&...E..I...o....(`.u...X.(.C.A.k..S........~..}`..p.......I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.01c0ecdb-8e59-4210-95f1-0fd0406e84ad.event.jsonlz4.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):4444
                            Entropy (8bit):7.961243876613492
                            Encrypted:false
                            SSDEEP:96:2D2WdAoKJLV5BlGxe78SrttwLabohR5WTdRFyKrZgNmJAj:2D2WdELLBlxTee8b5PKrZgN5
                            MD5:045344DB50D9715C1FDA1E438A9C8660
                            SHA1:59D8B44F2E4287C656CFB19A63A165F06E009B1E
                            SHA-256:4260337FDE63F822FBB2EE0A2CCBEF9677C7D0912CC2AAA45ED740C5D571DA3D
                            SHA-512:F8A9AA3D9DEF9650BC07BCC1B3CB9D036254867F5AC29550F15906A971009D0D5AB810A8FA8972EFA8BD87B87BC6B27048DFDDAF29886C49E4092E5674A9746E
                            Malicious:true
                            Preview:2...8.Q...z.:.tK.....D.#...Vt...N..0..%\m..@+..[.{..(........k....:.$..C...2.^.........BC..@%.....R.WS.Y...iH...\=..J...V.7...$..D.B...u.].z.F.'..K..^w.....Q.....\Y.lk..\..K.xV.P>...&.p..&.X..&....M@..*.G..q6...B..>W.Y3.n..i*\9QSZ...M..,..*..e...J..Z%.y......o.i..Kt9..x.~n.$.L......#.s....s'.x..>........2.....*../..+'.rv..?..6..yVD....5_.,9....Y.[!...."Y3.C'.......i`v.j.Z...2.y..._S.%.W..T.%|M.g.R|~^D~a.?^&....N....bd.6LX{.k.E,.4..gn.y..b....I..TU.7..f...O..d.y.T...?.o[....;.SI.jP....~l..8../...j...4.1...;....:A.u.I=..J.=BT.s..G..[...uv,q~.P..=.';..G.....&.q.Wy.Qt.x#R.../..}..w...W...H....<.6... .../........(.5..^v..z.....i.....@..Y...D.;.Lp.or.X.fN........:.%7j..<.!...&s.5...03%.. ..'=x.:...5.U>..... .}.D....5......g....L7..........i....1F......].}..+.5UR........E.<.......R.&6..qQ.......]R.... 6C.\U.(.q.`M..(.Z{.-....j.L...R'(.(..'...G..-o.... ....Gc7..m.~.E.;3.........2.5......s...`...-.L...+......d.=$..51.6.g..N@x.@..9g...<i.

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840727.86be03dd-6b03-42f5-89cd-4606f43d25ad.health.jsonlz4.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):748
                            Entropy (8bit):7.6830911273139995
                            Encrypted:false
                            SSDEEP:12:AiAECk+fzaNp5uWVabWHXQdy0osCaVZgIuvJzWrjZj30WcvCJihCc7VwFCRYTT/g:AiAEXpTVqWH30oGVeI6zWrjVbcvCJi3x
                            MD5:6AF6A875D8733D56E2CE661DFA6BDBE3
                            SHA1:96BDFFB36B88E91557E1D19A01ED42BAE7EA89D8
                            SHA-256:386366F41B8FD7337666CDE87FE118E57654F1E1C743C1EA0B2770D823FEFB66
                            SHA-512:E5D86829DCA2E6CD40DA7B296885BA1A9B1E8BFAD30D88785DDC097CB17E394F67878E7551156BCF3D679CE65C8E5AD2F1F2A3CAE218F8C736D3B79412FF3865
                            Malicious:true
                            Preview:d.C.S.f.e0....T.>.F...`...!K..../.iX;._......@.k..1.R."'D..e.M;..[.dP.h.<.T0.......n.....G..?.z.\8..^...!..Qk.L.A.....Hoq-....|.....1.B.O.. ....97.......5.`.F8...5:....8mL7..A..2Z.K.<......$4.0.r...../8fn..u.Jd....e..'.7.}.u...B..G.LMTm...[9..|..."\G./..k..%;..=.j.........SK..n`5.pj.:.%b.Enfq.Ei..q....Pt..`..j...(..B....w..8Q.....*%.G..Q.......?...Y..nk.e...|......m.\...N.=...u...)XS...g.......U..x........Mj]....'.Z..D.}.....<.<.^#.y.....Sjb{TJ.Gm.p&M...?=SG...j.M...G.K...hUM...55.u..\f.C.C$. .Tz...?.:m....~..y.....?.xJ..+..c.>8.y.E..3.iD...>.......(.!..q.!..K..`...%..}....R........I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\1696426840748.a8c1f564-c2e2-4ef8-a85f-52a56488f193.main.jsonlz4.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):15298
                            Entropy (8bit):7.986998305727998
                            Encrypted:false
                            SSDEEP:384:KiP3x2Azf7XXiVkxgNTswaTsij9Z2KRkIxbNpZATap7j:h2gXyDNwxTxZ2MxbTZpVj
                            MD5:C66803112152DC511CE5475BF657E455
                            SHA1:905C22A8C33C559B95961E7EBAB941212B50BBB5
                            SHA-256:9461E0DBD536D076C508F6D76E0427CBF7317741115A41C85B2347B8C147157F
                            SHA-512:90DDBFB61E389FC4A34ECD81EB648D8F4D3380745715F494CB9B108A2B3688EECE9CC9B11B367E080AF0B360E3A7F33C8F2F45570622774B454824C5007A1033
                            Malicious:true
                            Preview:...A..p.>...%.K..:".....u..&sJ.'......_N..U.....R.&.d...>)5.5....,..ceU..7..5..vC..;.hb:"_4e....g.........r{.^....y.h6.7.n..){h.7.....F.0......y+......g....9.......X..v.f..C...&..L.k.^.RF.Y*J...{.$..\..+.......]....x.D...n....3.S;5.w.G.@.5..]..,;.T.bD.,:.IW......d.o...-..c..c.S..l...."4p.7...4t....oa..i..2....m4...b...i%m./....ZQb...4..M.jQ...1/._..0."*!...g..+.&..M.#...C^#&..t...D. .!.l....UDx<.Y3A.3.vp...._*.......8FG?...&.`..'...B.%N...$..|=...H2......E....^`D..XD4$.......B.+(....of./....l......(L.......e.M..]...?e.='./...=%.|%}.^..:....O...>.....&t..'m...=..Q.X..s.).s....h.{..3......n=.']...7fD..m..#....m......p.....]N.A.M..;..F..o..4.,%.QuC..'.~...FT.?.h,.m...A.q>C.W9.EVk...../......S..R.....%..W..V7..=.W%v..W9.+c..{l0.....B.F.c.....@.Dya.Z.A.....n..e..4..;Q.............I#*fFz.+..6..C..%....;..D.U".SMO.$:-..R......F...T..|.5.c..v..q>.z.u..Y...y..=O....o_-.!....t.Lz....D.l.Y.....'.e...~.....v.D.v8.."..-.Q.@.)l..Z...

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\2023-10\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\archived\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\db\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\background-update.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):700
                            Entropy (8bit):7.703750177284206
                            Encrypted:false
                            SSDEEP:12:5OTMGQZvXozQasvMRRqqZABZTgiDfZJf+7Gxoj8w6cJEDwXpwFCRYTT/N3tJRg:5wMR4znseZs1j1oj88VYTT9TRg
                            MD5:F5CE40B59A4F3105D3B1D6C85DA1453E
                            SHA1:77EB28C8A2193CFA49D1A4A5D14A81C3F12116C7
                            SHA-256:9BCC47D276195CFFB55B37D4F3BB305FD22155FC583D2BE4DAAE9AC290A70FFC
                            SHA-512:1D77794CB4D0816E4680CE98C4D7AB49B4B204FDABD983EEE3AAE01FF1817E41805C5CC077A9CD298BEE432A38EBD16438F2873F160CC4E0E3F042E0AC281565
                            Malicious:true
                            Preview:....G(s.AE*.D...8e.......:&..N)Q..07.N..w...#iMr.:.4......p...}.%...H...t.ry....?..Z...U.}0...lf9g.d.M......f^GIx,F.t.w%..o`....P.............,4u._..#.4..\...9dc..3;f..n...W.3cIt.r..*.L...u................X..7...D...).0.H]O.%....0h..U.`......l.hh...SnX..]..{F......2.Z..=SQgT..o.?....U..#.^h....Bm,B.y..O........d6...u..J........O..q^Z..cad..o...i....Z..Rh...J&...f.i%..........[w8.u.y...Q.$I.9.....L.....1.._.57F.@PiM...hr.wg<.d2.@D.}...s.I.X..."......tj.....@.`(7.....Q.,g.t. .3N.@q[.H.+...<..%.L.........{......C.5.H..#@<..J.!..8s.v.HFs.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\events.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):755
                            Entropy (8bit):7.721031100315039
                            Encrypted:false
                            SSDEEP:12:Dtc0lbhSEzUMjeS5LiSbkY5CoLnXjJwJv4CjPbeon3hlLlBDoo5N6veDu7yVwFCV:BFlbhSEzUMjeS5bkICo7Xj2JA7MlxooR
                            MD5:4907056417FCAF3B17ECB9AABABB48F1
                            SHA1:BDF783839F1C359ABD243E256AAAD1AD60861D16
                            SHA-256:AE8427F02B6907D1ACA9E4E7762A805CB350DE81FA249C5FE0593573D8984223
                            SHA-512:40980D7B1A90978DC80C7D92AC4B90F6CA53B015DC407DD1895816E0A810BC71E867A6AE19D8B5D1803924C90AFCDBCC392AB1C3F890B5ED38E36D821A9481C9
                            Malicious:true
                            Preview:..3...Y.......m..:og.qXG....M..L.....Q6.U.t.x...c....a.c/).~.Lp.JT..#|.V.M...[k.J..(B.j..F._.%..-.....d.dU..>.DHtQ.V...s.(.].....Y./..|U...B.7...?..P)S^.v......L.L-#D...lr..........z....y.....x....+,.x.#.......1..T.............>.r..xV%S)M.0..*....Q.5.\K...D,....).W.\...M.....B....qs....n{Z^oD..(._."`..(flN. 6..<Mh.>.O..9.#B.JC..#..)N..NFg=Y.....Z-..o>...B!.e..u.....]...........{Oxk..@.B3}."...%..Y....2.{.$.,.2._!.W./.. m..u.....3<.".z(vd!R....(=...."...8.z..........z..r..+..5z~.$Yq.a.I....L.GD.|1!.>`....`..`.....w.@.$z..B.C..Gq..@\._.Js[....boem9..oU1/Z3..f2.X6..o..b....X..zul.Mmz`.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\events\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\43bb9a55-74a2-452e-8233-6899a7f737b0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1946
                            Entropy (8bit):7.895599560749029
                            Encrypted:false
                            SSDEEP:48:RSrO6CyPLVRWJC+Sz87Fizo8e63J3cYCYEI/jJBMPHTTk:srzFP8O60137EKJ+M
                            MD5:45E591F6EDF9BAE0E4E768EEF5D36FEF
                            SHA1:76B40C05DD99EBF7F1F4405464D12905A1941210
                            SHA-256:49FFED6ADA4AF8170EB1CCE24E3FEFD44F689550AB2371555E7BE4DB51D00E23
                            SHA-512:6915A21950EB5DFE5B78297422803EF49A6B674F454289ADB63F299848755CCC279B9555DF059DB12BCBCB9110EDFE8E82F80FFA276993C267870323250AF4AB
                            Malicious:true
                            Preview:.sr.r.BH...q...f..23..&.ml...lG_.xl.U..0+..x....."p.(.+....n..C..%..T..Q.....'0l*'.......&Z....3G.....5...o..$>].........1F ...P.......Dc . .<..6....A...a..c1..9..u....;GV...t.?I.X...w+.<.........8..p..<O..q....G.7.AO..{.#......Sa.H..=.....nx-! u....gY.=..%..@.H.X"..#R>.>B1..P'.T..{...-.G.$...G...9^..<..j'.........'.C.5..BJ...I'...90Q..3z..u......(..k..mp..w..$..p..1.....dgK.\w......e.)...2.`c.)7...y....{-.;$...1.F_....b.?h0.e....la.....d...-Wq'|.......-D.M.U=..I..9....=.cx..>.....+..6..I..._..C......4..E.....r..@a=.!...a..Z. ..OA.wq.nK....W_.Ke....r..c.P....."K...Sn./.c...SI..v....V#9...MV%F./.t.+.n..E1..E...Zp..J.$...Z.h...3.Um6tk...J...5.:......D.....k.U..,.[D..C.!C.Z................BL.........F:..H.:.J.....<5..l%n.O..=..\pF.E.y..|......e(/H.vE..]...~..*s.....**.v...L....Nk.\K/..h.$.).4.AJ...?...!....Z.....[......=.. [{.>....j.}..b.............i...C...3.P..s..K.w~T=.'zp..S..Q..2g.*..33..#.#..,...`.?.oLT!..\DPn_..Q ..;.(..

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\7755ad51-2370-4623-9d21-15c89f2143db.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1578
                            Entropy (8bit):7.884010621487772
                            Encrypted:false
                            SSDEEP:48:wJafJw6eOnCtw3loE4z9d0U43ITsbVFbATk:i6eOnMw3lzWsU43IOVxv
                            MD5:7C20C34D2AC78A7219FBC49431CC36F6
                            SHA1:FDC1AA55941AB664CF0F401EC470C7B89972B07E
                            SHA-256:762E649B4ACD804CECA5178B5E49E13BDA4C552FE77E91E0796CA4A250BDBF5E
                            SHA-512:8E155E67652A1723F04D9E407160AA3A2E691F02F35A80DD5697935393FDE94358EE0D01DACC13A01E0641A7E6D056B1B0F75BC875A7A755B005D14E3702A324
                            Malicious:true
                            Preview:&...G[.?.Y.c....(.b.UG.f...*...}.i.....]....a."...f!...p..71q|N.u..u..........XI.;Nv.N....XL.....&..+.....Ve..TD...N....)..X.....V.#h....../... .V.wfm.. l.q.Qf.A&p.@..k_t.v_..T......s.F..R%..e..w.l. .r.'.8f.....>....7{.Sn.J.....~.<Y...p.........a].G.b..{M...den.!0Wi....S..3..<..`.8......ReQ....y..~w...m...2..{..{.!.k&........\..2..2.ui..O4...z..F.....@z}V.....1..Huoy(...y%....).$ s<.K....F.....+...D...=.$H'!&...la....y..........KS;.4.c..W..j.....+G.\..'......F~q~z....9.@......`..........h4..M..,.F7<......S....g.V.J.. .ix..Bj.....W....G......M%..+.j...)s`...j..B;........@.......HZ.&..9..v. ..=.%&~..}..F..?6'..4..K..../.Y3s....%f9k,hpkiS..*B^..e>..........I..6..r..SD.P.E.......Q.'..v.>.iK.|....v.}.c..,....D.......\....*.....U..`....|.F=Te.LJ..5.l..-..&..J.#.aG..v......n.~.q...!.e]..o{_.Q.].>WoDe.......xGU..'...............<.'....h....nY.E..y........'uR..)-..........*..^.U..#y.MnxS.kB.....*WB.pi....\..aV.7S.P...^t..;..tr.....X7

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\ae04dde8-69a1-49f8-95f1-d533ed587ff6.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1581
                            Entropy (8bit):7.8921949576664305
                            Encrypted:false
                            SSDEEP:24:qN592PPjG5HhrQpPtO+1Ni007zRzp1fTWYDeLK2zzaIyEC0VDwWmSVxKntWUYTTI:cn2y5HhrgFO+1MR7NyYyXBPjsWxxKGTk
                            MD5:AAA01FB0125D5118887219516783EBEA
                            SHA1:D53897082E15C8864D6E3742A54407C79026CC38
                            SHA-256:5AB7B53262384B9B45E45F1EBC6DCC02F74672CCFDD618CD6A9D35CBEC8CE9CF
                            SHA-512:61ADDF27758C3876DE7765C415502E37F9476A7ACB0B71267A279063EC3AACAFCB5A7AFACDFA031C50426E5C61975643F846D374977C97717EB067F9B5B9377C
                            Malicious:true
                            Preview:OZ...4.v..s........7?~.f.#......"u..x"o.+.8...#.o.........*..K....C..'....J.{N..9.9.K....p....n........3\..'n..v..r+.O.\.*..k..xM........b\......- ...D]:.6'.e6......Q....C.W>.....\. cb{.i.}.....n.ez..._...#2..I....VkH.p...7#{..4#..O..f....YJ,....B.9g....A<...;?..R...!d...O..+.<.....d....2".].6......~...<.t0..I-.'.I7.M!.&N.............>..k..x$......:...$\.qy...{.+.B.XU[}..R..{..G`.^`..6 .....5.$O.....d....4.(.#n.0..<...a..|....9H..JUwq.F...N.~..WA..L._.Dx?B.|K....ZB..K@y.el/...RT.n3.^.w.MR...E.lU.>Akp?1........$~a.s...d...e.....hZ_.4_..B=Q.....{..*..$.I..4.q.{yA.r.*.....!pd..N......G.`..t...Zo..8..D...w6...eF3D....-{..>^..%..K.I...=a.z....K..C_.#..o&....p....*3..P.....|07X.].(5...BB..W.......G.L...*<gn..7"x.Y.w...]._M{1D....$Z....;..i3.A....6.^...j..W.8...P.]0.r........f.a.t.x.....'%..\...B...5...bS..........Y.F.......$Px..|..h..?.......ZN0............ ....0..[..N...l...........S+...:..4..F..op.> .&.2.f...18...eKThE(c.)5.j.C4.....,...a.

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\b8f053a5-de16-4a2c-8120-1ab4aadd63e8.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):3839
                            Entropy (8bit):7.953718532382209
                            Encrypted:false
                            SSDEEP:96:QFJnEtBz/Wr1yJooTmiZLlaPBHn9kBRtwVKUNZ32ElX:+EtBz/eoTh07kBRtEKUXB
                            MD5:7FCB4C91E1DB2A7CAAE5ED6F81376834
                            SHA1:6531233EC2ECE768DCDB0E2BDAFC7D4EA7EE4F08
                            SHA-256:3E57FC56FEB37C454097727059B834A738737FEDFF0637AF7C0E9F6822BC7903
                            SHA-512:BE39072BA42CDA2130A79B9C34E400A0F5D0D662871EA9921111D4865354945C81CF01F692F8773E8A751BEACDE469DA6FD0ADA4AE3ED5EA97E80FCAF36A4090
                            Malicious:true
                            Preview:.\...T.5,......H.4ZMRp....."..R..O.p..i..-.B...9C..;.P...A........U0.Y."y.kS^...;t..-H&.&..}.... .@......#.45^.{H{........H8....f........W.=.L.9R"+b9q.}[.$N.2.~5...+.u.1...p.$...F..&...To.....[....E..@......`.2.P...^..9r...f...#...2.{A.j..#...e.k..27.......W.8Q F.a(..C..P.7.E.w..)H..v.pZ...`...W;Q..a0L..T.^........d...i>^...W..?eF..5...%..d..(_.Rf...o......!.....>|..yfp.........dX..............z....vX..v..0.I...H.K.&..."..-i.u..&N..C....^.?..]...$.....`.....'.{[G.K....t.S.......a..IjT...ZMj........t.."..2#...&.... P['..pY......l..i..Y...\...H.........+t....H|.},.K....q.!.>.....`8....H...l1.}.[;.x%~T.e. M...D\.Fzzu.e0.......p2...w....%..1..N..6...+MC.u.=..P...G7s.S...".E.@....s.GM.B..2I.....#...S....+^P.=*...h]...K...A.O..j.I.lV..Jq.r.....Hz.^..0...^..D.w..u.,.\.....t.....R.V6....-..,y..{....;.........LR.Q.I..|y.....3*.G.....|...+Qt...TO.f..>@.... ..<.....Y....S/...G.m.=...@(yF#..q..... 7.o....d^..=..N.KG..hPR...U2...Z..F,.Vg...

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\pending_pings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\glean\tmp\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\session-state.json.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):407
                            Entropy (8bit):7.456850128317328
                            Encrypted:false
                            SSDEEP:12:a/Qoc6GQeKakGJLGBwpEENF1eTwFCRYTT/N3tJRg:bcMK3kGmp3N3eYTT9TRg
                            MD5:2F83989C36975ACB921BB88A20298CFC
                            SHA1:CC621E32142018B0390960C878B827809BDEE35A
                            SHA-256:B09C09FA289A89C02D74607EF00298FA32DA212E432BA34D4A2195B4B1473897
                            SHA-512:F543E9582EB5424DE5DD413A48AAA31D197F5B71DC7A8397E2C086172064106DA931C00D2EA03710E1B19ACACC54CE25C971084D6532D4D85DC40098DED138C3
                            Malicious:true
                            Preview:s7.....1.l.vR..4;..S..#._.Xj...)...t..r.\v..@.....%...m.pW..}.4.u..XB..2....%A.iJ....r...^.51X.h....L./.u....i).9..5[.,.jK.....c..n.'...(H=Y*I.eE.I....b..QD.|~..K,a....{Z .!........&y..B@.2(7.....R.,g......5=...{...S^....Z.:..~.zi?..T....#{..7"...M.1..o.2.b...p.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\datareporting\state.json.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):288
                            Entropy (8bit):7.259795487373131
                            Encrypted:false
                            SSDEEP:6:120bjn/FYofvpfwn7krF/lML1fhPo8aC6ztDsY80T/f/9FZtOoRg:17bLFYIvpIn8F/lMZfhwFCRYTT/N3tJ2
                            MD5:7642FAF76F34141A999E5640F1C056F8
                            SHA1:C72950275C4FF6F0C70D8C5E285A8BEF6E09E39B
                            SHA-256:6766AA31B320440B90B060B9B91EF0D98FB4CC7D76433BFF549FFCD3AAB49EA2
                            SHA-512:33E359E3B4B0CDF84CE9BA05EB053E3A710006A1A3F9B99AAC1D3B763F6420B43B9F94E636E64538CBC353F0BE9C58AB02BB7DBAF99374CD209D44E123EC6079
                            Malicious:true
                            Preview:...?...9..M..l..,..n....A....e<...#.....z..t.'QD.}...G. ......&....w...$y..A@.`+7......#Wr..|z..<+.uNu..4..D9Iy.5..4.G..`...e..7.r).p=$-m.08.N.g.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\minidumps\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\3c7034d6-bc52-43bb-9a23-5da34ee205e0.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):762
                            Entropy (8bit):7.7196184071783644
                            Encrypted:false
                            SSDEEP:12:C4bWlDjj402p/rj1AmR8eyuN6j6YgwoyUzJqfuXhBLu8pdim9VzQTOkAEmuNwFCV:gD4RFrj1AmotgtUfuXXlN9VUTOkXXhYQ
                            MD5:A87E2DB2B705C4DB930C2B64F8FDE8F9
                            SHA1:57FE05A75667AD63AC46E8CCF1DB0F3545309B37
                            SHA-256:1EE97C3ADC7DC8FD29E12BE147795729A57CAEBB0CC5A5BBE5C178B4172E2F42
                            SHA-512:025BB6F63219700B776AFFDBC5CD22AFA34E67B6892F4000AAF3270C0C6AD6FF399E7B92134BE2B9AA8441363F977501AE674BF3EE5823DC46C19386C81D8B28
                            Malicious:true
                            Preview:v..fkg?i.94B!...-\....4..7O..#K...s.Sj..s.#39..lf..R.k.R.na..Oyt......_.<..d.G..j...E...MK.]\|..QAY..3Q.....z..`...5.J...'3..h..O..t..W.....".|..X'..{.1H...R.n..c.9_..|.M._ur.......9 .T...4YO....@.3..e..1...#{..+.U.....+.bW..<s..(G....=....v.i...v.bi...zm|.........(.vH.C..Q..b....N...g7nB.c..[...C.*.....r..x...M...G.zw..|.E.M........0../L:~..j....5.\.:.~QV.....;P$R...$Kx.q.[-..$F9l(....... .....(f.&2...N.%Hf.j.....\l7.7.$.......R..T..@M.T..HF...DK...N|.&.Q.....M.y.D.}.......X2.y$>.....-9...{w.E.".4..&.7....A.,@...&...)4\...&.".W./......~.+trT. ..S....t.;7.8.?f...O-.PC..y.#>.!.r....Y.._.J......I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\a83301c6-790b-49f3-adc7-55a855f7fe79.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):74081
                            Entropy (8bit):7.997422124774174
                            Encrypted:true
                            SSDEEP:1536:ZD/SdT62TDO3t6GmWTFrFiPq1JXJavN/rgk6E0SVx6Di:R/C6WDX6tFiPq1JsvN/UMrVx5
                            MD5:05EE9E89023332DB19F304759E2763F2
                            SHA1:305A6A6C944AACFEB9F8BEE91604ECC706AB68BD
                            SHA-256:E7E371ABB0CEC71B711DAE5E77F0F8466A6D4D5E335D0E4297C2FC96DEA6DBE9
                            SHA-512:CA044102A5B277AE4159DEBBCF5C290C73DE97BA868C6CDABD5129694A49CAF78BD7C42CCBD4692EC7A401316E449F743860DE242A1AFC40926DA4988131AA6B
                            Malicious:true
                            Preview:.H..V..L.o.....%F...W.c.?...S.1....Ew...Y...C...V.Z..^\.b..S..c.q(p..i._...^e..`.m.w..':wC.....Cy.......D......(..+.`.f*......P....\....(+Q.C.t...o?{.....I...S.EX=....10B\..1...l..*.v;.,vM...x...\.G0I\3...X...-.....l......(....W.......'.Y....T.2.....&..3......XI&..@D...N..V.M..v...).}...N..f...^..tT...m......'.......a=R1`...(.n..yCe..."....6.lb...#P."]]@.*...|..XhZ3Q.}0`.a.D*..m.<$>..W.Xz..D........yS.i.._....npa,T1.q..n.6~.fxv:....:^.V.....$..T.#...I.0.3gW0.%.,.|"a....c....x....:...K....(.u.LMX.<Pd...+.&..+0UP.:}.......*........k..........a.`...=.P..........Y.?.a.&.A.7..H..,=f.F.7"....|..U...V#<L..]..%.Rd........1.XQ....p]#%e&[..A......Q..R..E.)%..M.....&.H....t..K...(..n....\V..'.f.q.......5..Hv.vaf..U.1...r4.".....p{2..;Qk-.&......@...2.....kb....OupMg\...7..@].+........z..mkW.|....K.s.2.8....o.73.I.j.G.3.I*..q.]hbB..>)k.2.....8O.Q.....n...x.y....O.....]..4=....;i._<..e..9......Q}.2.,..b3],..I}7M.V..4.|.R7u......<..

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\saved-telemetry-pings\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\security_state\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\previous.jsonlz4.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):4585
                            Entropy (8bit):7.961186607666243
                            Encrypted:false
                            SSDEEP:96:JlucvVOspJOHm+XK3EE1y3cyusNrBpZNSZO8fXUwmU898NxTxsY2u:Jlucbn+aUEinusXpZ0g8fX1m79opP
                            MD5:25EDD6C49702C34B589130A217DEB010
                            SHA1:1138C499B8B3113BE6541DDA5711E8771765FAF1
                            SHA-256:042649F87D28262318B3D02CE0B19B846AAA132C37E252E6BCFC9D56B56C8039
                            SHA-512:5240CE8AA73A21A6AA51DC093F8617A4D0C0158FF61162CD2F2ED269D8E7D1C1D8E5A4BB1FC8C27EAE639CBCC533958B9F1E8396D8DBB77193812C0DA9A524BB
                            Malicious:true
                            Preview:eC.).Vq....rc..5.jo....N.......A.@h=.y!.!.... ..i..#..r...zh...g#.h..6u]2.....Y.H..u....,9.?......)].&k.=5OL..A=.4u.a......G...uc..>...)gM&d.....T..3..{8p..`.@~........R....\L}.8..h.......\m...u.`.>gM.[..G..KHT.v......2+.@ .M..o\17..a.W..k>.95}~3n...+. .^..L...................vO......Gw.j.e=.....].Y>.x..gj<&.....c,..EA.%..2.`Z4.@.GAZ...j{?.3.7. ...[N......d.,.y.f0.\*7..xz.L..yol....$..S..S...MJ.a.Hf.<...q.........e'.:3..+......>.b.t.i.........._`b.1..U..X_m...O.V...6.i../;...RS...7..,.....o_.".n....bQn.Zx.....gN.7..T.D...]Q|.b....k.Hs..a.?..t...h.t...I.gw".y..*......3...i..k...{..Y..W.....(B.['%..NX.*.. 2.....Sf...>.l.<..:..[..9....z.$...[.6?h|7.>5.t...)$.H..U....`....pvB....;.{.......AG.k.V/..5.......W... [..AZ..KI...J....*`s..GQ.....z^..P.b......Y...? ..t.)$}.Hvb..#.3..8.io?.......V.+WI......~.....m...].9...|p......`.....Q.9.C...\..G.ER.}S.k/2...[....m.Y..e.".%.s.Q0|Er|.J..+D,;.O\q..~|e..._h...bZ....wn<.M0....R.....1.T9@n5.W.|.$...Y.J.

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):4605
                            Entropy (8bit):7.958189039108997
                            Encrypted:false
                            SSDEEP:96:SbIxW7TD++BoSITHNX7HZJIJHJiOF6L+6GEbaSWlbfQA0UeU+PXLQI:SMs7TD3iSITHNLHZJI5JzF6K8uRbfQAE
                            MD5:C829193CF43C1E938FD22B75C1AAB8A0
                            SHA1:3A23A4CEFB0FCC2E7A0E35C772588E7589507FCD
                            SHA-256:15E21F8C0AB00C9ADA3FD82E13C13D9BB26F52CBECEC756CBB15903688A5009D
                            SHA-512:78D678B7EA5565693AC98C924A42A0D06E6F8F1AE889D05446A25CF7734787DD883870C387F485A39302C175008C73228FE31A1567A0EC21980571ADD503E99B
                            Malicious:true
                            Preview:.Hs...=..Y......|...M.a.[!..q..u.(.O................'..9.".d.........5.D.S..>x.oD.|.y.@.<......J.F.(a.#w.^..;...&V.. ...............I...I.....^.^...Q.ZI...{..p..a..s7........:..+|...?e.K..xh..K.(d.+..#;.u..-...0.04./....w.....=.g.e..o$a.r(...o5...#...g.`s...'Lg.=.........K..g..m..n{...U..w.tA.h/.|.....`.......8r.....\K5d.`X.9..yc.T.....Y......F6..E...{X.Z.k,jy.4lF....k....J..<TD@.paD..Q.?..h...L.bEC._.Si.......s[y.{.|v..1...\.^.i...$..Qt.QcU.+ .{.r.IN..!N....5.....C...c....1;./Q..()4h[,<..C.th.;.w.K...%k..h.T.....k..k.F.~....].2.D5.y..[..>.A9xj...U.).g..u...nP.<4........g.E..M..+$......r.^).hy........y=..).V~0..'Y!..Z..%....0.*,..d...k....M.f.1.<..QC.%=...`...L>!..t.$.-n.(.....YP.;{..z..i..:bW.o.n(M.o..@+..GTd..%...P..(..HV...c...........KC...);g>y.&o...+.i.8.t.0x.m.|..i...L^ ..T]....p.H.e6..\...vrF-.......*f`$:....x.uPO/+.0..z.n!nJ.......L.Q..X.Cg....(G50.B..}.ny..G.+.-e....1Lvt.A...U......$.M...9k)@>B.....".i.d............bZ.

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):33050
                            Entropy (8bit):7.994028215410418
                            Encrypted:true
                            SSDEEP:768:AHfdZH9MWTK1j+TBaxbpt/Adtq4h5GP8va9VZTvntH:clZHNIossPGkvUVZvntH
                            MD5:08BD54D74EF32F482B43CBF2FB432568
                            SHA1:03BB392EB022A1E01F22127747877925BFFCA8E4
                            SHA-256:95A4D6803E26C7688403D58747ACB806BE0331F5B25417A2EF106B67687A9CCA
                            SHA-512:75A8A191822CF4208A2C3364767B3D6EBAD5792195859862A2D59D08BF8AA03F9378D3276A1C7DD423F48B706A1F15B5CCDC689BAF050D08081D353014D52FFD
                            Malicious:true
                            Preview:6&7...\(S.s..B%....GrhE.....b..(c...o:y.........#.[.L.`q.{....2..U.QX..H.<.....h...g.......7....S.G..sf.).......,....O..M...6.<....i...N.D|...\..cf.L......7QCM.jZ.6(.\.Y2NGy@.[. ...?..@.{.f.;n...d.....`.<(......E...si......:...M.K.@...B.b(j..iv5....,.<.#R...Y......=#\\.8......g.(f...i#..E.[..#9.|.86....+.,@.m.(.&$..0lS..ee.2U8..<...I....P.*.iB@.qy..l#..v-..0.H.P).41........u...a..#.5.r..Y6h....... .r.+g.8o.........E..7.^..o>..(..z..7m.x...t..Gw....y.X8...".0:.._.....*..r'oB....y>.{3....9t:..^n..KM.m.....5."..K..>.8FM. .f.......f".......X.NXhA.';.O.j...g...................O(ig..B4X.m`pw.hh.....Q..r..>..[...J$w..K.@.1[Vk).h.]....G.@.-....C..."/.>D#..[.%.....Z.V.......o..Eiq.=...^-Ng.s.]..n..i../.......:BN{@@)/.$.6..i.-.:..e.........Q\.}...n...qa.J3.....xY.we........)+G...c4fuVQPk.r.:.@..DbR.-.`.br..''..U:.+...>.SYA..[lM...+...w.&.r....y;..p.$..d.+j../d.o/h'..@.1k@.7.../...[.........F .........uB..,..t.3......u+.....S.X...,:.|....p~..7 ,

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):33042
                            Entropy (8bit):7.994308355070556
                            Encrypted:true
                            SSDEEP:768:O1k8SgYAKamp/hvO1y0zRfpJIlHMW5d0O0BV1UpLrzJjBK8:lgTNmBhb0zLq69ONxzu8
                            MD5:02EFAA4187C5547F78C3D93EE90E2D08
                            SHA1:9A9734CD616EA9C51A50E9286FBFC0F71606EE47
                            SHA-256:CD32F8C6BFACA4BD9A92D513B9B5ED4F3E6AB7FD296F6425792FB6A62B77B0D9
                            SHA-512:C705D1CAACF212D0274E10DC31F5779F6857FF86C79DAC8013E84522ED5BCF18C55F99CB8A66481D847555FE9E791D8D006EB71DE6A0748A5A6C74690631BD4D
                            Malicious:true
                            Preview:.u'7v..V.N2.]..8.....2N......A0|m.].v..........c4G..!.G.....o.v....tn.l...\..0.d...o..0BXT....be^.....W...[X....K.......w{....I..+.{.c,...iYo.S2..EB.h..aNk.4''.....[..o...xT..Z...2....e.f...;=d.@....*..j.=....%>..;..2.?.B..3z..A....{..._.....Z.(..I....,.......Tr_0}...[.yP2P.OHD.....zP...9..S......A5...w-.z...`sJ......bNA..D=7z..;z..l...y..XR1./K.0..y.!.Lv...3..?...0$.-'..(y....e\.._..Yq..EP.vV...i...a......H>.~.?.+..^<.:.@y{.\..q.*..jM....}9.........Qo..$Q,c*....Vb.j...O{...'6.N..P....P.....WC...K...-.1.....8Q...$..Bx...o.9.....N....Z.[.. ...\..c'...14..>..>.....CG.......Z.;...l...+iR.y.'.>.....2Z.....-...._.f....w.......9t.. .`...4..K.....)..,.;......x......]........N.4.).P.A.}GE.f..E....@.r.w.4....G..\o...2J...../....*.`.^e*7.v...|..J.n~.....W.....j.S.!.K.( }...f..j.}...&.....=W.T................2..2.Z....wB.h....K5 A.E R.....c....;..?XS......<"..y...=?k..............#.H*.\6..{e0@.....\....D..|.&..L.f..N/..Fn.G$)E...*....

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):49421
                            Entropy (8bit):7.995578903849006
                            Encrypted:true
                            SSDEEP:768:yKmNrCulfgptcS0TJRkch19BJ+hkRVLshN8s/x0z3yBpLOo6fKMiCwcJvTZmOJF3:yRN+UijSoS1PbRh2XOy/Oo8KzaTZJFM6
                            MD5:38FD8D2380528AB7BF43247075695A0E
                            SHA1:0A95F9FBD32850A99B4520FA604879BC5812D40D
                            SHA-256:EA1303862DDFD0593282C76DD26CD2F79B7114D2BCE5F5CECAFFE37801432629
                            SHA-512:7FB0688A46357EF1C3F572F2630EC1C8D3DEE886FD3F1AA7A866FA86614074D6E35941993DDB02BEB18D06ECB8F01B90C7C467FBA51B08702E90764CE64448F1
                            Malicious:true
                            Preview:..w....cX>.$.....g...0,..G`g.~:.4&.X.l.8|[..3........}"7..`T.......$}.!.4L......wTwA../.....c.fF.]J....&J%.d...0..V..4..16.......(x.}Y-..6.lvC.eb$....a.j..%).....o.*w....]......K.4.....V....c..f..LD...T...U.k.T`>.0.....L }...c.j.........^.:E...|..8h.....>}.4.lA.]U3r...AXQ.v...H.'n.n>.S.9...f*..av%I..4Za.....ey....|g.m|$8....q...M.FW~HO.Q.......n.D~...1...#..c.?.....h.>.o[.27....s.n.o...g.t..c...J=...hd..$.z.63.)Y.(..S......9..j.'I...L..1C."d.Y.Z}.._S.z......G/C...K....$9.._.'.......F..4_j~\ .....%b.CIL.B...&.....d..n\)r}L...S..a....MP?..."..M...o@%.y..;.X4u.N....J...1.n"XH.B9....tv...v.a.;...X.p-.b..~..'{ff........>B.i.....W.%.R..3=p.zb..x..(.#...c..'$.(FH...O..z.....\i.. .....l@.cCB?.mQ.s...m_z.$........4./.m....O..J.A..o.$...1....^L.d...7l.....?.............W$|...l.W@....10.~.|x.....#..bs.D.<twF..qy...M.......U.....!.....H.P....'..(...J.{.i.8.u..fr$..,Ig..p........-.y.UkG<......bn.....`.K..T.Q.u...[C..|6.+.2....S.T..P`p..D...ZD...?...

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:OpenPGP Secret Key
                            Category:dropped
                            Size (bytes):33046
                            Entropy (8bit):7.994214590353947
                            Encrypted:true
                            SSDEEP:768:M2Z27YzHyHZYUpqJqHGlNjyhCX+9xDoK6FO9F8KMvpJQ7jM:MA27aSHZYKm1jy4O9OtO9/UDEjM
                            MD5:08931011AEA9DA8395AA2E74C3DC8042
                            SHA1:73EB1459E12652DCBB1EB99F49AAD93A3CF294DC
                            SHA-256:C991824E2CF57C1B1717893270185AD653ED1D547E3E47E8BEBE3A3FA375EE3C
                            SHA-512:2CA4CB690AC7F2C5B5802D6FDBF6C234F58DD1E0EFAE6323FC93195F204DBC9F138B0131974DFD347D8B008FF79A7AFA22CD8A5A91A2C08E2F9C42319C5D0CEE
                            Malicious:true
                            Preview:....xM*...f........I. ..i.e.P.#..-....?..e..4$./...Z..m.....$._m..7.....S,...6...z.\.r.kX0...f...]..Sk..j.?o}.~.........z....-e............?.J..R...u.....a....6.c..0{M<.5..i.Bg..o..hQ.....`..z5..;#'.. ..(.,..C....p7....5.......TB.:-w...t.r\g..:......9.C.$.r.a.........c....).7..x..V..+..N....>.6O..... $._...HfE.R...U&~..C......g_.g...........Q..w.('....*...Y.we.p.\....aH..MF......Vl+`..H....+.su..fK.`...nS.. ,..-c..ax3.J....).Ej...>.Y..@d..W.........+..Rb".`(..R.0../.{....i......|..7c9m>gH3.*.k......c.U./`..}..k.zh9..X.N..5...u.d........]... :..F.BfuS`..,}r..?..M..bFm..j........l.tf=[).P.D./..jr..j$@...'..^.m.C.t.b.....K.u~..aX.......8..'.n3....t2...|....3%8....e.q..q.b...i......[.?.P....R7p.Y.....P..y%...h"*.:.<.&/....j...._/.YL.Q..=...K.a...a]%...Bo..}.^.R...x......,`.I.^.......QM.Cy<.vd9.^....a.}..r...|.9.o......(.|....z'......Q.hq.XB.O.f.Ui..=..`k3.....l..j.._.(.....Y!t...i....8.."6...o......M:%...c...w-.....}V..-..........r.Eb.Z..

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):49426
                            Entropy (8bit):7.996186591330578
                            Encrypted:true
                            SSDEEP:768:N1svrcp21WNUcQ/R831M8ljMnwHHBvfE52Ul9EqLf8wDRpVG4C71c7wcppVH+uVJ:IAiOSnwHHtE9l9rfvnC7Wt57U5sDx
                            MD5:9E5905B54F6A04AEAFF19EE582F4609D
                            SHA1:AE625DD0D53D259C1FAD3646FE8C09A0B7AE762B
                            SHA-256:96AFDC947641B7E7E52E53B8A2657DB02F503D13CD47EAC531AFC1F3280A32AD
                            SHA-512:3678E00D93D9C40C8E43D7BC8A3771380B95BBD55FA4EE2BEA9097A53CA1A24524D304204DDFBDFA91E6B402FF054027F9C7FAE3C1A030AD9C0B39035F465BEF
                            Malicious:true
                            Preview:xQ..9..{.N.4l...q.ey..@.[z.....]...@V*.K.....|.W.5fe..H..+.).z..b..;.....w.x.v.!\......[P..v.w8.+0......E..K..... vu-R....BSp.Z...?..1.H._R..t....4.e...|t.y..Z.,.|/U........6......Ws....1.]6c.Nz]x...<......s..*q.R..^.+k..{....@..g....6.!..L.....5Q.b...B....q.q....4.]b...../....j.....|tD.;..*..AN..(l.J,....k.L....B.i..o...y.=....{.....g......#Z..xX...Q..K.R.e\|.a...%".'.u..4....:..._..fP.f..@.*....=....@G..>?..r..?7DI...#..........;-./....yT..vz.ql.......H=..;.*.h..I....6..6|H-V...`g5..N.sfHO.O..z...r.v...O...=..*P<+.....r.k...W?g".(v..O.S.E.d73...\.VC.......w.#.......O.{.:..........\(.....@\......Q. .`d..^>...20?..q..]BK..w.L....f}.w@.u......A....f...l..'lP..%.b..7<..F....Xr.,......k..5..)..b.l.F.E..F..:y!.a..U.....3:L.2..w:&D$.....h.<&.-^..b..J...`2...p..[<h....+.$..6... ..<...E...|. .V.I..x.d......(..#Y.Q..Q.? ...C........ N.FuN.#o..LR....[...s.{........z..~..=._......*....;.....$.D..".u7Fu.Q[..Q...f.....0..XL......&K.mA..+...

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:OpenPGP Public Key
                            Category:dropped
                            Size (bytes):33033
                            Entropy (8bit):7.993916769436431
                            Encrypted:true
                            SSDEEP:768:ddvhd8HETMCE7fx8fNVTN52xDAg5yR/EDNo129IIc3n+Edr:jvhjTMX7foTv0Ag5k/6XAn+EF
                            MD5:6E79FCECC77A4ED79DE27E1E28849B39
                            SHA1:CEF82CE5B990DDCFABD106E06B4C9BC908040577
                            SHA-256:92880F4A2AD73466969793410939A9D858E51434079BFB8C99BACB8B56133360
                            SHA-512:DA75C6B41FEC29633B5324BD1383A0B2FC52CF1EE01272BC39C25DD8F8245BE11F1D9773782176AED3D3A52775D2A82A3488C50CE913586A38685C5CC749C284
                            Malicious:true
                            Preview:.V.w..h.{.a...z]..S..H[....".d.D.:L.A..S}.r....#..{.3E..... RaY...bZ....su...`....C..@.@>..PY.ZR.C^.4Jx......)j.T....Z...o!....>.-..E......wh...JPL"....9.fE."...)..r}.L...z.UL.`'.Q..S....f{.=t..."..A../..f.SV.j_.J.U......~+..`4....kqe!......].;*..W...n.{![v..Vo...P...".+x..k..P.......=b\@.?^....X.5...... S....jjY%T.#.............N........5.f.................k.6...t..|k^../.I..xsvN.r@.amq..*1.N.c..M.^.D..m=....nzF......a..(...Y.'.......hM.........0.t[...QP.@$Qc.....[x.?....B.3>t.>...?;....`.\...s3...S..+.QwlYh.....B...~.k.G.U....94U\...}..%...........w.d.....'....wM{6........SD4...E.l.X?.x.^.UF._.+..Q....\.d.OA*...'yT~.....v....k]0H.!...P[f:C8..2......=,.$.7U11. .$...%%...5.d........#.n;.b..D...,....^.~_L.J$..3.....>Y.....G........e;...i;X..........5|.f..-.{.H.d.;.Lq...Y..yt.......z.gX=w.,{....Izacax$.E.C..+ghh.T1..c..>y.E......b.[]d........6...JI%.9w=@.A....:.xq.....M.....?D...9.N.ZJ.8)._9.i.."i.!|.Fn.U.m..+...q...M.g...r..)&....1...

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):49412
                            Entropy (8bit):7.996474066108621
                            Encrypted:true
                            SSDEEP:1536:scaJB/G/o/RVopHEnbCm5HRoSF5nL3P+D:R+GQnopkRxoSDnL3P+D
                            MD5:FA36961FEC29E617C12E51D190E544C0
                            SHA1:B411D7CFF9C398991E7ADDDAD594D7F26BCA3CED
                            SHA-256:B03857A89F0F1ECC0FF7417493C98BAFDDC349B140D5B575C48D26646BA53BC4
                            SHA-512:A0783AB6E9FE1B5B8AE73FF2DD02A28F6937B9B86B213440E49270A2D8FDEE7E323CF8634598D8665602814CCC97DCCA4FC15261E8C20C0DB8069A04322E0173
                            Malicious:true
                            Preview:....CZ..Q...E../..}.pP.......k.._..u.....)......xc%y...5.^.5&.m+"...../.z`.....'.B..En...K.....J....b..i.].k..D.:/,......:W..k..7........7,U$T.1.Y4....C...i_A.~...F.*+_.+.....FI...`.....-.y/..!PZ.R!.RY..1.VN[.."..k...tZ...Ds..M....=...g.../.$ 8.!..b}L1..m......r...ML`...g.#*.o7...aV.i...3.(2....XL...ag=+.2K.(.&-.~B..=....@-........l../.....G.0.V....$Cy...%V..w.....x....V..`.....F?.........yw..!$...7.`......L......YNIi..).3p`R_Y=J.3....,Vq..y.m......UDe.|..I.k..h...C..t....Ta&....S.I.%.T.V...."=..f..L...P>f7.h..g;.-.E.....`>....)=.,....W/,....\.....x.r8.H..#....I6.9.*...<.....eQK.r..*..E.o;A.z............B....?.d....d...........?....m.Q..`/j.eL...y......"-...NZq...e}..r.S.a......{..2...)O...[......4..,.E*.../3....K...G.......\.GZ....k9x=~...bM.QO.#].,..\.(.1x<..g....q....?i...s......K...P..x.*V."...6.*F...L.'su.#?......5A..>}.....n.>".....m.....i .............:.e.y...#.L.1f.U....%..,j....+E|.X..@.U.ht...PRc...?U....o.}.Z.=....B..>\P2.

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):33029
                            Entropy (8bit):7.995099438356133
                            Encrypted:true
                            SSDEEP:768:GrX+9bjCwoeyIGwteFknQYg5RQ1U9LrcIKNQflUSI6T:GrXUftorwt03flCNXBG
                            MD5:2A082206D00C42D44ED0BF2FA6CF50C9
                            SHA1:B3965CBC3412718D13ADE42B47A2DC8E6D8BEAEC
                            SHA-256:04CAB85D8BF202158EB31823F789DBB6B2FDF9295EDF97AD64C9913A72DA2E02
                            SHA-512:C63AF17131DE94EBB4D061FD4393704520548B8A367DABA62DAC4973FA1EAFFE9684A2106684725150C1E34549E9EE678C1071E1BF47710BFFDD6D4E4A20E034
                            Malicious:true
                            Preview:....v.y..^....6.F<_y.)X.w.....j...J.=...0>..*....|.....tT].3c....N..Pe5.8.Y.9*_:..s2...7~..<..I,..L...c..._[".........o2.]. n...*~;"g.d.=d.E.1..R9J...."8..f...!.9j..b...S...M.\.VY2A...}A......y..K.c..U..4......(.*...,TU).WDO......W..(......[lU..F.dq....qA9.<.tu.4...4H.z...:.*...%...h..Q.9..p.D.#.j..!...._.N.]K.?.M.3%_..i.R.....@..f.|..K..X.mDr\$...G...s.*d..""w...\{.:.JhN.m..").U/......d@yE....p..<.I].....~G......u.%:..[..F....MCI.o...VP......:..E.W...r/"~..U.A.."..&\0..Z.])..>'H..~.[.|P:.6..?.\+.......<d..}.d.....1S.W..rA..A...X}.........lHk].a....$....9..&..Y.....C_..@.w..Uz!z.......8...T...:{..m.a.....n..go..r.J.|............Wl!\..1..5%T.M..r.rUV...C..[.'&Xw..f..h.K.F....zY.{}n..*r....(?..8...$y...I.......E><...b....k.}..Cvo..P..-.r...A...y2#'....h!b...\.u.. .uhE...X..n.>k1I.....g.rg".).b.V.p..hU..../.U...z....x..Z^...._.G..V([.Q|.3..J......T W!g.B....Xt.M........{..SQ..y.fs*..$o..N.oA>;o..6DYa.O.kL......{........KE...$.n..X..J:L..o.E..[

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):49408
                            Entropy (8bit):7.996085611909793
                            Encrypted:true
                            SSDEEP:1536:22cy2rfSqNwEM1M9YYeuaRVDY/hlfo1UB3V1BDK:22cy2rqqNpMe9XeuabY3km3VfDK
                            MD5:41802F0E69AADC0C056A6818D0FF84D0
                            SHA1:95766D81A7AA8196742BA55D46BFC303C12E8B3E
                            SHA-256:D0BE5FD4055BC6C3F99C08F1103235F54B7E87A92C1D8B232FE036B93F8B124D
                            SHA-512:3212CEF12EB890BC237BBFA6136BF4F313096C878C8FABE3B657B49EE8C0229DC9EC04951125D43FC35A8BCFBA786A1EF1711FA0E2E6A3F9FEA80D4AF849E085
                            Malicious:true
                            Preview:.....v..E.....o.0H..}V..(..&....X{..@... .X\..../H......%H...K1.|.J.J.....3.......E...t..~...........`...|.3.`......0....e..Nd8..#.....$.......I).`.,..EN.dZ?.+c..(.`.u.f..v.+.P"{.8/...y.)...^2[....r.N.C~&..e.W..-....C..B.iJ....a.OU..Ov..c1qb.o...2y...$.R.4O.....G.o......Xo.$8.Qx........#..{.S{si.l......z~..vg..El."....v.*'u..w.1.m..K4.b}....=.J9&a.J.yT..e..Y^/{.o.N......g&!f..{.+.;..l.*@..M..c.......R.W.`..(g.t[.F..y_......z..`.....N0....2.o.. ...|..<.....O..9.Mg..x...}fK.9.....G.t\.192r..e....*Ip.-a..*...h.$m.j.9J..t.l.!......D...N>]0....*...^;..:R...k...D..c.G.[.s.B...K.*...zkW.a.Y...>.y.8GL...(8}..Q..roC...*Vj......pk'..7..Q.v%.z.... T.sA.;..CT...R.. Be.....F..Y.....s5.2Eu..m..EXU.......e..d. ...Zk.E.....t.|x.u.S{..........E$.....w.n...F....xP.t...3.....t..<mO.......|&.......9...4.K....D..8..).o...*4<?....+..F..pQ.....q.+)..5PG...,..4...S.q.......X.S....a!......x...4...I ....).3..:m..B.ys.y.U..@K.'DFDa...n.$.....$..U ..J...~h...T.U\....

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:true
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):33042
                            Entropy (8bit):7.994011814524737
                            Encrypted:true
                            SSDEEP:768:KtLYD196HvAEhNab1Ij6LIjuz5fMhe7otxc30J9rlV1uDMC:KtLK6HvAEhEb11LIKz5B7oW0hVIIC
                            MD5:36DF90325894BD9E0E26276A144E4CBD
                            SHA1:62E7E2D4862B2506E5CBA316A9DEA5E373D4B8DE
                            SHA-256:B7274D5E453927A7988AAA115F9C02E4A41FB27F1837C727377259555ED81219
                            SHA-512:BE2E432BAFD0BF4A6B4E41E634BF5BDBF83B6F67BA22D0B1887732964A5D87107624385584C8B079787587491215B37C961FD4BA958A228F7E3E08D62D06931F
                            Malicious:true
                            Preview:'.X;jo....?.Ip..26................O.-.fn6.............Cn..+*.....y:......[...e=.@?..X.^.G....b.+.<P..6L5..-.#I.....@k.....%v.m3.E.A.'0...S....?...ia........iw6...).w...."...-.....Q.J....._..4.'6....+.(..r.B...J.c.$.h........e..VX'......1..V7Q5.g..~..1.O.Za......#.lK(.p..d..r..6....RsH.k.P..6._..Q.R2a...jG.;.t.`....f!.PN.4....yL..A..Z>+J-..j.|...UK........@.)J|./ZL.Z.....lX.`rZC6$........k.)..cg...|.z.,.=..A....N....a....yo.....3....^...-s.#.Y.@..{.....8.../FS..T-..,i.?m..^8q\.6.......'...~>..&.)..$..+..@<.5.5..VBU..C5..G.*.L.H.>.;.qe4u..$..h.#..-h....=!\.dP;7a.....XF..ZW.\.".a.c.i5@$.?>.jp.y..L.$..S...Z0..>..~....@.8......&<I..K|S..A.E..r.y.A......[..5...K.ST....Z'.$....{W{+..$,./M.Z.9.z0.....B.x....x....*'yx...qI5.......Vz....fz.....2K.......7&m...$^.Y.7..Q...B[R{j....~s[...[....-}..r.F......Vb.....B...J.(...O8....tx|.1JF..L.9.p....u.1@(.mb$...=.0".....{9..wVZ|..F..L.y.Z.....d..n&9..~S..X.[#..W&:..lpR....W"#...%\...r.

                            C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):573709
                            Entropy (8bit):7.8190317345899265
                            Encrypted:false
                            SSDEEP:12288:Cmj8Y5U7m10jU2O/KkkGnasC92OHfSr7aDkedYYIanp:Cw8DdJGnas02O/SrOlRp
                            MD5:8271E1A5DEC83FB3B1DD61CA20748FED
                            SHA1:F6D4A1FCF375C12EC37A6201F8C2F61597380FE8
                            SHA-256:177D565D06C071895AA6A8C26C1CBD91514870456DF51606234D9BC545EB4831
                            SHA-512:1C4AEB1E305704D2003CCC98D531FF932B870C90F696BC907AB3A5F77C9E83C0C184DBD330CB15397C021C438C5C9BE6521A0E7329717177F8EEE39A37C51A9A
                            Malicious:true
                            Preview:....}.O9...=..PE..{.......X..O....<"F&...2l..9.9.....K....WX...".Q....l'..VG..-c.o.S.s.......C...?....oX.h%...Y..qP!k.'...P.t.N.y.e...>..I...w...b..!H_F%.,.XI.m.IV...n.2.w{.o......1..!Y..3.R#=..........;..f......u...R..S_.&.2....'...k.T....<a..<..E5l..j..y*..0..o'.6....La.q.U....<]......G.HBg..5..J.B=..E.Z,.#..v.Er...-..@n[&.N...,..m.Jz.,ED.!...z pT0.........3.J.v...gX..*..............^...z...<.:.,K......-......LY..9.;9....@.k)......YB.......6..y..$O..D.:\\..;.FK.H...M..R..8}.;.u.q..R....|p..sa+..3.e..7vy..k'.b.r.1@.Vf..RR......p.3...kJ......B.>...{i.glr....:.....k....-....f..r.u.'1..9.OQ>..3.>a6<.iM.4+.............z.G4r._vX.F.AkeGm.m4H..1.F.u..d.7.@.Vsk....._)..U.._....j..1.......s..XM:.....z_q8w.......)[...@=W..s.....$.f.M8[...o[x..u.Gr.>}........5#o`...t...........I..u.#d.M.._mP@.....y8.DK.[....i..`..+.....#.,l1.:y<.Q..5..P.-.c.\J\1c.Y$.*..g....._....]`..m......d.o.<.<..0.z.q&.>`3..R....3Sr.\x~...e.t.....~.2<.....n.~.)@g....w.........

                            C:\Users\user\AppData\Roaming\com.adobe.dunamis\56079431-ea46-4833-94f9-1ff5658cdb1c\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\com.adobe.dunamis\61f56613-c62c-4b17-84dd-62b60d5776aa\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\com.adobe.dunamis\6d9d9777-7ded-4768-8191-9a707d72b009\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\com.adobe.dunamis\f2eb6c79-671d-4de2-b7be-3b2eea7abc47\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\AppData\Roaming\com.adobe.dunamis\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\Desktop\AAAAAAAAAAAAAAAA (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\BBBBBBBBBBBBBBBB (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\CCCCCCCCCCCCCCCC (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\DDDDDDDDDDDDDDDD (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\Document.doc.scr

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:modified
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\EEEEEEEEEEEEEEEE (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\FFFFFFFFFFFFFFFF (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\GGGGGGGGGGGGGGGG (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\HHHHHHHHHHHHHHHH (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\IIIIIIIIIIIIIIII (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\JJJJJJJJJJJJJJJJ (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\KKKKKKKKKKKKKKKK (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\LLLLLLLLLLLLLLLL (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\MMMMMMMMMMMMMMMM (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\NNNNNNNNNNNNNNNN (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\OOOOOOOOOOOOOOOO (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\PPPPPPPPPPPPPPPP (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\QQQQQQQQQQQQQQQQ (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\RRRRRRRRRRRRRRRR (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\SSSSSSSSSSSSSSSS (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\TTTTTTTTTTTTTTTT (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\UUUUUUUUUUUUUUUU (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\VVVVVVVVVVVVVVVV (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\WWWWWWWWWWWWWWWW (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\XXXXXXXXXXXXXXXX (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\YYYYYYYYYYYYYYYY (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Desktop\ZZZZZZZZZZZZZZZZ (copy)

                            Download File
                            Process:C:\ProgramData\D4EC.tmp
                            File Type:data
                            Category:dropped
                            Size (bytes):199168
                            Entropy (8bit):7.997487317877989
                            Encrypted:true
                            SSDEEP:3072:qbqUIEMkwhHl7rputzobqUIEMkwhHl7rputzobqUIEMkwhHl7rputzT:0IkiF7rGqIkiF7rGqIkiF7rGT
                            MD5:6FEF3B299CF5F1B118871E0823209963
                            SHA1:2437C2B1239346C790BBAC29E87F04A0E4DF4B8D
                            SHA-256:CFEA8EDFDC9EB5274942D05E6572DF31B673B27184DDBB1789C328A9DDC3BD01
                            SHA-512:B31AC0732DEFCEFE87FA2D0805BF3FD2887D49C2D5C541CBEFC33600FA3661F7656E892F9778C0BBCD38F2F8D4D4FE2156D860B55E2C4BDC4B9CA9E82305FC68
                            Malicious:true
                            Preview:....=.....0.o..n....D..M_y._vvY...d.$........qb.E.\..+..b.~.l|Q..q..|V..N...mq.*!.C.....m0txt.."....0.h.!p=x._?..a1...5.r...3..y.......TO....|c..P...6HS...Ht..3..!....,@`'.E,L.gyC..a..'...o#.....l...jK..XMg...2....*J..v,.8.."..H......l..'.d...j.1......H%.^...4.mg."......hRE.{.?...........<g....Z2<..o<9.uD.:h>.n...D.8.u.b.eS....3.,..#.&I6.z.,..!...{mT.....(^lC....e.{.....L...tz1.#..B....6.%\.4=y.....,.......).h.f(.m..|.e*.j|.2....<.."'1*..q........H.7e..A........H..P4.....V~.S.g.m.}..\...x .d.o.9.?....o.....4.w..z.*... .z....>.?..$.;.g..*..|v..7.)R.....]....WY]k w.2\P....p.5...Q~.....g..<;.g..-.....g..g.o...7.b..:...Z<....).9E.'.l^.*.....A.'......... ...w-.px.M.^3_J.cA.;...m...H.....p....7B...s..G..&.eX5..CD...8`<.q..D.z.z.9]d..:.N1..p*.c.a.jA....y.v......[..7.2.8;..&..f...p.....b.s{....l.3Io..t..\`.'......P;y.....t.V.....Z,...4 d../......%aQ^2..'V.......K....P.f.d.^...........aw.3....f-..#.6"..T...N/u.....R.r..DKw,..........U9...../.U

                            C:\Users\user\Documents\BJZFPPWAPT.jpg.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1270
                            Entropy (8bit):7.827255009322669
                            Encrypted:false
                            SSDEEP:24:Hwl5HXR4ErS8dMqM3W20Evbi70/Ll2GPnVMkC/YtyT6DpPDbS429h+YTT9TRg:QlhXqEm8tM3W23bi4BVMkZDbSNTk
                            MD5:0AF047A797C1FD16CB475EB3C93EB7B8
                            SHA1:FF04E9BC57A9FAFC133C93DE85C9B736907736FE
                            SHA-256:36CB4EB01641E0B4677C82AD146F79FD2825B2D6B853D758A4FAC1E9857F0B47
                            SHA-512:355D05B81F86E447D0B53421A5D49DEFF6C833F91E0AE43BD197E20447D99B73F1D38E5E41B7DBEE5FA96A8D3398DBC41A527398CC6E6777A7A33C0F51A2E480
                            Malicious:false
                            Preview:|.(.O..........Cl..g..3T*#\2{.r&...e..uP..>..*k...8F.,...YM.vj...W.Uf.2....i.OV.J\.h..4.e...P!D..,.gv..|....u.R..WB.\,p.f.!....h....tF.....>....b.0%*.8..n..h...!..+.K`...(Y.2....y. ...i..Q0q..+m....V......y..D.Q.A....N....o..v...M>O.=..F7A.q..W.,.^.o9q~....J<.;ET....=..<..w.8.....Oc..zd....I..1.7...6.....;.o^..e... !..._......C...E...H...}...JO......^...9.~....l..B..G....&z.~............w..QI....t........*...3_.u.z.L.z....5.o..).^O...MZt$.K..T..re*v.5q...;..@.Q............y..t8.-.Je.*D..!.^B..]..MN.O...7..C.....g..X5Ab.u..<.|^..$+......1gT.........g..G..s....]H.Vd.......P..oc........C.u9....F.-}....e.k....@..W.......O...Zd.i.....I..-..t..n...I..F..M../.Gp.!o...mn.A.jt.C..!..N..SL.y._.......{+:.}.?....t.,....6:..k.......c..|...&@*$..Nj/.....u..w/.4.[!.P.-...|....qax.MgF.0.j.>...r....g5b..~.H.r..:x..|....|G.;K..x}.Cv.c.y.a.2.....#.....zH...3Fd..qDG.;?.dX.....B......9.|..v.....w......o)C..V...7...0.zT.h]57D.-..........p..\..y...8^

                            C:\Users\user\Documents\BJZFPPWAPT.xlsx.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1270
                            Entropy (8bit):7.848332354325875
                            Encrypted:false
                            SSDEEP:24:iX+MKxb5LsrbciRYAs0+mUr+DGsrV9sKzDVw2eJCYfVIkTrkCG08JYTT9TRg:0HKxb5uPR3z+46sns4DUJCmVIErtdJTk
                            MD5:11D802C87FD5AAE07A5A0EA1E9A511BB
                            SHA1:0140AB7F4802360545D4F3383900A85C217646BE
                            SHA-256:012B4B26BDF51ABA54800EE0BD7DC8DE676AFEEC92014FCC4B4F8F2A650F00FE
                            SHA-512:7A7DED43EDF11E2881F590F20B4FD7646DE3F65851D88BCB3727218C2CF08F5528B7D2B13AD945F6373F18A92357629A77C385CF99AD331F0E83CD7725E8B924
                            Malicious:false
                            Preview:...:.b418.e.E.......2.M.l..E5...>."U.Ig..9...5?.....q...J.+vX>i........l..f.3!.:k..9...?&..W.e!...9n......Z?.W..`.c&..HyE....:......D1.P1fd..i.....s7'@.M.x...8...d?..).?...[n.B..1...~....S_..-;[.<...R..K..X.......&..C...."...d..0EI4..t.=.S.."g.HON..g7.g.@..UA\.....?.*%.m...)..B..nv....;..>.l..PEw.*0....M..My...R.1X..(..^!S...}..Si!.O3..3o.....%..#.....g.......$.......H.E[z..]}..(?S.U.I.e..1[...B..M...O.%Ng....d:.....[.ay...V......bl1.V.....L.MVx.4).b.. .=.I_.J.{..7wz.G6.J.bz$..MwL.)\...QxG9.{..ZU.......?.T.....l...E.....-eO...(.p..V0.8..R..>.rQJ0%.....b.1..F..?.$.b[...=...;....'.. ...;Y.....V<H.QX).`.`.2P.6w....0:..y.F.^~..'n....q.7...x.v...!.#.M...$.F..M.3....#\F.h..A..?a.w..)zV..K.....IF.....0......|.._b..L.....;...U....Huw.D.@...p.>O.....B2..0D.K.U$.u^.A...:..r6.dE.8...;....o..6B.8...b.|..:.`.dc...L.....c.0A.[..I.`... $.k<.....&.W4.n....<...q>.....x.....i|......V&R...z'..........w .T...+w..S~.......d+......,].....$5.3..][]..vI...

                            C:\Users\user\Documents\DUUDTUBZFW.mp3.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1269
                            Entropy (8bit):7.835083548936828
                            Encrypted:false
                            SSDEEP:24:qJYgiQ+6gfztFRtKaXYEwuI4twsvJeApvQmq70Na+mYTT9TRg:VQ+6oRTIEwjl+eIzE+TTk
                            MD5:F9A86127377C3D6655FE0573855C42A6
                            SHA1:304C2B009256D7C927995760F649108F06C833B9
                            SHA-256:61D761DFFB2CCF4AAEABD76C3B23C5A37DB32BCC39C39E11A39AA40753C06855
                            SHA-512:C109AC59284A486E9B671F8B23230B18E297345B71889C7BEC6B84158CD7A65B11C302B86206929F03BBAF3DA249781E69BAD072B8FEE17C1990ACD8CF408B14
                            Malicious:false
                            Preview:....{..@,......J.f......d?%U..F.n....OP.k/.....s|.....Q.P.._B.....R?..z...SRfW....v....j...gYf.+..WVT.7...Nq...9...s..|.....7..")..}..m.1.....y.k.rv....Z...4.>...\..$...0....W...j7]..nLc...;.#=..)u.eK..=z&...M(......L....R.P.k...[.\O...9[.....9........k.P.....*_{..{Hr:{/>F%Ja..%.=S[......LIz).B[.....\L....+n......|......;$....M.CI...}..J......$X..A09u...0....{..5f.w...{n.?...A6S.?R...^:.=^..cX...Rc.l0..W.V.3....1.Rw+.4P...I.I.Y...#m..u.H...6.?j.{..VCG.%..r..:^..%O.....KJ..n.8.........E.=....g..2.Y.q..@MQ=. .].........[.....#...8J..........?.rY..o.6....5.....B~..;.xS.\....@\...Q^......,..w1o.'Y.5..upz..i.K..6-......0....x..C.,hJ...m..R....p....j.... ....p...;.e.U9.k9....7......-t.j...b.....6..vS..[~...^..+.]R>..@.]c`..."u\.C.N..Z..6..[....qe_a4..^7..<#..f.r.].!.@..._..9z.Sn._.K....~o....|>.#...|.]..FC...J..\.....\.z..d.:p..:.[[.5,...=)...../.... .A)...<AD..1......D..L..No.+.m..a.Z.K.j^.(.+.....s.!.[.`/..SU.\...C..Z:.V.G..lP.F....."....

                            C:\Users\user\Documents\DUUDTUBZFW.pdf.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1269
                            Entropy (8bit):7.856435785931182
                            Encrypted:false
                            SSDEEP:24:ueBOKcz2qrYr334eOYnzAkEWfwsKCnO8GMbPpCtCKN30Rr8b01mmYTT9TRg:uOOKczHc0ezn9osLnOAItCK48b+mTTk
                            MD5:B104406F706013AB73CD5C2E2F4F9035
                            SHA1:108A2EE1B1049847AA850B49B7A6C2CAE0670EA7
                            SHA-256:9DE561AD056C4E94D05AF9037976AAFCB030A7ADE4223B19A93387CDD8E651A0
                            SHA-512:C0A7CF58DBCF9B3DCF7B93258D40919ACBB894247F2900610902AE5E1C76B54EF8436A9F72DCEC9D0A0C15B838CDBAB5A32F7D9D36879F6963896F32E3B7B2F7
                            Malicious:false
                            Preview:...w..Zz.z...2...p.`...?.c6.b.....z.....b*.g.Q...I2.{..Rkq.jJ..f.@.S......H.s.X4B.N..X..(x..p..i..1X;8...%.D..m/.......%....dU.=2..j..n9x@Nz..a.w~1.U....A.j.........(.%...Y..L.EU......(.pHd|x.B..O.%....kK...lk...Y%.....w^.. %7.....V.a..n._.Q\z........0V..X.Y.....3]......Po.....y*....P}.kx........t.V1.u7[.3D.n.fK.|...$[..T...... .......`...U..P.I.3......}.m... .J.&.F.X<..Q..I .l\..p........$6.J.!.2U..{..'.A..&|....L.........sJ.M|..........<......8A.]zilOg....Al..H..@...K.i. S...^e...C.<f.HI .$.k....CP.N..6.MV.G.W...&.....dq....:...'.]*......dM.#I.Q.V.$&...9..S....+..._.....$.._.=......:Q...._.....d.$....-n.*..(.....x...k......i..;E...O.A."7q%...,....#..u.B.'.5.`...........X.....F..p..?....b.w..b...u.z.s7X....AE.sC.;.A.t..u...lT..H.wG..)...t.h.Z.K.$>D.o1.->fX.{.=.W.R......D.:....-Z+5.~..opdH]T.....h..........4.]...jU].a.+.w.#..L..s..G.p..D.p$..+2....0....;..X.&,4.}.C..I....f.j....q.~6t.X..a..n....w...*....."..............R.H.d....mY.

                            C:\Users\user\Documents\DUUDTUBZFW.xlsx.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1269
                            Entropy (8bit):7.866997512549162
                            Encrypted:false
                            SSDEEP:24:2zLVziefKb8H/OXHN2w67U19+fuLKsL0ANVG6XRo0C3C294uPe8tr7REsFXs4mYQ:MR24KbKv7s9qf0NVG6BdHru7r7TFjTTk
                            MD5:86F5922A8A3EF2DEA84760D15AA48CBE
                            SHA1:75DF9870877C1ADF9F3292ED3FC576B71AF4B1A3
                            SHA-256:066C45E21D8552D3CBDA378CF4A9BDED0AD1AB4B98A6F04C6F8A8FFC31DC5FF7
                            SHA-512:D0CB176498F0AE57A9C55FDBFF1937EA60C710743DF11F5A712A6823D1C1A31B4D29C7DFB51C1B319F9A77697688B44D4BE17F8DD4D268B9A0174D8FF57B4FC8
                            Malicious:false
                            Preview:}...8<?....DQ...`g..V..f..[..x...o...hW.sX.......T..+D...;.......,../)...2.?...b......v8N..P.CIxb...t..+.d...|..6...$...9...g..>..$.]*....=.-@.I..A...ud.X&..})..+;wA.{u........._*..++..>.h...[.X`..U....y.w.S.ze.v...b.n.WE.....Ql.$Kv..@(..u...?...x..2...+![z.f..(At..qf...l.N.....D.,R.b-.U..."..>s...h.K..M.$...7.VS..-..6B..k8q.......}.^Zi...ZX..K..p..F.....zU...."$.(.4..S..&..m.2.pG....[<hW.c....g.G...........`....v.Q=......_V...............9....Z.;...b..r.....t.......<...^.tbJD..2!...6.....w.U...<`3-....&...spo7..;i.,..E.....H.N:.."C.Px....^>...........w...#......?.f/..?..<..E.].|-...ry&.R..b.7lG.4.2R.=.Y.v=.W...t@......5>...\.:.=T....d QS.#....U..Z.HP...K..Ge...$%.L.`...QA>W.b.`..d.KnW..._..$Tr..J.v.U...J..$N......!tQ&."...s..........5.Wc..U....6..#.X..,.nU1$..>..R.~).W.v......|.w.....9.c..q..%%..ea..3/f[.PH6i.N..0<F..qe].a@...S.$c).5!.I/..;.......k..ZT.Ex.\..R..WT..X+.....I.....E+.....t.m.. .|.2.~r.5V......_...A....C.....

                            C:\Users\user\Documents\EFOYFBOLXA.docx.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1272
                            Entropy (8bit):7.832312633360458
                            Encrypted:false
                            SSDEEP:24:ITquGQtZ4JHrVGSPZp8lGsV98KroEWxmaJvYFyYTT9TRg:ITqbtgHlnVKKrg7OvTk
                            MD5:0BF9C404736AF9A55494EFE7C9365F7E
                            SHA1:F589805F18F428A2004B89966823EB73AF549C6A
                            SHA-256:82F887442A7835A40BA8DE0A5C893990E5EF344E4F6FA01EAACBE37F1D7E4384
                            SHA-512:7B2F091C8EB9A229BF8C532BCEEBDFA7D12227438D7CEEDD8A6D9552815040273E5383DD0C91C4455C4D06679A724F37253EBFDDBDC28607753C8C1EE90A982B
                            Malicious:false
                            Preview:U..#.jo.AT..kY.]L.......H\.b..H+Xj.'t#.y?E.._V.s$Z.-_..J<..f....../........:i,.ef.CH...R.....FzFn..iGl.A8|\.%L:l(.+..]k.VF.,..H\[x.n...s.e.t"..[.1.<....vw..rT..*P.x..06;l.p......G>..0.j........j..E......OrU...{..LN...&..s......u..j$....8..V.m.<.v'Z.UB..I...$ZNi......K....f.]...I..R...2.....4....\h.9.Q,..;G.k.=.SR...l..Oc...?.....2xW...H.|.&...4...4...3.L.I'.....~C....N..V......L....d......}[rN...xfw.4...E..4....0..l...d.T...Ae..|...!)X.....p7....Qz...+...m..G..Ko...$)..).....|.B@3...F.....S{.7.j..5...+y.,.C.].-.2...p.m2.e.i...].*........%2.% &.y.....fn[.....i..SL.+...*..u>.....5..3.vp..4....T,..~{..ex..UD..5_0...7|M%...o.q..C..)tj.W._.*4.^<o>\.........8...]Z..1...?....."A|....n./:...E.....Q...7&...\...........$i"....?.I.7O.`...h..!Z..Q9..._.n"\.......:...RN....0L.;*Y.T ..Hp...vYU..........K..S\.j.......G..e,..6.k..qM.<b..};9R.A..6.;H .~p..C..K{.SK.....M..U...YM...:Y.;....b.F..F..}"......+.!.Y.r.m.M..!c..LH....c..$.R...%..P1....I7.<..=%Wui..n

                            C:\Users\user\Documents\EFOYFBOLXA.xlsx.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1271
                            Entropy (8bit):7.857025969656485
                            Encrypted:false
                            SSDEEP:24:VvNob1N8L/bk3Zbq45oVru8E+6lGJkPvQYiC4uIgS4eYHaoZJAMSYTT9TRg:dx/43ZbXPflGJkHQYsd4+oXTk
                            MD5:C896C9A1D61D094B96A4BE006D2CAE3A
                            SHA1:B2D72FF2522F96DFDC757D1F0B9DE1626CDC712D
                            SHA-256:8358D21A67A989FC59CFC4DD21A4AE35535AA5145997A096EBEC7C87656C3B02
                            SHA-512:F9CD5905A5A749B081EFE7496EDFC3741EA276EC158676DD441B0D4991AC8F13395C764E520F611C5A741CC6AC226B9B321807DA9A7FE32379B73F96486656E1
                            Malicious:false
                            Preview:..o...r......'8.K...Hf;."x.(..7G..:...!..?M.. ....6.7z..Q.vy1...B.....l....b..pj.....4....... ...\j.C}.8\.n.V.<.*.........3M..u..."=W4...D7....s&..c...&Py........<..6*d.OH...)D..f.aD.y.^TP..BV...hvN.Go...A..\...2T...UG%..`..'.....`..1.K.j..o.. ....N.r...E..I.X%K..+...v..DV.sd2.q./..o.Z.].A..E.u.a.hxd......o..^.....&.4..u..t..'.<...p.]..-..8.....^...%I.B.%...........,...p!1.....`8>....J...V.&.B47].]w.-.J...=.L@...V+..X.0.3_.3...J....n.U....K......1......%.a0iJO;.4o........d~...[.N...p.@o!.)DJ.l...6.#.......w.....%..1/r.......W..Z%>k0F..F.....M..`..V.~......CrX.g...z<!(...Q#.B..*|.......X.P.....0y.j.o.u.L.....K.bs....5./.....L...>..^..K.&.....p.....2...".fh...X.....g.;.f..Z.-.......,....>Rf....A.).>Y...YQ.._.<...t..;..]y.8..K.jN.>.g....G).&rk+.q.....5..ye\.Ic........C...5.`.PHs...h.=..d.......nO.8./....Z..X~..D..}....&......#..p.....q.u..K...W..4....n.....y....c.[xl..^...v.g....-.7~.a4.k1G.....`..r..T..:..`...g..?..uN.?T=.x[....

                            C:\Users\user\Documents\EIVQSAOTAQ.pdf.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1271
                            Entropy (8bit):7.846034461436586
                            Encrypted:false
                            SSDEEP:24:aNV8t1gbo3baZJNBpD0gmu8jmlc/iHkgFkbeoVOMYau4xw737YTT9TRg:kVw1g0+ZVmu8WTkgxogExwDMTk
                            MD5:A13C5EA04365B7A20BA80176882B609B
                            SHA1:CDAACCDF67F6436F1284DEF6BEA0919B981A6C28
                            SHA-256:02A5C95012981274035A53DA913430FA17B97423CE0B7A1EBDD3FFECBE8EBFCF
                            SHA-512:8BD14737D6E99B602D0CCFA5411540573CD9256F904107B4BC18FFECA0F65AA90D00655055899F25EB0506F243BB610451E09C67C716EF964318663ED0F45D76
                            Malicious:false
                            Preview:.W.B..T....>O+...J...D.".....R....p[..U.....8..... V.:E;.Fc.N..W.j.?....%.h\m.(....Y...f..c... .).4.y.3.dO..V..f..>...fy.A..............r.|x......s....>7..k...g.^....;4....r.2.&}Ha.\.7.'F....e._...i..x.q..D|..:.."..5....W...Y.*-...].].....i...m.f...W.c.}...v.D..d}.2..J...v.J:KW..'..=Za..ws...yH.x.....\...eED.in\|,c.........+.YJ..N......Ii.c%...a.."...1Xe..B.}.......Q*.H5.(a..q,..%..}...o.Z.`...{30...<8..9Ao.c.;rW....4...z..R9&.A.@.(...4;?..|.!iVC..H..M...........1....V........:u.....4..l6..k#Z......{.4.H.(J2.*.6.#.j.zT:u....{.....?.1[k....#....^.....&t.l..V.....0B..{...Q.IDs.....F...-..+..BQ........Pi.7.u)3..V.:./..a".JM@(.b....(.u.n.,.K.u;z].s=....Z.#.."#D?.f|..x...~."}f..o......[..CY$..i..G?..g.%..?.a..n..>$i.@hQ.o..Ll..Q.uP...l.........g.......=.>...._.8.`....a.W.6.u..]..0E.\..|.&._.?.8..z.....~S..W.RQ..*w...F...H...DAIG+D<`.....D.....4g..d.....x_.].=..!...o..b/.w.sW..U...7.a..Na@?...U..}.D}8...........G.b7..C.........3......

                            C:\Users\user\Documents\EWZCVGNOWT.png.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1272
                            Entropy (8bit):7.845893073249798
                            Encrypted:false
                            SSDEEP:24:5KuHPuxU9vPYadVimx+PRPPGSiSQ9JcwW49GValCYTT9TRg:5pHPuAJdwGoPqSStIIpTk
                            MD5:9CF4AEFB3D5A432B64661E16D855B216
                            SHA1:49B3AC10F5DAFC14DA98357D1FC47D6736CDB4B2
                            SHA-256:BB17E4615169BE836A2046B24E61039835F467B875280CBE4210ABBDD0E6109E
                            SHA-512:579BFD95AFC5359ADD26DC0B36A0FD1B82E27168D2B2A54EB570E5E6004A6C07DCF257035AC252F8E80782C54D53E853E2399E7B60DD8DFD638FA5DD82CEC547
                            Malicious:false
                            Preview:OW..Y{...f..L.......S-.cd....E.....9..%..b.<.C..px..7g..$`x.X.f"G.`.......hn........{.......XUQ.z5.\.........V8....#.,..d........'.,.4.|.Cb...[.Z..r....`...IJ.Bl....\"g...L*ei...4.(......@...T[..C!...7Au<..L....$...?.n.D..6...E..g....\.$...pI.M.T...q.[...-`....Jm..v....[......;.?ch..L.......r.s...h.U.%$Q....../...P..e.R...G....Os.......a..lJ...OV......)$...bf^.:.v1j..0&..u4.8.6....S..(.W......$Y.6^.VG....w..Wf..)...v.K%E.......z~..-..t...Q.......L....+.v....N;."8.l..&..iJ..#n..^d.9m.a....(f.%W..0`.....2...d..X..(.8..w...L.G......b3..C.&3.....W1Y...z:;{.....e.b.I..s<...'Em\.?.6.KSIG.N~`{...2...53.!..^.i8.M..-....D............U. .%............:.C.W...8.....L.t`..Ql&d..>...g....u.kTP.[...........x.>.?...Ff.Ylp.&qB..Gl.5.,1/.)..=6)j.....d...%.A|..^.E...Q........$..`...>......>.0"..7....}.H.oc.....t..u...t...v%..>g..JB<.z..>.G..y~M:.`$.d".,w.Gz......tiM.z...G...,?........*..u;^8.*...l.Q..........^.]63..,....!..U..<......)W>...\[...S?.MG.

                            C:\Users\user\Documents\GRXZDKKVDB.docx.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1272
                            Entropy (8bit):7.871768548575421
                            Encrypted:false
                            SSDEEP:24:QVXJILd888NwLaTEborZB9akH7jrzPFU0vVZq4/RuvZpA6fCYTT9TRg:QJJI+NeaToEZB9as7rxvVZq4/sw6f/Tk
                            MD5:5E760E73DEACB3C7EEA8FD48C96675D1
                            SHA1:019FBDD52B50C0FC024233B454802BA8E59E9BD3
                            SHA-256:1A6A824ABCFFDF33539597F21D00AE1DBF7CD1EBAB43CA34F8EEBCB7A74A475A
                            SHA-512:100BF31823693D28603BBADEBBEEA03AD2E1047B1EDE4DC8AC222CF46DE474FC83CCF6BCD6E4AABD832851778AFDFD8B21D444EBE478838E1DF39AFC260AC028
                            Malicious:false
                            Preview:..w7.S\...8.s]4..X*e.=.....8S.Ou...#..Kj...~!,:.... .8N(..yf.......}..;j..@`x.'F.m.W...R..I..)...M..a.X.`#...h.la.]Ch..y..A.M^/......-..j(.<:GWY..:........Y...^.B.l...c.lB...;j.}.6...4F.K...\.y-...e(......v......6..^A.......P.^....>gH...U..........b.I..z.,.[.riT..B!6/..c...!....J.aJ2.....3Z#..[.9....fL.'Ox../.\t.~x..Hwi..]/.u[...c.+.\.k!........d.#...B...KT.27>." ....."....U..-.>..V.e.t#...0..?.........Y....l//.%..5?..o....w>.0i.\....+T...rf$S..c....;..."GE....1.V......N/*...p..`..m\.S..J.c....s.j....d./..v.......z.....}H6..Au.P.$,..'...G.....yG .=...N\....gl.qq*..@....3./.......~.%.A^...i..l+zr...\.&.3.;...H..]..un&n).ag....+H.QAo.r....HI..b*.J{L..[..w7...rrB.y....as5D.HQj........:.n..8&...2..o..=... ..:.."...8...L..*.(np.u..K...KC..%PO.\..0..*).5B....V.m.....".....1_j.r.>...`...r3.8....%..mOoe..l8..,..C.....B..'.T...$.Pq..YM..D..+'..2..9..2.~q.......M..._[...x.(....r3...J...3T.*e..~p..l/t.....^&..&...."..1.RR.$.(y.`.O9f....1

                            C:\Users\user\Documents\GRXZDKKVDB.pdf.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1270
                            Entropy (8bit):7.868994487446516
                            Encrypted:false
                            SSDEEP:24:LxmTDGJ6jYArSsIFFbydm+NPHZeweQHpA/oCgboh2OvhJ/AYTT9TRg:LENjtrSsITbEm+FLeQHawCgEBv//1Tk
                            MD5:54502FA09E1060A04231E78118AB36CB
                            SHA1:C6A97F7867C9AEB3AFFEC0F7A8739972230C9511
                            SHA-256:4AA9E32690E23F038EA85F27FE0423EFFEBD5BAE2ECCF5912B8EA34334729329
                            SHA-512:22EE7318B4BD4203E20CDBD35893E89F356D0C9B7B351C8CD06F37E94AC00BBA238353D660A5B83693D0F2344DDB3EDC2B603BB1D10EF4FE576BD3EF671FCF50
                            Malicious:false
                            Preview:..._D.y.D....Sm......5".....E.G..6.G.^.~..2....uSWBm.+(..;...-.x.:.=..p>.q9...O......Q7td.J^n....]..Aq.!.e.....K.C.5.~.....m.....u..S.lJ....|...^.O0.n%...S..9...`N\C.=b1....^?)5..R...{FuZ.P.bi.c&.@.....H.f%:.!?l.Om..V}.g.rm..n....X...*.V!k.e.`...^...........>.No.f......&.%/..J..d.....@.......+.7...2.(.....X.<......svZ..j....i>T.PG.u.0...._w..Og...}..O.a<.y.mLz..2....O.c.....a.v...e9.....2....!.........e."..Y.FN.n.$.l.....v$3.sY...I4_.!~;..J7.b>....ED.\.:..k~....jj-.=..[U....-.."..Yw..S.{.+.x.(...V....:...^e..K.Mm.........).>...+..\.8..;#...znbO.....eDf...g.:Cz.g../...`.Q......d....... ..._..P.R....^..F=:.G....1g:...^...6..#........\...4..7.q.....s.L\.$.%..n4..^...J.....X.9)p.I.Pf.........i. .r.:Y.JV/.o..m.9=....&...!.O.7..B...\...*.Y....Q....X.X..e.a..b..Rk........W...k..vl.r.7..Y..h.r.u.n/s..0h... G..I1".3E1.......d..||.\.....j.9.....0.z..W......@...`.....h...l.(6.._*.7.#.(.!.m.1...$.I.+.=T4.;.?..2...q...4.......A.v)..L3...._.'.Hl../

                            C:\Users\user\Documents\KLIZUSIQEN.jpg.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1272
                            Entropy (8bit):7.835666046852329
                            Encrypted:false
                            SSDEEP:24:eVygvlMog3Ld54b+Ng9f5b4TWXqkD00xPSLBRBPZSYpv+aIWhQYTT9TRg:eMcluLQb+Ng9hDBELBR5MYpc2Tk
                            MD5:1563C6164F262234034EA23CA9043810
                            SHA1:2C44D5DF691C47EFADB929F74A8E986ECB86B64B
                            SHA-256:15098A4CECA8B6122A0E1C657A9C5A9F6AB5B79ACA1DAAEA6ED8BFA65099E614
                            SHA-512:1766248A574F45B9CE68CBECD5E88CCBC8073B435649C90ADDC8DE2F96F57ECC51E65084BD4DDE2821DFF55D1C719BA6F878E83D1BF7EE3B2DA1BE6500338F95
                            Malicious:false
                            Preview:m>..Q........5zO....D.. .G.....J_m...n(}.@.... .L...e.#..J.y...E3./7..FX.p.i.k..Z..H....n...T...v......{..E..X)......."../;#.|..<Ks0...r}T.{.f&...H......k*........A...L.....5...._...pJ..\.4...Y."....d......r.K......{n......wp*..e.M.I......9...V.U.3R..S..Eti.L..fb..k...AhmM.O....(.!x1t.....?Cg-...\N.....tO40>..$..[.&...}....;.. Sr.Z....Y.!?.b=...~l..]......0....e....Ti0..\0V.....1|s9F.!...).\wd....F..]?.2.K).....[C...a{..!j.1E...H.5..P..~. c.#..K.m...oO.5.N6....e.s....o....-..K.. ...Ay...1.(...Y..k..8.k.. <t.j..v...:.&z..k.xq.Mh.*..)ux.....6....q.K.....!.\.*fz...K.c.%....]^.S.GtZR......!I7..,.%......D.i...Nz16.*..UKQ.....W.;..H.."...L:.p.o.E.t."...7z_.=m.._h.eV>.$..C.{.C.1R...M.i........5eQA..H....EO. ...P....w..f....y..A.O..........R..,.8j..D ...%...EH... ".J.pa..........b]:. ..m6.N....(&(..RU.pzT...*F3.?.|?..-.GY0.m..(......FY..P<".QW.....qa9.I......f.f...1..._.w.@..P....>....Q.o......;..'lIH.\...3..jK./&.k.~O.....Y...O.I$..b.$......r...

                            C:\Users\user\Documents\KLIZUSIQEN.mp3.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1272
                            Entropy (8bit):7.846263660852138
                            Encrypted:false
                            SSDEEP:24:/xSF7VO2FZdZR+MLPCHs1YCX1KbqtuETcCcfNe9wQ3cN+xeMPG682Ab0HYTT9TRg:Jm7BdZwOCHUnFTuEQbNeWs2Y1Uq4Tk
                            MD5:3D01EA3E9CD28E12CDD75ED032E35352
                            SHA1:7FCC6CC25DF4D4C5086CBDEB2C0D761F9E3D69C7
                            SHA-256:CC391A0E6A48BE2DE725D698467C0746711E890D867FF6E8673AF1C4B55884C2
                            SHA-512:0F1EBB7936224290C9EC2D10DD12829176613B2E5A9BFE2F2B1A9D984A7489B66C1CB5AD679CAB5E8264A964836A00E76F9C047B1CF31BF830A2165D9343EA2F
                            Malicious:false
                            Preview:|k.(........:9.v..^..O..NG..+.z..N\..H.*S. ....|...^..K....Kxh...h.Ozy.].....{p.A.....X...n.dh....T.Pq.LC^.....d.!.f..sC.[.$.jE...u.8A.`.z...j.D...a.X..?e_.KG..7.c.4.Z....h.yz..W.........8r.Q...5..}..G.%.g.....1t.VX(SA..9..5.m.{..c...8...<J....AiA.?w:0T/vt.I......?M.\^b...0.......c7.S.0..F.95c.1..o'.t...t.V..=E....g....@..).n..C.......8..w.}7.g...L.0Q=V....K.!{.M9.8|.V..L..V..r(5..k.E.W."+.....#..4kGS.H.B.g.9C........B.$.)..Nya+l....."S...q.6..?..)....SA..SB;.]z[.....=s....c.......@..FH.....>i.h.Q$.i..o\.....1.....r.\.....0.P.a%i.L..M..[t.[mZ.d+.D....G.V:.....<.8.().r..?.B/...6..j..Z......7t..L@......CH..=t;yn5s.......;.[u..v..Z..6C...R.%.'^.T[..<...%c..l....t...-}...j......E.....&f#u.w`S.E.xl.R.......=......0C.L... a.b.),.d.....A..}ub.....8...G.3..GN.d..Z.~...R.,Ir....E..8..@.q.k.]J...^..fp/./....1.|...C..IIp.\.Xu..d.m..?..f.m...^y@.....L"w..K......I.c.]=F..XVJ.N.n:..e-?"&....:..L+{..[...5..h.A$u......w.vT......K..)(....w...O....Y.U.5...&.....

                            C:\Users\user\Documents\NVWZAPQSQL.docx.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1274
                            Entropy (8bit):7.812573479143039
                            Encrypted:false
                            SSDEEP:24:uoFWU7HdxZAoRx3Xx2LhOWYqRZMVVMivg07D+OWlw/ElhvbYTT9TRg:RzLdcGx3B2LkWYqRZkMiVv+OaDHETk
                            MD5:61294A1873027FC359ABFE1E1276989A
                            SHA1:D631FBE89E779EC0719BC895273E300636CCEA40
                            SHA-256:99890D47216B6E4D9C94D9F750F36823EEEE5FBF3D191CF395E34FBBAE3B4ADE
                            SHA-512:370832CC2C1A3363F9DDE89DDC31EB8DCE62B350ECD735B0A0B9E0F7B8D9E42EE634CA7F3FE47F51F8B1E3199E0EFBAE14F5B1FE19679364869BAD9597C60AB9
                            Malicious:false
                            Preview:...1..?......{.+.&.5..V.M..C......(..1..'.9&.......D..!......w..{.4.w.Z.O.;m...;.*...Q`^W.#|.Pj...R......'.16..0Q.-...Z_.Q.v...c.4....v...3.1....W.E3..c.....l.A.....['...S..5.[............[........b...BAH..J.{...O?.8m..9\......eYs6..Q...qQ....L.|N.v.1.'.o..o.i......zQ'..eb).]....I.go..lQd.s..ZOU.j.T.....k.e..D.....#.c....$#.Cea..........o,....#..1..'..j,8Z8....b....[....zE./jU..{A.!K.R]..W.9.....C..{.B...u....-X......o2..m..$./...].....L.....3..@xPH.?..b...Z...Q ....3G..).?"[..p..sI..5<.".zA.v.2...2N...*:.iC...X.e...0.{..}..Y..og..)...e.....).m...}4..:.S=5.)....B..+.Z.mm.N..Z.v..q....y@e...W.v..[......?.,..Y....b'.....I....1u..%!.Y........T.\.@).Bf\..U...-....&.^{......uxP.OV0].J...VT.^.,.-r".......#.sg..B..vi....O...$o..g..5....f5X.DmJY@h...f.B......p.[.?;H....T.8..g4.......n^.....h.\....+....7l....d.Y. .-..u........*...R.LN.nS-W..f...<1l.W.A..%.P..\Q...........k.,Q.=e6.$H.D..v._.m...Y6...5..I...A$s)..+.K.......Zm.cq.$4=..

                            C:\Users\user\Documents\NVWZAPQSQL\BJZFPPWAPT.jpg.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1270
                            Entropy (8bit):7.874200779396851
                            Encrypted:false
                            SSDEEP:24:o0LeBoQHrPpec1Al8Lx1B0Z9p/RyEfIgzsRqG6SL7Ds1ugD42YTT9TRg:o0Ld4jwa1B0Z9vyEfIlr6SzmVD4jTk
                            MD5:F499B23607A757B40F33855D9314D56C
                            SHA1:A67E2DAB817C68563A1CC2948C624E54EE7E7EE7
                            SHA-256:68F8EFDC41CEF4E2BE06CEE8126BAF09A140C29AE723BA7D69AD15D41F4B0139
                            SHA-512:481094D0AC32AA943E102CF8D5C8590829789799EB7052C3D65F10B58E8E683A109F3580E5F59547064C4FC6A8633B2D50A43B4BB47D02866C94086FB51F13C5
                            Malicious:false
                            Preview:.b.x...PD... M.......Z.z..?C..._..O...f..../t.b_(.g..hK|v.:..,w.Hl2...?... .......5:.8xk/`...\C..*....:}....... ..z.....=.J.u....4.S.,.. ..2.*.....B..{.6E.._N'.....r.64..S..h....{.g/.j...C..^...j.9....D^2...e..+...=5..v..UA...T'....U..SU.D... .)G..I...N`....^]s.l.Q^.e.;.n!L.X>..e......[9.+`&n...)z.?..kJ.?....?..._....8.....!}.....&.\.G.O..0..G........T.E...Z.~Ed*./[y...~.^.....0C...7.w#|.$..!...V.@.*.T..@...[t.8I..Mt.....=.x...\....^...B.Q..`DA.f..._B....hE..e..Es....p_..X{.....yt0=`......Z...x5..^:.J. .........A-tD ...........`.......&..:.......w<.m.T].D..b..w..a.`4t......|No...].{^.g..=.....k....V0..+.~..s....9..`0L...3r.g.......c......z.Q.So.j...VR(4..$..nVp7V./30......c....,V8...q;]k'<.......Vn.J.....).B.0^.......G[.0..&.|.{.,..|Y.W.....t.b.....;....r.b..".P...e>.51.,.u.w....m...9.\r-....@...!.........hC............@.. ...{/#rn.y1+..$.)M...W.1Q`.px.]..O.C..'./......h".....<..gk..'.A[8.a.!.J\i.9[.u......SX?......E..1Qme...

                            C:\Users\user\Documents\NVWZAPQSQL\DUUDTUBZFW.mp3.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1269
                            Entropy (8bit):7.837386186070884
                            Encrypted:false
                            SSDEEP:24:cizx39YFrwr7/uXMl8VLOHTARQL/jkO1Jsaj+od/qGAERfH/8z+mYTT9TRg:rawmXCWLOHMRQL/bL+a38qTTk
                            MD5:7741D48146CA20072D23D5F705C8AC9C
                            SHA1:23072A620475C1CE74AB1F4833D260A9E28DDD11
                            SHA-256:92BD4D6429C462B0A6976309256F580F8C9299671AA7032394A36D0CE57D4104
                            SHA-512:540CB326021A7E58BEB07DD1C04741180933B5CCCF2446440BF36BB6B77ECD2EF831F8097877282B2B04051BD78ED9FB3BECAB063B27A49825B9B85921C59883
                            Malicious:false
                            Preview:....j..Q....u).9u..T.....u..?..<g8...b..m..<<6....aQ}...6G..K....m..[{.q...{.q..U..b.!.wtg.ks._^...^..C%.q%.P~...K...4.`..,.#!...o.P.e..........6..u....^U.y....G......_..um.h...Te.t.(.;.e..&..d..9./*.....W.....E.yI.u..\..!/...s.%.Y...w.9...;..(Io...G.SL......#..9...&.t@.".a.c[9.........h.#%.TBK^L...?...].a.9-,.......n._)..(.L.s.|....t.....D......\D..F.O..^O...W..:..K....b..mw.N._..P.?Fi....a..).#@.........2..y(W...O...K.6c.,.#~. .....R....q.._.....Ij.....7V,.W;i%.8..:.~.&.X..(.7..pR....4.K.C.u.6..(r.o..l.nw...vy..i.rk.<..>V\..`.S%...f^ld....|.._..N..k....\.......X..g...0N....E.b.a...MG..x?...S`:IK..@m.j.{p3}..Z4.......H....r.nn&.Bi$..Q..6.<"..t.....m=.\....Z..D..?<..k.A...5o....2.1W..0...T...N...*q.B....H.a.....9.b.fX........+.+...?.M;.z.6.../..X1B......;..G....`To.RR.Bwg.cA.....0..`!qzg.R..&....^..Nn...;~...T.3T.n..).............2.....x....5.....|....a).....8=...C...O....'m.mW..@...~.U..4.....h...-..M...R.1E..O...

                            C:\Users\user\Documents\NVWZAPQSQL\EFOYFBOLXA.xlsx.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1271
                            Entropy (8bit):7.842940768952653
                            Encrypted:false
                            SSDEEP:24:Icxt4TI8TQPBV7uilHeZWUwsYiyBo0EsdNxU4OWZEqChvnl8RQoZAKCYTT9TRg:HyMJzUweyfdNxVOz3neRhZTk
                            MD5:CF4089EF6DB87AD85D15ACD7AC64FA62
                            SHA1:77506E2C940378CFEAC4F948BD1DEA13B5532805
                            SHA-256:6603DE9590FA012A12388084F321C223F25B025B6758725221559233CBF33D90
                            SHA-512:0E40312F1EA97AB1DB36DF221D1EF34465C1D00299BEEA9E1EA6E94E6359ADFF704E5C3CDC1FB6C4A3F800A1F5FDB2B1D2C9D77F949C1F787B00C45DD3437AA2
                            Malicious:false
                            Preview:.xGHa..L...R}....?.....gI..k......e.2TR.. n..3j...'3..'z..|.7.2...b..../...........(...W.z.U.TBO..B.\1..TG.A..@........>.By7..l......'qoR.*.H.$~<..h..9.w.......x...'n!...q-.K...E.yl.0..;.C...p...V..V..8W#.KJ.r...........,nDV.V.7...p.cb(8..-.fxI....DM.@....0........C..M.. .IR..YS.l..=.....I..3(.N.X.z.GFa...o...`.../..._..E..^..E..[<.s...t.e.....k..r..6.....MF...X..u..Gq.\..5C1.+B.......W..I[R.../f.x8.n74{u...C.(.?..o...".7..N.0e!...5......M^;........;qx+.t$+|...K....q%?R...C..c.......+.qu.0...\Y.......3c[.8Rb..b....?c...0v&...c9+.....7...=P.F>.. .Z...#......o..N(U..C.&.C.1.....v.r...=".@...:.O.jX.P%y..k\.6j......V ma....tU.'....w....w..Y.W..4..$.....&.e.0-..).SVA....b..>...C.....?..&...iD..z.u.D.]..~F....|Q.z.`...."(i.(.m .\...g?.>.*..h.A..`..@.?.......uV...0$.$............~.0h.0...q....~a..Yk=..:h.[...h.....t..O.@.A...4.lR.9...\8..}...]{....7..n....!%.|.oe .^...*|..jh....._..+.:.R..A..C!89.Jz.............I.O.}..'...B..r..Y...0.nK..r.n..y[

                            C:\Users\user\Documents\NVWZAPQSQL\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\Documents\NWCXBPIUYI.mp3.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1272
                            Entropy (8bit):7.871993955688178
                            Encrypted:false
                            SSDEEP:24:XZT13OiYfAPNiPxI3/TaJEOBoLWyXXDheACRNVRLc5Hz+YTT9TRg:XZ53dYfAP8xI3/qmPXBeNVMTk
                            MD5:DA8222775CD591712972AC5E3846054F
                            SHA1:6BAA7457F343D6EA1D34E49DE3944506B4F1E836
                            SHA-256:F691391B824FC5BAA44A66E5441B34D6741BC38BF12613F43F91F227E0B8A524
                            SHA-512:47D6E40F6CCF19BFDFF26A7393B7ABF7373487C683A225474559EAD6EB15973E02D1E282558D308451F63490F077AF04B3D82B468E8027BA28E1260169C557A6
                            Malicious:false
                            Preview:s.g._+|X...n.[...1.r..]......[e...I..>..^(C..>;.M"(+su.+...l.V#..h_....y.'[...E~....u.@..EE..J3b..f#/.. .^,...\...):.8.../Y...l.>u...Q.[....D|.Iu)..w..9..*.D........~..D..{.e....*Z........F.......:+.xW.B.........B..2...c..O......h.......J.>..U.I..^%....a.....8E.....Oj .m..T.izt.....0...N.q..?.1 .4P^......h..0..c_.w..6.T..Z.F..5..|......a..?F.Pn.Ga.+...7.w/(...e.s0.{..^.,..Vu..(k}E.#..;V.;'o..D........13.Y.A-2.. ....vM...l.K....r....r.... .D.4g .....^...r4.........SG.,.........[...^.X,...I...#j.>..H....<S....N...}......bHDj].SB.....!G_..`.6...4}0.;.t......J.>...6..O.9.Q.<.7.);.B.F...-....T...Fo.w....1.{8.O.dn[2.pK.vP.C...g..~L....3.av.[.Fl.S*\.hEz1....-.J.aW......fp)......i..F.Q.....@.a..=|y.hy....j..b.....T..g..oM....6.#..2.x..L.`.B.._^$.=.Q."Ox..........q.V<].%........]..s..>{...;..r..)..C..5.GT...E.W.f..:.6....`.:..q.a.Ke.#.S.V..ECS#x..X....].0U.G... +SY..gi,NF....N..S.....QY&#`.T.0..p...lu.....{..^.."Z...~.Y....fZ.....D.9.Z.!.AhX

                            C:\Users\user\Documents\NYMMPCEIMA\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\Documents\PALRGUCVEH.png.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1273
                            Entropy (8bit):7.850517508242101
                            Encrypted:false
                            SSDEEP:24:XantgimhOQJACMa9gjzY3xqIcBzVJsTV4i9+P4ZujvlkXgFqcxB6dF3Uig11H3C3:2w9JAU9WYuVJsTV4iMwUegF7CXA15/Tk
                            MD5:1D02FF5501D912E1C33BBCE9F9669A45
                            SHA1:B6CC013BC3173F7F03B5063EF7E0FB9F737F0DA3
                            SHA-256:5F8A95DF6430B2D012317CDE69F801BF5C02598684EA6DE4507A2B4F92B63AC1
                            SHA-512:23F7184EF9FC5563D706E76190E8C28EE2239DCB5513D53736EB2A42B4310AF5659D21F0F23E496FF95625B0188ADA5C8C4672AB6459C97D025701247E695057
                            Malicious:false
                            Preview:\.8~.......xE\..9..QU...S.qN~.%e..;....d..l../7....{.6.9.a.mc=.@.....FR......\.]n.U.......A..x.H..1.T..c.B..`.........6...~..?.^...W?I..i..y..|...@.qf.gEP.x.)c......;..B...P..24.......i.c-t.N..-.1.....5&.."I#7..~.+..........N {.a.......0......i..3.....A..]y..C.\.....E.....*e..\5A..$.e.l..Q.as.....e..'...&(.....C..Y.e..O... -{7.S3o....7.s..8.}..bq.G...kr.....r......O....r>E..g.oV.X.I]M$..!...eH...y`...p..c..3..t.d."X.L......C......&.E....PRa.....lCl.$..K."z.....q..G..T$..K..0w.{.....=./...%...KJ.i.].._.dx>.Y..%^A..<D.Tv.l..o.........~...i(..'.M.v.8l%...&.7.....3.\.5"..Y..]v.r.....R.hT.y..{...:S..A....V..,...=,...Nn..=..]*.5.V.......|r.q.>x....U.m.!..T.#...G.N....."..j..`.Q... .(....9.+.t,.G.:Y..3,2{....J...4..MK.C..I....q..?.....}vCK.R..C.0$.........P...!..S.Z].]Htb.o...B..1(.jr..5...tD.z.yR3..#...m......k ...l..n.;....}g.O.=.r..!.....3.g.(v..Y.(.^..x....c.O..$.i..X<..i..I{/..@.[..Hz.....;.hl...M...`Q...Qb.....Q.3....J+../.HMy....K.

                            C:\Users\user\Documents\QCOILOQIKC.png.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1268
                            Entropy (8bit):7.850846091656921
                            Encrypted:false
                            SSDEEP:24:EFdhL8KCkOw0OeCKuTqvmlGdApr1kNDE47xJdycfZwFRmsFiZmD2XYTT9TRg:SvzeCKuTqOl45NtjdyuW3TCITk
                            MD5:4491BA223B8EB86CC3A3A5A85FE2D619
                            SHA1:B3618D35389B2C5963158303850B1B972A3FA4AA
                            SHA-256:4453643CFC40B1FEE7F5FA7A3F9CD23BB15216B313EB615E43DD660B4C6D8770
                            SHA-512:E117CBA6DEDD1688E2FE350AE6E32E58E111151CB9324526FDAEE6E5CB3B909950CF4DEBE9010DB33DDB9687DEBA119C2F3FA57E7B3D9862FB61F0610A5B6E97
                            Malicious:false
                            Preview:...FU`"z...._1.~....r5..+B...`1...YXU..2...h$.+4...lS.T.).......|.-...|..........t..>..~.T..}........;?.a.o."J..W...F!G....\...wToD..r.)RT...G'.C.\..\.z.#.7.TC...|..3...4..[....E.g.Y.........wP.}75(..+.=xU.U......Q.W.c.......Z..._m.?i.i...B.V.4...7..w...71..p..../J.H...{.,$M.j.....(.nA/...D9.[P..w=...d...1...v..U....Dt.u..=,.1~L?/.b.vxlSt.w....S..*e...G..Q..t.\...J}.w,..)H......`l....H.bJ.........]:'U.L&W'..D....U...q<.%.Q.....PZ..'xdr..u.i.^GT&G.`0.tS.....Ef.,.`..v.\.sH%...9h...W.h.....co..x......_.....k2.Q.H.KB9)Y.r.P....U....M4q...L.-...l.F.G'.5../...;.V.q...I#....VaTm-;.3..B?.[.wJ.!....-...*2.v...$...cBuHO. }r.j....w....Q.}..&&.YB].f...r...'..V........G.P."'.p..$^.....3..+...@q..{5P.A......*.g..|)..8.. ....[L....41.9.,.}Z...w..7..v7]..U...........ZQ.K1.>W.!s.y..j............B#.ozW.J....=.....P6U.M...O.y..u..$.. .4..&.h.../s.O...._w8....=a..A.....!...c....=.K.b+...]...d?..e..02\.jpk.7...U.L../.xR-V...@}C.."+...V..}.U3W.'^a.0I.b..c1r.

                            C:\Users\user\Documents\UNKRLCVOHV\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\Documents\ZGGKNSUKOP.jpg.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1270
                            Entropy (8bit):7.855197236280255
                            Encrypted:false
                            SSDEEP:24:1xxcI8u58715aeoyZNHgS9LKL+6ckV61DF/vCRnUr3JYTT9TRg:1XmS8715aeHNgSNKLbYFHs+3yTk
                            MD5:F5090E3D59F81B9D69BAB9B24F919AE1
                            SHA1:2E0012C9FECB9145375959E845883C48596FF853
                            SHA-256:FB9AE389D39CED58D5BC89ED50FCFF773FCAF049E58C07F2AD04EDCAAAD2168E
                            SHA-512:D4934CB544161B28B1A9334A61072297519F10046354EB8901D472A30A84E9D9E627121531B589513DC1467832BE67A52ACD57B05306DC74C8C30ED5BC175864
                            Malicious:false
                            Preview:.R).....kGC...Q\.g.h-8.=..N..<m#..%..s}..S8....R..&B.@...K..g.G.=.wI.......~....<....7..0...........AT./...g.vS<....}...g..g...@cEff...M=/4.}..|............o4.L.3...WO.en,BN.5.._.....y.C..5o....g-?].1...c\.(...c3..J..aY.N..3..T...........pQ...wd[=. ..q..$..O..\]..R...A...j|u...zm.."..........7....!.Q.g.#....#.o......GhS.......V.o,c.Kn.]!...V6...j.]..>P....PH.5.!......gq..K..m........ Y.........../.O.......i:.)..}E...l..?......U...Q?i.Ig.jJ.tq..;.Y.sk..[.n..3....((.W..'eV.q ./lF{.;.jj.....W....!..S.l..u@.......,c .....xaH.|.S+Y.j...CAl.......JQ.2.C.X....Cs]B&.,$x.5..A.%^U.8...&g.[....h...._...6...M7..Wh.F..GN.c....N..L.,^.T....%8..c..X....<.9.O....6...I..&.b...xS'.8.~A.=[k.f......<.&.[r.....CM;....o.^.#A.hbx..[...2.#G.. |.X.;..D..qz...V....~.m_.@.>.3.a.PC...}.P..qb:P...7...-....q2.]..I.23...I8.zf}..F]M.o..%vY........y...1...K0T/...Bm..5...#..Q.a*_.c...".[. ....zf..]..3..<=$u .M...<l..pe..^..8..7#..*&....$'.....b....F

                            C:\Users\user\Documents\ZGGKNSUKOP\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\Documents\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\Downloads\BJZFPPWAPT.jpg.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1270
                            Entropy (8bit):7.845880831981752
                            Encrypted:false
                            SSDEEP:24:j668agEpgycHbl0+n5EfKu9Fp1bJTQIPTJJMTXQzBhx1RuYTT9TRg:yabOyK+Lf/eIPVJMTXQzBhNLTk
                            MD5:C5D2B8F20D8A146C21DCF3251B2C370A
                            SHA1:2DC175FB1A53E4BE8306E9B447C26A0B91673253
                            SHA-256:588CA2AC3C6542443AF21385B3697F2483E09AE51C5549872A975C802E8F2645
                            SHA-512:0744B2F5F7B1DAD48F87D6BCBCDFD0462168C510A0475077ED30453A2A5D2E39B493F9F80C3A9F93F84F65FC08F67E995AEC4D97BEF029C3FBF2FC185F14C281
                            Malicious:false
                            Preview:+Ba...W.. 6Ys!...Gt.cG..qc./...A..<.\.'........,.kw...QB...])c.....3..e.@i..#`..@..t....4/F...IYy....%..].XX`..z.D......u..PM./..o'..<MU...J#6..R.-......DRD'..evu...>X.~Y[.L..c|Z....0..v.............Q..q...g../.2...B..X..'=.....7q.I1..X.X-5...zh....5T.........u...j..9....qtX..).......OB.i.........yz......?.......UnCM6.5A._..m...!..w.>.Ls.[...]x.._/e}..r..:V....t%f..kU5.=....)Ps}K..`n.....4B........g..i.;p.....;x.....b.4.........7x5.<. .P...D..!.....Z.}.3wc...b..4..[.-..ca....IO4...%...;.M...t.....).P1.8PM<RcG..i..Q..<..s.y.......X...Zp........y..1..t.I<.BF..S.U3X.zy.z..y9.a...7....Ub...1...;....=A.....V.E.K..|.C...n7.}=.<....b..J.6....w.,/.......I ;e..a.Kn9M..P."?.1.H.*;d)O...yo.>`M2;%.XZ.>.i...:.A..QN&z?..B..".....8...Ki..!4gMH.'...Rn..o.:.9.F.6w.~..1.:.G.xj:.............e.....B;..-.r/.".'....$$..u..-.,qw'.;S,...Y.>*..Y.._ .9.bI...<(.I.uEO..J.<..x.q.@."=T..:B.:....._..[.SUI...Y.G..{...\l....#(.F,3.\..B...W...nu.FX..mn..n.&..A.2..

                            C:\Users\user\Downloads\BJZFPPWAPT.xlsx.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1270
                            Entropy (8bit):7.846294331370296
                            Encrypted:false
                            SSDEEP:24:LfHnW9sGs05+kzNR4X9hFbkJQNmL7dgrfzKY9mm/lfPEYTT9TRg:LHasqFPwQJYLJ4mdpTk
                            MD5:40788D6C73FBF0D8A9B66C639953ACE7
                            SHA1:8DCD0AC625FD94E7BA21C5CE5992AACCAB2B4646
                            SHA-256:5A1C40E9D1F39BECBEA53BB2D617CFD3E693C4281C585EC3A9C1ADBBA5B453CF
                            SHA-512:44A8B9C74B21694604C4EEC170EEFD46B9E381F0B4C8461E217579067137EA6685F836680B57DB61861AC52F88F8635323A5F59F1DD8D96B8BA28BFD631DBB61
                            Malicious:false
                            Preview:/.VyC.Y....#.<.o.UU....=...ms.........&.F./....<....^...6.%.....+..m.}!.....S."...;Q.K..^&.#....-6jo4.M...Z..9v....O4......L......d..k.N...4..KZ|...t..i.Jh./+N....y.?....\!./...L,4pM}.._.......D&..i...m..<.."[9S........y.....t....O..o..).(..8..s.S1.%~.i.y.(...B.6...Fj.{..q K.c..R...A96zl......yD.F.....r.Wn.Nv...U.....0d(..|U_..".=&]...s.@.jCw.nM..asKg.V.@..QR...e9.+..sw...H..M..Y.{8..$y......[^V"#`_<.......b.f.I^4iM_E..$..J.0........l.X.R.A.{..A..[&.>.......%.5.1C..7..f...........}U....9..3..N...:...mh./....Z...49H|..{.#.p.....P.=....j_@|.LG...8...B9..=.o..e.4.t...Q|......e.^....j.AG.=....;.].)3w..z}Kb..;5c..9OH|...*Wt..RY...X>$..#.1...V.....jc...m.>.9..#......x..h.<..R..."..0........@U@.....j..U..j.`....&K.h..j.....z...')\...)E.)........il<.y._Y.d!.:DQ.S_.S.|.......}J......L..RjPx/8....9?..7L.[.....\A.....a..r....q.l.m_*....u.G.....`e...=...`..d.....d.P;...ROV..a9.V.a@...jM..(..4R.F/....}wa.a...h.... .......m..<.=W.w.yDH&v...s'c..

                            C:\Users\user\Downloads\DUUDTUBZFW.mp3.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1269
                            Entropy (8bit):7.835753854217582
                            Encrypted:false
                            SSDEEP:24:FKcScQgGGfvwAhkMEejwsyxHDbfW1iA1P63oGCmHzZmYTT9TRg:sXGfIo9csgvob1S3VCmNTTk
                            MD5:B7E7F981B7CB11808625C2FD3F3EED8D
                            SHA1:C907B0639BEFDAC0967D99E1CA259BB18BF02BE8
                            SHA-256:F97F967C812C8D7F0B2663EBA930F100D6450CF17F15DA32444AE8ED6BF5EE2B
                            SHA-512:19C34CE890064902E33D6508C9C3EAFD742EE86A6A5B4FDE540200E81B7EA67A6C764F552603CA5CA0A297D6BF4D518C786DD05E5B357A9D0EED3A8C83932857
                            Malicious:false
                            Preview:h.....A..U.8..P.#O.w.k.Y$......6+.mB]..u]..]...6..........U0...\}..$..M.....=!.....^M.R}-c..U...g......v...a,!..^.Q/....cC.*vQ{..|QX...>.?.K....o..F..4..&j.#...\<........._A.l;+.3......p...n.!.."L....^..CPD.i.o......5...b\?..P......MoC....o..y.k.I...U...e....^.q)o.......}...2X..&."...y.Bxj=r.GE.SS8...'V.1V.$..g.......y.:.\c&K<....ia.X.....h........R;..tqco.Q"..~..E...A..:o..Ir...gTi....d...*....g.-4.....1uh.z.u.l.......<..$..6.T..c;.m.K.u..b...1...z......0<*`u.. Qt.`....m.....9.....%0.@.:.t.f./.*{O;...*!:...sD...+IAP.6......ls.iP.:bY/..6 ..yu...#=...+.......5p]A..K.....=.L..[..;..O./.%.1........k......o.G.ax$.f. .h..v|..1..u..X..3..ZB.....K,.fJ.@u....$.....P`4......b.o..X~t..4.E....I#.........@.(..W...9...".i....fm..`.T..9h....f...gQ.4..G.$..(.}...P....5.Xa..7.8..e.......H.im..|'.....p(UUI..'~...+8..:.,.2...Q.(.& a.....'.Cm..f...i..&l.a.......a.u.....QM...,.z..b..(...m~...'.l...-8"....`f...;~..A..R^..FU^...&f.m8BX...k..b..C..,......`.c.#.

                            C:\Users\user\Downloads\DUUDTUBZFW.pdf.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1269
                            Entropy (8bit):7.854873173383014
                            Encrypted:false
                            SSDEEP:24:JdYwMBtod7aGDm/qVuQeRG+6AW2HhDduxu+wGo5dv9gzz0DvACl7yekfmYTT9TRg:PFdjmyVuNd6AWOhDU4Z90z0jl7yeqTTk
                            MD5:445F088523B1F22F9154B893A4E43B81
                            SHA1:D18DD64E70A2E63C4D23DCC43DEC17E02D0D2635
                            SHA-256:39C16626EE1BB7A316FF494DAC207F4D2CF294DB4A3A28864B8946D50CDE9262
                            SHA-512:A7D3BF105670153F37A364E494735C3146F205517022449BD5FFAA795BAD99AA15035FC6EE60E334FA8FC8E5A97EE94020D9BBEEC67DBCF9D0EEF68C91AEF396
                            Malicious:false
                            Preview:e'....%.Pr..th..j.v.p..s.U:...tH.@._..U[.# R..}..i..+=....n....,.t.LaJ5J.e......S.Q.Fi...qV#R.M....u...WA.....^.....)^.*";.........r*.%.....td..{Z+..D!...|.Y.=.z._.a..Z.{?....'=.i.z.p .'..[MK.."...3#.1...t.......k..T..f..yk..6L....N.G....).......B.......[Y)...........#...fh.^.@Pn.t.].rC.'...}.d.\.D:.3.N..c..Vb.....0..)..D... ...>..i+..J.....\(..p....Y..........IEN.f..V......`E..7.....SH......-.W..-;r.Z..,.|..w.....tbD{....r.7.y..H..#J.(^..."..U.S%.P..b.."..6$.Xn.g.......!Tv.*<.DD...3.Q.B.!.g.R..((.G...j.........s!..h,.......B[...1..F...0c%....T.....A..2..Y...t...w-.jK{.*....`G..`..{B..I.....cu.m....ZP"Ap.T....C].?.P...B6+_.*.[$d..7.wanN.<[*.y.-...b..x..%....c\...#..........;....PR..T.....f....U....6.d......(...pf.9.....k.<$e..%r.G..(...`6.)\l ....qY-Y...F X. j]..AiJo.*.Q..-.(..h.B..._.[.1/.`&............Q...:0......E.....,WY..x._x.,..U0.t..y..J..B.u.wy'i...]>......|{.S...!<..Df4.b.Q?F....s.O.U.E.d.b..z.:...c]...Dw.~..u.)..r.|82....`$.l..fCS.6.d).E.X`

                            C:\Users\user\Downloads\DUUDTUBZFW.xlsx.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1269
                            Entropy (8bit):7.826857393433326
                            Encrypted:false
                            SSDEEP:24:lWJ6JZyOhToMhSxeNpa82gFfU0XaWtH5v4wSTTxARsusmGgF2WmYTT9TRg:lW8xEMhSyahTeBs+FXTTk
                            MD5:8936E2A0112A0E6433ECAD43FD511F30
                            SHA1:5016A0ED36BD282862212C63ACEF03D2AA2D4FA2
                            SHA-256:3EA4A259E6DAF71F61610137C3DFA1C54A576746C7BD6E131A80D3DEFC130009
                            SHA-512:4893F178BC1B97601B100838129019AE7F2F1ED26CA0B2B9F833D4E15DA21038E1F868518A87531A1C7C962D04763509741901054FA71EEF98127FF3F0A721DE
                            Malicious:false
                            Preview:..c...$.(Q..d.d....(...UJ..y..>M.,BU...A...DJ.B.......4.....,.?.1v.....+.:.\f.....t..@.#G.......>.....1...E.|.B."...Z..'....Q>.....B.B'......M..1.u.>. .]..T......7Hz..g; )P.:K.d.b...[...2TY..>......>?.x..X0..~!.............(s..-....{......J.....G....;u...I.R..N@....;.*...U...?^.....[.!..he.7.C=PN.v3E.c..2....W.`.D..b..C....$j32>a..:..M.(..I...&.Au.(......4)...km..C.p..a.s..t.Y..CP....N......H.h.ZD......q.2...s.........x...eO../...T0]K&.p.=.c.]@eG.R..t|.3.3..{..l-..*..n.:....8..G,...A.w....'.F.k...=.0........P..D.'.........u<.Y..H.*b..H@....[A...D..@C<j...B.E&.r.t3...V.I...)....j.e....#...kU....0..5_a..........s.A$...|...."OD.f.....6A........`........v.e..t...>J..Vu.(......e....!t.....:.6D-j.T...C...*]....R../^ ZU..qiMgH......w.......p.C}..oq.^L4..5.TJ....|.(-...d ...Ug{|>6 ...w(....Y.;.y..`"m.fu....j./..Ec..8....c...B....f4.7..V..j..<c3.........-4...&?I........&..<+.....]f..|...5...k...~S..k...Js....AjZ.'..........d<....w../g.,..n22.0..g..

                            C:\Users\user\Downloads\EFOYFBOLXA.docx.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1272
                            Entropy (8bit):7.853135817374965
                            Encrypted:false
                            SSDEEP:24:VsnVAQgGv4ZQznewJh+1QBuEoc6y30J5iqgtugmc9EYTT9TRg:eVAgv4Z8Zcu6y30J5iqXgmqJTk
                            MD5:B552A30CFC56A1644FFF45ADE0FFAEA3
                            SHA1:7E1AF44D92792E2DF499279826DE3740B02E1CFD
                            SHA-256:DD199553B430E24CA38C6B8E118AA69F4DA9A7DA90420A64945C89FFB6803242
                            SHA-512:3D33CD8E3CAC47B31E108E6E4F137C20D0A8E25B95464F00C8481CAB79FB856C940474AE9E208EA5B0BD64D545D630C6BBCC84779DD9B77D9D69A17D065E2B69
                            Malicious:false
                            Preview:0.w..$&Nu.(.9."Y..ux.0..>v...$.`_`..'4..b.8.On6n........!.<}....%.*.K..FV2...J.:.Z.$,;t.qk..).gM .G}q.p.0.H...q..S.T1<... =.|.....3?5J...2ao..}..2Q|...IG...iP..i2>$i...o..vW*59.E.o..t...)....i.)..;.Aq..{[.B...85.;....%.u.G."..i.t.~..S#!BJ....A.}...Z...Lv.............I.x..vv."H=Z.t.. ......J.}}.+B~.p..l:.s...^.e.....#e.&......;^...Z..Q....r".....ma)..&c%...w.K...B....!.Gm...:K.t.J..2.h...4D..[.1e.~=.G.H|.Q.. .;a.Z<&.k..cm.i..q.,..+...g...o.........z.p5....$..;8W../..(..<a.............H......v./.ik...P.0..+....e.z..0...........w..._....z....k...+..b.....Z...h.r...}8..I... VR..j..-}*.O.e.kI.l.uR....?B...*pO".....svw9....sL.uj.."X%....p.{. ......Gz....,.\i+tD9...........h.....7..?.c.j.-..........J.*.S..+Uv.2....!~..|...*...*.d. Yb..=.....Mg.+^?.%B...3....7Da^.1.B...#A.... .B.&...9..}T.._....,..Z...b.......rj...O.Dm..O1.....!u...._].....\..EK6..d\......X.K.....[*,......4..C.d..l.lM.B ......[....M.p.nkv......C..U...E....j....b^.z)Q"1..^.Z*

                            C:\Users\user\Downloads\EFOYFBOLXA.xlsx.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1271
                            Entropy (8bit):7.834268933386361
                            Encrypted:false
                            SSDEEP:24:hsK9zezaIiqPTqktxLYZESSks97svIgj8hQIf1b8YG8ClzZ/YTT9TRg:9CzpiqbLrY7Sks2v4bfd8YG8cGTk
                            MD5:E46D50F8C72CE72086A87D356761F134
                            SHA1:F4129026FAF35F95A8ADF83E2FC17B5AE43D5BCF
                            SHA-256:1807160D4511DD67F921234EF5A9F152C9164F3239256D4456E5582C88519ACF
                            SHA-512:51DC88A26AFF89635FD839B0749D0C1E2B1CE9D030D65C6EED4D556702A1672230E23224088001966882741C16298A74F52D54F18C0C32B6B833D6855483623F
                            Malicious:false
                            Preview:6.....-.......H....]-'m`.v.{../3.Z..<i_.g..)....3...%..t..QV.*..j.0....HT..C&.Q./Fu..E..Z....o,...5.ng..H...:c.YX..LWj.Mp..>;-......A....+n/-.0..ih..bK....3.3.#.F.QC...'.......V..Mm.s5.6I...K.2...A=.I..o,....\Nw..,.NN.......8~.t........d.do...a{W.....^.Fb.y]Q.........uQ.y{........2L..[.+.t..r..G.J.....[.............a8..A5\..s..6D>"E.v..Z`0..Wb.K..\.US|....Zr...3.....u.5.j.6..'h"n.\1.S.r...XX_*...+UDv.5|[...~.js.Y.=.}....7}["c...Ix......v....6.h..l....@......C.........{.n.t$z....%5.:y..w.T..[I7.Gw..X..V..J..`..!.6.......6..}.7...T?.9Y..F(U...D$D......j......r.]qO}=].V....l.A&/..&.D.........x...%g$Pp..J.....Y.n.;.'TE....~..[.e}..b..F..g...]....XN.$0ZQ\.0v\...`...g;O.....q...0h.!.}8...m.}.:..& ..P.3.i....u....=....A}......I.^..f`.X..5..8..-.....".4...,......0...~.M....4..Q.....)..}........Ip..'...n.<...DH.X..5Ws..._$.4.wh.L..(....I.@..c.d..nj?&.+.._t...`a".k..G!..}."..H.T..9j*G..l2cR....R.........@.y...\nSe..R.......a2m.....

                            C:\Users\user\Downloads\EIVQSAOTAQ.pdf.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1271
                            Entropy (8bit):7.839519494317456
                            Encrypted:false
                            SSDEEP:24:TjNTa1FeE92PjCmBoP6ZXe6Ppj3FGt1FB2moxxu+arxw7r0JYTT9TRg:TjNTab27CxvctFGH2lxxQxwBTk
                            MD5:D54CFAF079B3506698F518C9FA6E0104
                            SHA1:5D21EB6A48ADB7C18C5C43AC5FC91DC1A7FBB854
                            SHA-256:AE5244F3A6D016E09C4795B65EA05CD1A04938EADB11F4F491CEFC2AA76FC856
                            SHA-512:511FC49DE9CD16ABE794BC03A6720EB99347C09A0F0BDE4A90771066360E32CC36DD7A62A06EFE2E6D6D2FD1D1E1C4642A03839EA453CD86E5EC4DDB594C0626
                            Malicious:false
                            Preview:....(M.z.6.\*...k.m...3...B.fK`...1.......p.....`S./3s.]..6...(...&.n.o.....N.O..Fo.....aj.mv.A...a...oVM.m.....o*?........B....V.pP.F. .oH.V-......zW.n...V..z...|.;.mQ.%^..Y.h...l.QL...Y.Zz].....Y%..<..q.R........%...R...>*.r....0.A.!..[.>p.i~..<...hM...K..5%l|a.o.L.,.G...'m.....3.J.'I.../.hr._./..........g.h...Y..#.9_Q...-}..h..U.2...2.....d^.N..Fjl?.pji.....J.....Wk.L.Ty8...).....h.j..>.vy$.d../.G....Nz..%?..4B.S....}...I.....kU4.{vq...Y;.l.l.6....l]Z"..v..bOs.....f.fG..QO.}`...Uz..k8.J.e..6rh...{U.....il....5L......AZV...nk.&.=5+......O...Z"b..u:..CY.!a....[.....#K..]...c...=hg.8:f.4...z...[..!]a...|.....d...X6.z[...mf......R..0.6e.e.G.T2H...F.I#.pe..S!.ZZBy.j....Z"...K.P.)...#...h.vV..D.h...D.E?.-c(..~a....8..[Y.........>.._s..ZR.....Q[7..z{..-....r.L....|'._....0....zc..f....mB..c..1...]hz[i.;...<a....)......e.V.)#......_#..V*....N.F...T..................}u.w.IIh.|J#.....^......cPW..%a.s.,.^tm.h:...R.j..U..V?}QQ.\...

                            C:\Users\user\Downloads\EWZCVGNOWT.png.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1272
                            Entropy (8bit):7.847922502414519
                            Encrypted:false
                            SSDEEP:24:8FnOWQYa0GPT2j7cW0r6YHrsy1RPJXBdWqOziOWEJGQCbtlc9VYTT9TRg:XFYK2j4r6YHAy1vXjWneOW0GQCzckTk
                            MD5:83AD018F5083F9BD25998F34E41ED3C9
                            SHA1:E2993D0B74F2A05E5D67E31B606A1731B42CA0A0
                            SHA-256:3054DBA9B84B3962FA60DDD66BDA1FDA96AD896B70310550047F9562F5954A16
                            SHA-512:59A3702E03F47D3AE2CA22F5AF1318AC8927B1366A8BF561262209F7C9062B88C2D7444596F367B199E949B5FE6E8FC57FA18D557C6DD694D1CE5F481D4BF6F2
                            Malicious:false
                            Preview:.x..3..>.w....>.q.......H...Rmd.A.{,....p...w.........R...E..-.n..{>.%..._.*...m.=...z...6P...3...U...^.M......_M..$a..Hk'.A......`|....Ogf..".b..x<..0#.)..D.L./..rQ.....Q^Jq...{..Z.5.?i_h.n`E.....7.?..w..K..>.7a...^...6..k..N;..a-..W.@.[....~.)mJ.6..1.S~W~..bV..FE,...jlP..r@...LI'.$.@P.H....T..26...y...w~..O.| ..\J.W.8..n.,o....;U..A....z..F...F.Q..{.S-.X.+).:w....3.HGz.A+.!...E...../h.k.=.....C9.4.pc...\...,._$N.R.....[=G..VU-od..+.D..e..D.....A..(.a?.g:.d.^.E_p.')*..Tc_..".&.k\O.%.f". .......4.I..g....lZ.....&....{#.....r...mJ.=....O1>.F.....Iy..Y... .@+Uz..!9z..x.)K/j"j...34..~..3...pB..q..z0*.8..~./.o.........S.A......~...._TsF..../....[Bhq...............,..^W...<..a.AM$}.c.V7..1...>.]K...T;......1...D....]p....S.....B-..AY....w9.6..b#.I7.1h?2.....RWC.(.jp......4...*.......ZF.W-<w..0VzU..oW.r".p..%... .q.t{5z...;...._._xW....4l+...i....O...X.......R.....jt....V.o<p.X.r.r...+./@...4?..;k.F7#.fyN....bQ.c.5o,.p.G..6W.T......(.....

                            C:\Users\user\Downloads\GRXZDKKVDB.docx.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1272
                            Entropy (8bit):7.822122478758556
                            Encrypted:false
                            SSDEEP:24:RYxCYdvEeXsMz8r5kPB0Ae/6BCHkQ5fV1C0jAm7/k+BYlCN3OgcqVlHZXCYTT9T2:RYxCYdFT41kPmAe/6BCdt1xjAmg+BYl/
                            MD5:6CAA9140A7276507A2AF9CE4B8D6BC9E
                            SHA1:3AF30CCB786918596459AD754EB13658D4CA936D
                            SHA-256:0931E98D3F6F3E1FA57765667C0A2666DC001C14710080F94A104353DD80B47F
                            SHA-512:EDA7B209F8A8255D3ADA6A8C3BDEE7A3DB68499AF4744E6F938D19658B4F653392F6612DDDE896E9EB79B5859F0E3993F38663015F5BDF2CFCFE8F9CED8D0B1C
                            Malicious:false
                            Preview:0...5:I.gG..t..W..}.W#....,."sp..a....r..._....M3.@..9.T....).Ik.`h....o.."!`=.|...T.0.. ..n..+..)`.Y9...z..l.. 7..=...B.q.3C.g..vn8..m8.kKi!......o..M...o..;G.Ou.."r..d.2....t/...&......iH........(.X....a.R.W...Hq_o.S.{E.._}D..}[)..1.9pf...$9.e.....y.C...."i'..c.H..rXy0...HP?N.}....I.r.X.S....:..\.:.,..C.I...m|0B..M....}fY.J.e3(.]...tmd..yj^{...>.ff..U..xxA...7....$;..ks.O<....[.1.t6........G.W..U....dN..8.....f*.......N......%T..)..4....wN.!6...^..).r.>.V.c...>..$.L...V.s..:..Q....._..m...o..d...}......P@l.xZ4...9.w+.,..>...0.9+w:_.e.o...e..1...,..E.......9$G<....FTwl..do............jiE.....Bh..YY]....$..uC.D.a.d=.1.e..[.!R.wlc.#.....E.....5..M....w0Ja\.L`:'..`............&....I@..D.z.{...{u..R3X...A.N...dl...%..rax.B...#f.+q..+Q.z./s.n5/.T.5..U.B..mN..w.L..>2"[..Hp.E...7.'.....`P..".A......qX.VF..q=.."f7-...&.7... L...3..O]."n...i..>qj......}5.........b..+...[P...s.J..:.Y.......8.....{.P.....F...M....k..,.n....V.^1;......{...<...+

                            C:\Users\user\Downloads\GRXZDKKVDB.pdf.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1270
                            Entropy (8bit):7.8232171133162085
                            Encrypted:false
                            SSDEEP:24:w3v03XHzrObMaC8RZP1TyPl7VZME9sD3VstmZKYTT9TRg:Qs33zabM/8nIPlV6+iFemhTk
                            MD5:3C0C9ED834E1452EAB9D5BF0B210138D
                            SHA1:91A2F22E79864F9C390C11ADCD943F27521B219B
                            SHA-256:2DE30C58581F082EC7E9C30145B2BFF1DB705AA550122A1EEE8BD0E8160BD9D5
                            SHA-512:14EB7D36C73020B85BA99D25ABE828D6DA5C55EDE2A75AAF863674B8ADE6C498A33E892B50F2DBF90027C58142B390E83D8D0ED824AA05546EEE8C295A4396EA
                            Malicious:false
                            Preview:....-.......hx%.a....L..*..g/W.-3'..Q>H..."...Tb"........9.....TF...@...U.E(J."a...?.I..e..."}.84U^e.n.H..77.......I..P..wV.$9p.Y.W....j..Y.......C]/..m .JI71.)..._....m.6..3..^h(|6...H....!M.9........j.....:.hZHo...K.A.SU..m...,j........h..2..N?....@...S..........R.....^`%..9X{.j<K}~R2W.s....5c{..'......."2..b...h.... .-y.R....S.3I."A.:G.^...._\.^nK.:..j.y.>...&.....WO.).KI.N...8.`p...+,.._....;..^..JXU.~...+.y..[]..;.wH../.$.n.89...|.6MgBoRZ..v..A..0...u.....3g.....H.v..r.1..q......!yB.a...w.D.. ....\vuE@9..).....R...8lW.H..V..S...-w..O6.....OS^mK.a..G..8.X.mUE......@.n7....T...D...TY...AM..`*.uX;Q.X....>Z.....Q8.....l..7*w.,..Z.n%.....7.`..;....}2.2;......,....F..y.........d...;..U.vrf...}...4.)...K...H.r"...p/.e..1...5..D...d...%|..hA&i...j<%'...{..'R..'............~q.T'...q;6.p..C..H*.......*..*..%N...m...._FL.!...A....+..9bPE&.S..r.]..O..AF.X.#..........;..AW...3".m....l1.|I.N,v.s..j......cH].*.`.-@..#...._.s.q.3..y.^*...0..pL~..=._./9z..

                            C:\Users\user\Downloads\KLIZUSIQEN.jpg.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1272
                            Entropy (8bit):7.865916334894125
                            Encrypted:false
                            SSDEEP:24:FgVsr+nXcDSLENZeKs6JSHALm1mCjOAkJh10vFYTT9TRg:FXgIs6kgLxC8tTk
                            MD5:F9FB9394B19566B084B7C9C9217C237D
                            SHA1:15B91748CF74C2AE3E2B8D9633D488EC6F9EC943
                            SHA-256:CC6E79B34A087A42C1FFE0AA8FA395E41094F9DF4B907D5CAAD8C25538FFBABE
                            SHA-512:D2377F640148980B57AC1D3CEEF2C462B8BA6C5CB19576605E0310D2F99BFE1975AE0C5B7C46947985CEEB8E131D23A4DA14BC8146B2265C0550990D4665072E
                            Malicious:false
                            Preview:....(.f...y..Qt..5.<....`:.?.S...s.1.w5..6;.W......^....,.+.$.]..#v.9T8.CS*/..+.'.;.K....L...........!..........O..S...xE_ZK9...8d.....d&....G~iu....@..9......].L(.0*..NV..?{{....*SJ;..%....X....\~.iv..U..%[].c...h...).v......8.b .o..n...%o.W..DvVUX....jA.qK..,.)]....^......H.8m..@............<..f.T.\.I..W.a...W...h.u.;.&@^.9F=.*..7.........LS.3..A......V.....L..ek.7....S.g....../r.S.".j..0.6=.B.f".....*?..._)b@....{C.+...td+..tF...I.F. ....&,...'.T....KJ.o<..n....)....auax...A......zYU...>..5.|......kD..WFrx.w...3......4..Bb..N.bN*.r..C_\..2.,....(.&..R.b=-....}.....D:..E#7.. .k&..d]5n5F....#...+.~.\.o....,....Y~M.Kg.....c.*p......../..z.5tk...ss....FP+...5.b....b..t.&..3...../.Y.....T.....CM...t.j8..`.0P.m...338.F....Sm..$5.rJ-.y.0........c?*JJN.i....V..I....iD.E....K.&.~.3d..E...r.\yx....,....Z..YE.....70xAX.....4...Xm|yP.o+A.L....J.ee....J{....6<H...Yh.3.\......@/.m.aM<.h........c.....]-U.1...I.de[q.....c...+.....=x......@-....g..

                            C:\Users\user\Downloads\KLIZUSIQEN.mp3.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1272
                            Entropy (8bit):7.8421210734087134
                            Encrypted:false
                            SSDEEP:24:Zt6ozIQklalQBSd7OhURaHerQ2iPYVEU1aK31EYTT9TRg:ZkoMQkuQBs7OoaHeUuh1aETk
                            MD5:34F43530858E463FD99F4CA4CA52A8F9
                            SHA1:D9D57562DF612056C887BAED6C5E0C5542D8E7F4
                            SHA-256:7BABF416FF2024ECB5EF820C194C142866ACCBEE3C8B36495FCACBD33AD96A86
                            SHA-512:CEEAE3960EB6C9B8D0F79A187BDD39A9179C54228FAE8DEFA972189721E46E0A1697DEC8E1CBF93F1AAF4A8725C5548C34D4465F816C2C18331E16CE6DF642B6
                            Malicious:false
                            Preview:.>.)XUTp.X.A~h..V.K.oH...H...Dx.y..Z.{.;VV.."@I.{VjG...X@r(..mo.....+........jZ-E....FB.....v.7W_...-...R>...%..N*..Nhu...6....0%._...r...W...}|7uQ3.p..M.1...qw...Or...6@.m....W0I..)..6I`Q`.!..-.T1.8......`.......L.g.......d.=..G....Rta...1...F..K...4..Y.r.._..F..k...c.....]..#S.....3..D...Q.#...I>...9..{.",Qd.*.P=.......D...Y.....~.=x....."...........3D_!w....]#.r.E..]..W!c.....j.....mz.s1.RoZm..Y.....-*..o..i. .OSma... .N...v.:......... b..s...*....E.(...<...L...:q.0...3..[.}P.%.....e.m1L'wP75.)>.........v;........E.#m...)EC...y@..u..e...5|^.:..S..J.0D.<..|wjj.m~.<..b..<....V.P......../.WY..i.,..$YwO1..H.....!.....?..-..I....=..b5.,...,..NUDt.=.>.D.>.P.x......L.|.u.....2..,,...h;..P.....C....J...d.3.}Q*.U..f.Cu..m.......!L..74.<:.t.[...R..V.D>..u...3..x.<.f.O...JF..,<\cc!.t.*W.O.8.4..@th...Vf..M.~......^;....2..!.z.\.?yY&i.'.l...0Q..;.6.M..........|T......o<.9.^?..u.km.......a.l...|S.F..T.*...T.D.7.'^....@..Lq9h..N...d.h.,..G..vF.~.|1_

                            C:\Users\user\Downloads\NVWZAPQSQL.docx.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1274
                            Entropy (8bit):7.8470060811289235
                            Encrypted:false
                            SSDEEP:24:B0yFBi+HndwPEPYn1ct+g2EludY5JaNG7u+/nflfFjYTT9TRg:B0MrH+P6Yp65xHff7kTk
                            MD5:8DDCE6A1E660E0541305B92DDEFCBF62
                            SHA1:F20E221DA289259578F51393A234BC3B1EE64470
                            SHA-256:1D7BB6CBAC487ADF4248E834CDDF90BDD77611F6890F6B90BCDDA37E633CCA92
                            SHA-512:AC7E8CF95C3417A310F956E48CC54984E6C87973BCB3ABFBDD9B37DD92968BEDE3BAE4984C28F3E1875B521CADF9B30DA04416B1D7D17ACFBD9A191345321C85
                            Malicious:false
                            Preview:-[T~.k...dg..fn..K3.6...&.A.a...*..Tt.L....@..Q...;y...GV'........KrC*V.%..\......%....-..z......y.c...I.-.:....~.8J....L+......aN.F..A.P..o..qf.Un.P..5t.0....[..j.N.....4.1..[..a.Y.....O..,.......b.0.4..a...,..h...p.!.TX....`....#.|.1...GH...V0V...!.2..vB...,......7..3Z.....?.wp..h...G.PvY\....,q....<i'gU.....y:...x#.s&.Q...p...."~z.@u.S.U.!o.?.!...4.;?>... ...v,...o..'r.e..m.._e..n..PN.K.sG...].......gq.(......O.|b... rAJ..J..P....Z...vIA.F.,..D;.k.?..jO.C.............L.HL..N..c@hR........4....3....E....3...../.R..p......If..WO..N..C).............<...%..^[6Y.....V.`..M.om......k..u......].D..|...?1.Wg^...@mB.. ..~BJ..U.o>.v....H .8.........=......X.../.e..mFTwm......!...F.....y...p:\......i.......`S.5........wj..Fz.e5N.R......nn.Z.....e..~..w'...b.y.+.....%...!H4..)....N..:Rc7.4.y..-1..5..........<.........BZg.b}...#'........./..5\...M..=c.8.Iuq..;0.*...vn..b..J.....b..y.i.p..-...>....v8.......u.5.....V2..oK.........n>..1....

                            C:\Users\user\Downloads\NWCXBPIUYI.mp3.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1272
                            Entropy (8bit):7.851807656765154
                            Encrypted:false
                            SSDEEP:24:Yd+Gk+/CXGFG0IVg8N4BGG6ILh5JTs8Im/avioLn5AnxYUKYTT9TRg:YMGNqYg6HsIipWnxYoTk
                            MD5:AC0B6801B6918C011303119747B124D3
                            SHA1:56C8B29F9B115B288C3114E0F656626083BEFF32
                            SHA-256:7CD046537CB7A8414BA114561BDC6D0F3A75129A812E7BE3B89D57949A57EC7E
                            SHA-512:7B648F0C3B8AFBE5877CF5B33405FF98097F6D7822BC49BF7BFC553794ACD47C1270EE1B45002AF3EFB21D8C7D00ED26B50BD07253A628338D08EB2A0640C5E7
                            Malicious:false
                            Preview:ZtH..JC2.K.W...&.9.^O..*)P..`.C....9...5E.A[Z...x..EL...x..C..VA..O.......z.%..A.fM|...T...'..P....S.....ZGy.H..//.g.x.k..X..e...i...CF....P1.V$I...4...<.....V3<./...U.l..../.Cd....P..".... .....q.*..`8u..(i.....s.....-..g}..)..|.u.<.?.|..(.......|S....k..px...v.T.<%byK............p.. }TM..c..y...T...]........LsP.7..Z{<W...p.~GI.^.M;...7...1"). 9.tF..8.y.Y..q'.W...<....p.p....[......k..`.&..Q,.gv.\H...5B..YVC..N3..C....-q.ks]~."..._Y..P@,$....t....1...u.C'...;...8.."......2`.69..@..aX..@..S-. ...^.Z. .e.Lu.pA.!.....osU.".p...P>Q.R....j..lk ...y.I6...#....^......k.n.......w!"..{y..J.....U.J...Vn?.. l....."..b)..........Ix N.lU..7.B.X..;Q..l...ufV......K...Z;.=...f...T..eD.y.p5.........;..d. .o...~e...n....S..SSX..w$.k..r.....3..M6\.C..o....`\.......6..o^..1&.h..E.=...S.......r....r..R?..^...e..@/V..m....y$..K.I.+;.HYlx.G.T.R.+...<~Zn).2.TFS:.C8.|.9...dz..M..Wv.........u..+OR$....1..T.B.Q3.3k..8.i'].....s/....u_%........T.......OQ.A.$.F.k

                            C:\Users\user\Downloads\PALRGUCVEH.png.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1273
                            Entropy (8bit):7.826597581432139
                            Encrypted:false
                            SSDEEP:24:yVwd4cs0kuGu9fQtg+81y4FGJS6s49FCd7H3Nwdfvh26qwKCPpVyEYTT9TRg:yV+PknUug+/JSB49cD3gf5cCPpAJTk
                            MD5:0D45428165692A410ED2264DD4F43C26
                            SHA1:DAC03DD898FDA6A6B30AC3453E21AD20516CB972
                            SHA-256:D3939CE66817462F56873F21DFE958AE4490D00B080FBEB45B4B1D0122135EE5
                            SHA-512:80CD19CD14D186DFCD11A5778DF6088FF90D024FB527393FF7B70113BF71DABFE73F6DAF3B6E789A30AC51DC11A375DEAE71B5E0C0E312262831D314E84B1F8E
                            Malicious:false
                            Preview:...d.H.4......1?..F..5.t.>a6.,%...d.....VD{...N.U.~.....:...e..PN.`../....#$.."s..}..S.....H......P.V....IW(..]A...t$.yDE'..(.g......8..:.).l...M.xp. A..1....R.....@[..2.........0K.^O..B.....H.zX..0..N...7....Q2......hu.Ao..'..We.We7).&.o..?-....j..d.~.._.X.x.Z.!..X..o.-.vH.\&...sFO$".\q.#.)...2....e.[.)..S..l...d..V.2.i..._.+..Bnr.y...Bgj.R..$1S.K........P..F........s+n'.<.i.1o9 H9.....|.....n..b80..k...76Rm.q.k...U..2.9..6....(+...9..O.0....z.Z..%..S.HU.....ry.-..f...a[.....e...^...".R.E~...R.H....P.|....,..W...OZ...j.b...........s....X...L...J.s..a.k...6\(.c..N..i25.c....*....m...1JF,YZ..{.i~j./..J... E....(.a$R.o......*....F.vUN.0\R.2H.....%O1..c......N.D{.u.L.T0.2C..K.]+.GO.F.z.".?.e...f....e\...\....3+.20.........dy.e..c...:..O`.?\.....>....Jm....8....v.Q.../....\.p.?8=...yfs1....6.}.l.......Z2..n...f.H[.vP.,.........e8.........F..cw....Tfn....\$........0.Y.PoP.2.vz.L...m0!...,..{_.P.Bo....C_lSq......r@$.l)W.Wc.{..w.^.0&ce+OF...M....a

                            C:\Users\user\Downloads\QCOILOQIKC.png.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1268
                            Entropy (8bit):7.83837159398364
                            Encrypted:false
                            SSDEEP:24:I5OZ5+c6t3nIF1YnPlyBSre5IpfjE3d7UtS9EZfO3e8xaBut4u6hAdYhhYTT9TRg:IgH+c6t3nC1GUBS6IpfwyS9EZfYnKGdu
                            MD5:A7554F5CA03CAE591D429DBB98DFD21B
                            SHA1:7E1D90649ED74189F2D2C0028F02645B957BEF08
                            SHA-256:FA8EA158600DC86B7B9A8C357799C6EBE6ACD1C2D9DC942DC701B6A4909C9992
                            SHA-512:64B96D8D6E0B82290B657E19C1D05DBBA35702BC48091503C226E83686B522BC879A65246FDC23639FC9EAB17D1FF0110BF1CFAE037CE7FE3EC9BB044A703247
                            Malicious:false
                            Preview:.9b..+h^m].\".....>..0..@.....8E.....I..~v......%8..UE.l.\[..\6..9e.S#.f<l.^..<U..<7..~m.'.e.]...p...d!6D...^...MFh8........n..=d?!...B......k*.."x/...<.ps`7F....E.. .......I..O.2B..+..:..J.h.4.....;..D..$..^1./p......U.D..).../...w..r..n5.s..o..uI..._.kIw.T....{..a2.&..sp...,...a_&..6....>Ye.5!.lK...x.@:.'..?...Zo..&k._......./...{....X..(..v.-...3.SHE?.i,2..e?...G.=.N'.{0`.C..)..hJ...B-f..................J..!G..r....j/#...1,Q.>.;.o.).<.._(\....X+.........K...(....e#...rK..aT......y'~|. ...y.l.{~!r...n...m]?...-e..uj%.r2.2...I.Vn..P..}eA.G.lOK`....h1..imD.E_.....=....g...X..g.0AY3...U.e.].ds...#Y.V'Z....Da4....3..bD..."-^.|%0.{.I....c~~Q.N.T<8.v.n..Ix.4>l...Rr...6?M.)...v..`.v.a.=.Cf.3W..Ex.....C<...=..vX...o........[...tB.I.B...fM.!.z..K......g.k..\.%<Y .....p0+......G.b-i7|n..pcm..JD...b6.V...7.q*tl.\9.n.Lag...9.j.i.r.*.S+.0]%C-...b.C<.dp........)..Y(..N^-../.I....8.];#.Q...'.6.].@..5/......B......I|ze.?.?...4..5.<.":=

                            C:\Users\user\Downloads\ZGGKNSUKOP.jpg.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1270
                            Entropy (8bit):7.832425923013206
                            Encrypted:false
                            SSDEEP:24:mEjYVMHg1w5TCKdBQ927Rh2pekqlZKHmDFifVd43wi6YbCbYTT9TRg:bRHswl5dBuMhlsHmQfVyAiZbCsTk
                            MD5:17D0414C5ED48CFC125B2D2544DC486C
                            SHA1:52DD032607D8D285D55F68A480FD561FD1CD11FF
                            SHA-256:FDFE980B03CBACBEA52C37FAB6AAB81298D36DD59E14D3C97D7AA4E9FEC30DFF
                            SHA-512:0D397A6AD54EABBBD0986947E8428888C7F11D57031F61C0081605344087FC4D1EC234590C710ECA370A20A78E1F327E1A11C79341C981E13251F40FC35CE643
                            Malicious:false
                            Preview:s.L...2..G...J...1a6.R .....ij5..;...^)U.v.#...CJ+.`\...9....5a..`...t....Xn^.am....D.x`....(I#..#..G...].v<4H.....z.Y .1.H.,.`&......9.;..7Z..........j.&....@.uoB...s.......S..U......@.e.?..x.v...u2I....AS..%T...|.X.Z....%.. .........c..J^....m.....&.}..:d.).Q..x...au..!.;N.W}K..X.....IB...8.....O.Q.....~...3...7.b#.b.M.&O..3s .o..A..M0|..-.w...G|..-..P.e....^.3..."....&31\..%.Gk.....&x.k.#Z?=..a................~Hg...60b.3..= ..OF..rF..r..)}.Y..."+..(;.....^{..m..3~....IA..P..0..?iQ[.5~.Q.....-G.Hu.T..IES....1...b.2.E.k.+....!K3..{...w.S.......#......z.o..."..1..)....8H.....J&<v......J..7.v....&...!..a.0F.Z. .].er8.p,.._.6.e..Bew.^.....bl.z.7.....R....CP.2R.....er........?....F...c.1NT.)4....bA.}.7].*.y..8a9...(X.R..\.........9;...s;..u]..&....'..]...v....Ef.<M..6....?.....(..g$L%b...5d.~\.VM.5..J..X..rk.J..#.h.R.yf,..v`&3&.v::....Geb.%B6?.$d...K......{.F...S..g.'j...s..RW.(........G,..Y,........^...a.h.T.,......f^,.:.>X....;....R.

                            C:\Users\user\Downloads\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\Favorites\Amazon.url.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):350
                            Entropy (8bit):7.342147076117379
                            Encrypted:false
                            SSDEEP:6:TYvKFYHmvgqeuVNMIbPhDrjOm2vr5UdrihcNf15748OuL8nPo8aC6ztDsY80T/fY:UvKFqmoqPlPhfjOmpdrihy954fs8nwFS
                            MD5:01C1DB9488CC5C31D1DB3350730397A6
                            SHA1:EB743BEE7E6CD7910F6931332901CEF24DFB4364
                            SHA-256:3FF1DF280234B43DAE7B4E7C1736DD344A1B1E1AB0E72A2EEF02D461EC86D313
                            SHA-512:94C90A6D033577FDC52957AE3D6C5485D1A649F80E3C0BB7F0938C49639894672753402BD470026D602989B2B15FB42DFD3C70C8525A9F09137BE0F8525BB118
                            Malicious:false
                            Preview:...t..v.gS.4.....;'.q.(."..C....{......!H..xv".vb3.G...].*..5x.*..^.=.so.'N...N.>.P...k....A..j..7E....R..cD.}...{.I.X...*.4..`.@.vy..B@.`(7.....F.V..Yw...l...S}..w.!.:..n.+E7..u...Q.1w:D..mTV[.Ig.....>i.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\Favorites\Bing.url.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):443
                            Entropy (8bit):7.537981803038552
                            Encrypted:false
                            SSDEEP:12:h98qgOz2L6+8vLUlRLtAsx5GRipwFCRYTT/N3tJRg:38bOz68vACs/GRiVYTT9TRg
                            MD5:799EF9B970E5C05F5CA1A216A4702BDB
                            SHA1:153436950BF4B7602C10F421E32AF5F684DD9DA5
                            SHA-256:BFF9BFD002592D604A729C80672535E6587FEDA1B3FE150289F51AE39E23D221
                            SHA-512:210592F36FEED637E05CCF2D5B66303F200391121CE1B4845A941EA1766A0F1ACAFC76F9BEA4B7EA56E46CE425D519EC606A9FC47C7EF0112F07C9DC11D44434
                            Malicious:false
                            Preview:?..8.e.@6..?..#9.@.M.`........6..Ke.. ...)....I1....+.'.?ed.P!..]H.....3.....R...wpfh1...!S....k..f2a...'...C.S..Dj:A.....G.]1...v51A.V.7..L...0N.dC6..m.2..bl.G........x&R}.]Zi..xa.O....K..!.s..`D.}...:.I.X...bF....%.@.$y..B@.`(7.K.q...X.|.K...*..DuU9k.]...nP.\..k..T..f....cd}...}.F.(.e.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\Favorites\Facebook.url.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):355
                            Entropy (8bit):7.393124634047195
                            Encrypted:false
                            SSDEEP:6:l5HYPXlHdCA8UhgYmS/Yz/TnhaBApmDCswM/sju6gWcPo8aC6ztDsY80T/f/9FZ6:7wl18XYmaYTbWGmDCsw8sjLgTwFCRYTk
                            MD5:2213686855E006CD098F1D44A373AA31
                            SHA1:72BB9EBF9A06905DBBF118C037E2AD09F64CB4A4
                            SHA-256:CE12D6688B7D1D157C65C292AC8D7A888B9882367496C3B802DC337D39A1B2F8
                            SHA-512:F56121120F84066121B045E1094D77F1F7DCD049CA4FD28AFD59A917396734F60DDF8B594EC5786C1CDCBCCC318CC0DB1D27D67B64A281A7729031FED9952E59
                            Malicious:false
                            Preview:7.p\.pg.X.1+w.g.4U...8...T. D..RT..W..........>.I.tY^.U.....j..?Q.?...J....?...6.._.....k.).DF..t/.....=H_..dD.}...v.g..`...Hi...u.@.$y..B@.`(4.....R.K...!..9].1....6..'.7.{n...|+W.n.....;j.].`...".Px.E...2'Iwl.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\Favorites\Google.url.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):347
                            Entropy (8bit):7.349078398629356
                            Encrypted:false
                            SSDEEP:6:68QQLjJA/K4DffJjOhDADEh+sYglVqdt4dwPo8aC6ztDsY80T/f/9FZtOoRg:NC/K4Dfhy9ADEh+9t7wFCRYTT/N3tJRg
                            MD5:6D5AEB4298B1E5F45D791DBB90BE2D4E
                            SHA1:B78E1A0FBB41826909AEADC76130E41F4267E3DC
                            SHA-256:08053385DCEDF15B0C81CCF35C161958EB8883CB53AFE1A4A57C14D57083AC4B
                            SHA-512:C7AB8D3AF5BA66993D56B536373A0D4782541EE659DBC057B49E893CF7A1DCA1FB16E2368FC98FF314B1037A4D1251373A074827AAC76B29359A0070FA65FDF9
                            Malicious:false
                            Preview:.....{..8......Z...D......C..R,..2y.k.s..b.+...e....].p...M~....,.^N?.m.^..U...3....;(&...p.,`i.qdN....eD.S.N.N.k...c\..D....wZ@.$y..B@.c(7....T..]..Q...x..l.......@0i.e.6x.7..u6......XD?.\....n./.,v.f.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\Favorites\Links\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\Favorites\Live.url.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):344
                            Entropy (8bit):7.400359848971284
                            Encrypted:false
                            SSDEEP:6:F8zA50RGVDaqXtoqUWsVj6YF7AEbIf3SiPo8aC6ztDsY80T/f/9FZtOoRg:ek5oCDsbFtAn3SiwFCRYTT/N3tJRg
                            MD5:1AC43DD4275FD2C8699428C4141103D4
                            SHA1:C7681545CD467CAB803215B5BB40666ED8AA28C5
                            SHA-256:76F9C038A1A350BAA514019D1354C17EA0E20A2524A9186168E275BFD11D0083
                            SHA-512:314A62603FB7F962A364384B0F114A64B3396557B0D41CBD9818651765233A453488829FDE38CC6048665C390E8F7AA7F2D8509DAB57F9616FC4684105A8C8EC
                            Malicious:false
                            Preview:.O..\...Q.L.Z.E..R.&...^?y`.8.... O....H....tcp...i....H...a..?Oq...]i.!b.GeE..........~.g.).Q..b..d.g6.YnD.}...:.I.X...bF....%.@.$y..B@.`(7..U.....~#5#....7...0.....S+...]...O.J~0..8HZ...kX<.D..)....&e.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\Favorites\NYTimes.url.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):353
                            Entropy (8bit):7.347646169217103
                            Encrypted:false
                            SSDEEP:6:0+EPrfOg84GYHTpjkDfVNvAnCJdjPh6GPHjDKk9H+XtSdBxdPo8aC6ztDsY80T/g:ezmSGQTpje9hAnCJFPvDKk9eQ3wFCRYQ
                            MD5:3CBF78294DF082E0C92AD2E053581EB1
                            SHA1:79C3844582ED59228B53771FCC6688827C7BE1E5
                            SHA-256:05AF0448684A4D6ABB8C57DD6546E69C4FCCEE18B1852AACCD1C88DE39719EF2
                            SHA-512:250223FDB799524EF61CE5E2A6237C97E1C2FA98AF235C39C1BC523187AD756BF5CEAE62299DABE33709A839D3D521FC617C723C74D9FC755BCCCFCCD8E6CF90
                            Malicious:false
                            Preview:.."._.....1P.....i.....m.+.@..C.p...G>.n}p]n..tZ$.....Z.k..NW:p.........)fy.@...;....G....RP...K-...*i>lD.}...y.I.X@..4..=eu.Y.$y..B@.`+7.......H0H...1&.{.K.=n.......h...S......0.+k.5.l...2.h.&*..*...y.k.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\Favorites\Reddit.url.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):349
                            Entropy (8bit):7.415662677545218
                            Encrypted:false
                            SSDEEP:6:X5gsqiIEZFBQzY51dRj7FYNlImMK4JgccnoCH2cLAPo8aC6ztDsY80T/f/9FZtOD:Fozq57eZV9HdMwFCRYTT/N3tJRg
                            MD5:4006EDDE487DD035B04A193980BD2AAA
                            SHA1:524BBB20CCA2E8ECF38F790990C92940B37404A0
                            SHA-256:820E1D44A16AC47F0B1B82A41F1373662319B37A9C21450FF73110F31C6652DF
                            SHA-512:7AE6A1B7A20C9A7E22AB2375DE6A9344D190419FBFF6A0E73BFFD5C51F3475882581EF3936A0C9DA477932E61294494D245F485D77257167E9D20AE5C8B93A6A
                            Malicious:false
                            Preview:.!..es....."95.5....s...Yu..p...v.....@G.d[u.P..=.q9.WUhm...U=z...h..M.. ]|...4NWG\....m_..Wo...-.j.w.Xo..pD.}...K.z...`\..]....w.@L$y..BC.`(4..W...m..lC.jA6.....}f(.....G..{(.....i.j|....T.b.......A'h.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\Favorites\Twitter.url.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):350
                            Entropy (8bit):7.457593853136138
                            Encrypted:false
                            SSDEEP:6:j1E/zfwJfXNFlPD1UiUsv8iR2XvYNJo5OBtwJRnPo8aC6ztDsY80T/f/9FZtOoRg:2/zYdXVPDu8Uro6OBSPnwFCRYTT/N3t0
                            MD5:1B5720E484F842993D332ED2B39C2711
                            SHA1:1E67CBA8EB79FE8096F1D6FE19BFC27F58667669
                            SHA-256:73D92A1E0A6513A0C3F89A2FF55264A8FDD6C99675513FE0CAF57D95EE314CE0
                            SHA-512:638911CF6C168949461EB7340B3FB3035728A7A1621080D1AB9403DFCC2C396E99E7E59C80572E39616D05F9C7D9B7B75CF889A5109A35069CEB5219304D3517
                            Malicious:false
                            Preview:3j..B......sH.'..+.."...;..H<.x.1L.I>...(..%.?.r~j..<.'..U....'.=m`N.E`.....P.*9..Mo..).W[rZ^.Z_.Q..D.h3.vD.}....k....b[.......w.@L$y..BC.`(4..C....\..^.O.1.W.X..,.l.I.v.f}j..zpT;..CR...4...A.3`V.A.?.O.'h.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\Favorites\Wikipedia.url.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):356
                            Entropy (8bit):7.370184520971109
                            Encrypted:false
                            SSDEEP:6:y6usY+uPaRxa6coY0f6lmwmpmDnJ2D7bKsBLZcPo8aC6ztDsY80T/f/9FZtOoRg:yLsYZPaRI6nYYJwmpmDIDHwwFCRYTT/g
                            MD5:4A8110444CC02A3D17B0EA76AD821A6E
                            SHA1:0E669DBB224B5BBEA1B85ECDCB0C15EC0A5FE2AC
                            SHA-256:8A37F345FD8C40FD4ECCACBD5989FC0EB20C733EA01DC122580DE777920D3654
                            SHA-512:46C23CD5AB06305E0F31A1A3EE85C57A37F2ECF1EC4AEE21CA1C28780FD8F5A132570352F45BEA82B26B71B0EF74C729ECBA529641D070F4E00D27845223EC03
                            Malicious:false
                            Preview:N.#.....r"G....*%.....n..q.j... 17..QN....q2|......K..".h.......^Y.12....x.......=...8.~.k......br.2..!uD.}...R.k.....C..id.4..@.$y..B@.`(4.....R..s...x.KL.3.....<4.R..T}.............H...-...~...W.*..B.&,I.8l.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\Favorites\Youtube.url.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):350
                            Entropy (8bit):7.387695586145538
                            Encrypted:false
                            SSDEEP:6:kwzIeo75He/c/ukgDFeEzfi6ltBXvYNJiAIH48/P1QePo8aC6ztDsY80T/f/9FZ6:5Meope0/kFesosAIY8/eewFCRYTT/N36
                            MD5:39E065D9F1FDAA33AC7FB86D457525CC
                            SHA1:34A956F48D93BCE71DB1E821BD8A122E77DD38D9
                            SHA-256:52F2C69263BA8859CA72B332168D36693C74F3E7962C2826C87DA64B6D1F1F58
                            SHA-512:EE0C6DC2310257B246489348898AFD819B1218C8E857F3C3E115FA438D15549B5AFE27112B9ECB11D425C792DCC805B45394DBFFD886F9895D2172345834DF0E
                            Malicious:false
                            Preview:.Db...1J....... W..M0....n...z. ..t].:...=..t..&..........s..;.!.7.N..&...'.?r...<].u..G..w.......&...._.2....{D.}....l.....\C......w.@L$y..BC.`(4......V...N._..y.I.YT..6l.."..D.j|.../...7,.AT.....|...a\..K.h.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\Favorites\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\Links\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\Music\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\OneDrive\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\Pictures\Camera Roll\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\Pictures\Saved Pictures\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\Pictures\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\Recent\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\Saved Games\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\Searches\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1003}-.searchconnector-ms.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):1173
                            Entropy (8bit):7.84058366016628
                            Encrypted:false
                            SSDEEP:24:dAHy+ZvBZHdc1wlQmq/OMZX1lZqEmZJvLzxxCYTT9TRg:nQZqJZdBqEeJzzvTk
                            MD5:7AE89B408A74C0F1DF1E4258D33C214E
                            SHA1:AD84C9AFAD00383CF8DE7BA04352E6491B1C77E9
                            SHA-256:DF678D5AAE4F7560E8D0447C4A5DFC16D0BDE8F1067AA033DB9B3C6DAA54A81E
                            SHA-512:E624AA5BF850AD968258B8654E754C8FEE85699CDCD778B9FB6E7A4DA33C94A13D4C4EADC1F6C251ACEFC522AF773286B03ADB987F868CF659EDD906C8C578F1
                            Malicious:false
                            Preview:.......8..1d.U.n.W..5.n.4.-..g.o..l..A....J..F..]ts"...[.J...6KC.iI%M(...+.Y..e..j........D._.`.......+...5v%..}.Y..4(.Q.y...A7..]..?....i.n8....I...ck.h..@.....7.i.;@...)J..=....k.J.....m...C.&....S.+E....%.o.w...2.......g... ~._-.qj.o'..k{._&Y.....Q....s.JN.......M.i..M13D9..U....W...os..z`..tT......#.....t.....v..T....=..e......4...v.7.GVKj..u.-.=_-4.$......._.O.'N.F9dz.j.n..pOoP.S..A!..{...ak.4....S..\0..>..5..~. ......%.E..0...v..dg....|..Z$.4D`..5.;.;.{[E.N......Iw.I.j.&H..9.N@......v.Q?.<7...o.X..^..{..j>.f8..{.byi..^.pL....1..'.D.).p..$@.. .o|.....$....@.......P5..%'.h E1.X..p..G...7w#...iF...> ......1.T$....&%.6g..d....C....4ge......W.-#.,..0Y..$4X.^..Q...h...ws^m..G...n.W.......K_.j.b.c.*..B....a.V.uQNe.T.>./.U.o..Y..eW]kP}./...(<.k...4(P%../%..M..[.c?..rmwg...C.b3.....k3...E.S.....`c....x4....6=.~..SUD.}...`..g..b}.Q...I.}~...t..UJ.U.......f..B.q.v...D.r..........\.y.h0i.Q"O........s.#...~+|.cy....?o!...{..m...h...e....r4.>L.4.Z.".,

                            C:\Users\user\Videos\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\user\_curlrc.kZd6jLIwz

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:data
                            Category:dropped
                            Size (bytes):239
                            Entropy (8bit):7.120771711699525
                            Encrypted:false
                            SSDEEP:6:UakK/o8tfcEvvoRYWQricPo8aC6ztDsY80T/f/9FZtOoRg:Uk/olE34jQricwFCRYTT/N3tJRg
                            MD5:FFA4D3FEAF2EEAAFE88689562CCD3879
                            SHA1:505337A462E5707FBC24956B462169F1FDC00C4D
                            SHA-256:40D53C13D9CB85683D4B005E46A1C9CABB2820216DB8689640CEFEFF2AE8EF68
                            SHA-512:8BF742FBF18681BED71D8482E3DF93E87253F78003D6EFCDDA0CA34209FE715F0BFC3CD44D65993C024A6870F6F1662BAB266D3EAD7638C9E34103CAC8768668
                            Malicious:false
                            Preview:..?....}D.}...x....n!.`FI...w.C.$y..B@..Y.$.s.?...P....gDN.....G.JU.....4.-......U}.{.... .t..hzG..a.....I.tDV.GX.7.vvA..d..02Y..'_V|.{..c{.....b|."@R....|.P'..yW.^+f"1..l.....d:Zs7!E.5g...8pR.2Y...Wo...H5.(.T.....v&...%Q......

                            C:\Users\user\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Users\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            C:\Windows\System32\spool\PRINTERS\00002.SPL

                            Download File
                            Process:C:\Windows\splwow64.exe
                            File Type:Microsoft OOXML
                            Category:dropped
                            Size (bytes):13666543
                            Entropy (8bit):7.892353289329497
                            Encrypted:false
                            SSDEEP:393216:snEk1Vuj5du9k+pai4xCWAOqNDZizSTn3LXReXOuUbIBpu8vE/ws3:bvHMp
                            MD5:86B93B198634BE5CF3EBF328E34B5424
                            SHA1:0411B43F167484186A24D2947864FEA8DA1F1781
                            SHA-256:B1F17F1D2BD4F309245521BD3A94FF0FD583028AA55916C213988C96817331CD
                            SHA-512:CF6E619FA39AF6BAEE0EE9F16C525CDAD2C29EF38757DF0584365CF430535692E83AD22998C057A2BB814119F6F6D6BCC33DA804B8AC6B1AD681BD58F7DA6FE8
                            Malicious:false
                            Preview:PK........G..X................[Content_Types].xml/[0].piece.....0..W..o.x .....e.(....Ql!..<...S^.MMw....#Nr.9....p..:..J.z..`3..DM....T.n..J..-c...3....&a#......PK....X.j...q...PK........G..X................[Content_Types].xml/[1].piece..1..0....eE$....{e.C.&..X.........H\., .....o.T..i.."...K.s..4..VW...i+.Ak.....}....\.+..O?PK..K..jb...l...PK........G..X................_rels/.rels/[0].pieceM.A..!.E.B.w...1.....9@...C!...?,].......f..4.qp.,.._^I...y?\`.....Cc.jF". .^...#g.T.A.e.c.........3.....PK...BpJl...y...PK........G..X................_rels/.rels/[1].piece..K..0....9@&.....nk/.....O3S...s....L/'.UN...'.......P....UO:....=X......B..gD...c]...[..[..3..9.9a.... .....N.PK..4...u.......PK........G..X................[Content_Types].xml/[2].piece-.A.. .F....p.u.q.&....!...m..[.n_^..kA.......>|.......f....`........}..F..(v.6.t...0-.n.C|@.N-.Z...PK....[Pm...{...PK........G..X............%...FixedDocumentSequence.fdseq/[0].pieceU.M..0.F..fo&.....H.`..2.....H.o..p

                            C:\kZd6jLIwz.README.txt

                            Download File
                            Process:C:\Users\user\Desktop\Document.doc.scr
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):449
                            Entropy (8bit):5.3026619730084175
                            Encrypted:false
                            SSDEEP:12:bGFDCFfZpbl8ZVVTIDh0ED0nNErJgwiLaOh7J:bGFDCl/6pTIDh2EVRiNJ
                            MD5:C2F46DB865B0BA6EF8F9385CF458A56E
                            SHA1:0B2F94FCF38EF15F59BB86A3296B7DA514B4AC4E
                            SHA-256:C25759E6083DD4BF592A6DA2063C45DEF5ADC9A6EF2ED15820128A0D838F70FE
                            SHA-512:9927B209CA26E3243FAC9F003C6AF7663BA84405346FBDB66C6F401387CD20EA3F99D63D0858EBDC76F2E6BC722D41E2A1F599BC6F7D97B0687DBA95DEA31B39
                            Malicious:false
                            Preview:.....!! ALL YOUR FILES HAS BEEN ENCRYPTED !!!..........You can't restore them without our encryptor...........Don't try to use any public tools, you could damage the encrypted files and lose them forever...........To make sure our encryptor works, contact us and encrypt one file for free...........Download TOX messenger: https://tox.chat/..........Add friend in TOX, ID: 36F186C6FDCAAC0CF122E234B5D15F3F42F73568745F251C1306D71EBCA96817770F9B9AC2E6

                            \Device\Null

                            Download File
                            Process:C:\Windows\SysWOW64\cmd.exe
                            File Type:ASCII text, with CRLF line terminators
                            Category:dropped
                            Size (bytes):22
                            Entropy (8bit):4.186704345910024
                            Encrypted:false
                            SSDEEP:3:otlUyn:otn
                            MD5:122353F41CD064B36DDAC43F8FC590C2
                            SHA1:B86E515C499C9747637FE220DF20321C5E709CEA
                            SHA-256:92E6FF1A20F14A130F0C6348A5C8D39CBD2FB0F2F25C66C619CAECAD2BA7492D
                            SHA-512:C9C69518CD31B295E7D2892732831585D17DD56D24EE5B46A9978F39C4D1DCE4BAD18DD82B4E6E35414D8E2A0CFEEB64E80D71D0BFFE05AF76DCC2DC77210F29
                            Malicious:false
                            Preview:C:\PROGRA~3\D4EC.tmp..

                            Static File Info

                            General

                            File type:PE32 executable (GUI) Intel 80386, for MS Windows
                            Entropy (8bit):6.772003068492061
                            TrID:
                            • Win32 Executable (generic) a (10002005/4) 99.96%
                            • Generic Win/DOS Executable (2004/3) 0.02%
                            • DOS Executable Generic (2002/1) 0.02%
                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                            File name:Document.doc.scr
                            File size:199'168 bytes
                            MD5:ae811bd6440b425e6777f0ca001a9743
                            SHA1:70902540ead269971e149eaff568fb17d04156af
                            SHA256:86e17aa882c690ede284f3e445439dfe589d8f36e31cbc09d102305499d5c498
                            SHA512:3617d8e77c221525125778cf64f2525136f7958766f5bed0fd7bfe00e7f738017d2840972acc628e4c3471b93cf6d52ccd619f49bdbbcff824c12cac8e1ea88e
                            SSDEEP:3072:a6glyuxE4GsUPnliByocWepiHkZmlkQIQP6fo:a6gDBGpvEByocWeQwLAPm
                            TLSH:68145B21F246A8F3C42324F52A32E53173AA9F2D1D6D180FEAB53F4A68725D32B15D47
                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...e..c............................o.............@..........................P......F.....@...........@....................

                            File Icon

                            Icon Hash:76d393391a9ba6ba

                            Static PE Info

                            General

                            Entrypoint:0x41946f
                            Entrypoint Section:.itext
                            Digitally signed:false
                            Imagebase:0x400000
                            Subsystem:windows gui
                            Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                            Time Stamp:0x631A9665 [Fri Sep 9 01:27:01 2022 UTC]
                            TLS Callbacks:
                            CLR (.Net) Version:
                            OS Version Major:5
                            OS Version Minor:1
                            File Version Major:5
                            File Version Minor:1
                            Subsystem Version Major:5
                            Subsystem Version Minor:1
                            Import Hash:41fb8cb2943df6de998b35a9d28668e8

                            Entrypoint Preview

                            Instruction
                            nop
                            nop word ptr [eax+eax+00000000h]
                            call 00007FB620940327h
                            nop dword ptr [eax+00h]
                            call 00007FB62092D6BAh
                            nop
                            call 00007FB620930CA7h
                            nop dword ptr [eax+00h]
                            call 00007FB62093E766h
                            nop word ptr [eax+eax+00h]
                            push 00000000h
                            call dword ptr [004255C8h]
                            nop word ptr [eax+eax+00000000h]
                            call 00007FB6209400C6h
                            call 00007FB6209400B5h
                            call 00007FB6209400A4h
                            call 00007FB6209400B1h
                            call 00007FB62094009Ah
                            call 00007FB620940095h
                            call 00007FB620940096h
                            call 00007FB6209400AFh
                            call 00007FB6209400A4h
                            call 00007FB62094006Fh
                            call 00007FB62094004Ch
                            call 00007FB620940059h
                            call 00007FB620940048h
                            call 00007FB620940061h
                            call 00007FB620940062h
                            call 00007FB62094004Bh
                            call 00007FB62094003Ah
                            call 00007FB62094001Dh
                            call 00007FB620940018h
                            call 00007FB620940037h
                            call 00007FB62094001Ah
                            call 00007FB620940003h
                            call 00007FB62094000Ah
                            call 00007FB62093EB95h
                            call 00007FB62093EB9Ch
                            call 00007FB62093EB79h
                            call 00007FB62093EB80h

                            Data Directories

                            NameVirtual AddressVirtual Size Is in Section
                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_IMPORT0x1a2300x50.rdata
                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x270000xc160.rsrc
                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x340000xfd0.reloc
                            IMAGE_DIRECTORY_ENTRY_DEBUG0x1a1200x1c.rdata
                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_IAT0x1a0000x70.rdata
                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                            Sections

                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                            .text0x10000x17de80x17e00cfbda2c44e51b3b0b00bcbbc767c62a2False0.48375122709424084data6.634079266913224IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                            .itext0x190000x5460x6006f4cd57381bb5584c0a0755384d25180False0.251953125data2.9337361310958805IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                            .rdata0x1a0000x4920x600bd829aa493ecd52fe5bec776d207f206False0.3671875data3.5366359784052652IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                            .data0x1b0000xadc80xa0007058dded90f7b91caeb0f8538fe66fc2False0.9826416015625SysEx File -7.9885847715103475IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            .pdata0x260000x89f0xa006f11c5fa5120ac94794cd017561d1cabFalse0.8859375data7.3675444501797145IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                            .rsrc0x270000xc1600xc2000498258b0cc68156e1295f5d17bb63e6False0.22473018685567012data4.478609900548174IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                            .reloc0x340000xfd00x10003f87e4c23650dfad0bee7da98889ba94False0.843505859375GLS_BINARY_LSB_FIRST6.738987246879603IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                            Resources

                            NameRVASizeTypeLanguageCountryZLIB Complexity
                            RT_ICON0x271f00x176dPNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9296314824078706
                            RT_ICON0x289600x4228Device independent bitmap graphic, 64 x 128 x 32, image size 00.0973665564478035
                            RT_ICON0x2cb880x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.13340248962655601
                            RT_ICON0x2f1300x1a68Device independent bitmap graphic, 40 x 80 x 32, image size 00.16715976331360946
                            RT_ICON0x30b980x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.20309568480300189
                            RT_ICON0x31c400x988Device independent bitmap graphic, 24 x 48 x 32, image size 00.2721311475409836
                            RT_ICON0x325c80x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 00.34244186046511627
                            RT_ICON0x32c800x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.41932624113475175
                            RT_GROUP_ICON0x330e80x76data0.7457627118644068

                            Imports

                            DLLImport
                            gdi32.dllSetPixel, SetDCBrushColor, SelectPalette, GetTextColor, GetDeviceCaps, CreateSolidBrush
                            USER32.dllDefWindowProcW, CreateMenu, EndDialog, GetDlgItem, GetKeyNameTextW, GetMessageW, GetWindowTextW, IsDlgButtonChecked, LoadImageW, LoadMenuW, DialogBoxParamW
                            KERNEL32.dllSetLastError, LoadLibraryW, GetTickCount, GetLastError, GetCommandLineW, GetCommandLineA, FreeLibrary

                            Network Behavior

                            ⊘No network behavior found

                            Statistics

                            CPU Usage

                            Click to jump to process

                            Memory Usage

                            Click to jump to process

                            High Level Behavior Distribution

                            Click to dive into process behavior distribution

                            Behavior

                            Click to jump to process

                            System Behavior

                            General

                            Target ID:0
                            Start time:03:17:37
                            Start date:24/04/2024
                            Path:C:\Users\user\Desktop\Document.doc.scr
                            Wow64 process (32bit):true
                            Commandline:"C:\Users\user\Desktop\Document.doc.scr" /S
                            Imagebase:0xd40000
                            File size:199'168 bytes
                            MD5 hash:AE811BD6440B425E6777F0CA001A9743
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Yara matches:
                            • Rule: JoeSecurity_LockBit_ransomware, Description: Yara detected LockBit ransomware, Source: 00000000.00000000.2009802642.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
                            • Rule: Windows_Ransomware_Lockbit_369e1e94, Description: unknown, Source: 00000000.00000000.2009802642.0000000000D41000.00000020.00000001.01000000.00000003.sdmp, Author: unknown
                            Reputation:low
                            Has exited:true

                            General

                            Target ID:4
                            Start time:03:18:12
                            Start date:24/04/2024
                            Path:C:\Windows\splwow64.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\splwow64.exe 12288
                            Imagebase:0x7ff6e8410000
                            File size:163'840 bytes
                            MD5 hash:77DE7761B037061C7C112FD3C5B91E73
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:moderate
                            Has exited:true

                            General

                            Target ID:8
                            Start time:03:18:24
                            Start date:24/04/2024
                            Path:C:\ProgramData\D4EC.tmp
                            Wow64 process (32bit):true
                            Commandline:"C:\ProgramData\D4EC.tmp"
                            Imagebase:0x400000
                            File size:14'336 bytes
                            MD5 hash:294E9F64CB1642DD89229FFF0592856B
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:moderate
                            Has exited:true

                            General

                            Target ID:9
                            Start time:03:18:25
                            Start date:24/04/2024
                            Path:C:\Windows\SysWOW64\cmd.exe
                            Wow64 process (32bit):true
                            Commandline:"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D4EC.tmp >> NUL
                            Imagebase:0x790000
                            File size:236'544 bytes
                            MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:10
                            Start time:03:18:25
                            Start date:24/04/2024
                            Path:C:\Windows\System32\conhost.exe
                            Wow64 process (32bit):false
                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            Imagebase:0x7ff6d64d0000
                            File size:862'208 bytes
                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:high
                            Has exited:true

                            General

                            Target ID:11
                            Start time:03:18:25
                            Start date:24/04/2024
                            Path:C:\Program Files (x86)\Microsoft Office\root\Office16\ONENOTE.EXE
                            Wow64 process (32bit):true
                            Commandline:/insertdoc "C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\{082B68BB-AD41-4487-9321-7D0501AE003B}.xps" 133583950932070000
                            Imagebase:0x90000
                            File size:2'191'768 bytes
                            MD5 hash:0061760D72416BCF5F2D9FA6564F0BEA
                            Has elevated privileges:true
                            Has administrator privileges:true
                            Programmed in:C, C++ or other language
                            Reputation:moderate
                            Has exited:false

                            Disassembly

                            Reset < >

                              Execution Graph

                              Execution Coverage:32.4%
                              Dynamic/Decrypted Code Coverage:0%
                              Signature Coverage:38.1%
                              Total number of Nodes:160
                              Total number of Limit Nodes:1
                              execution_graph 890 403983 893 40389c 890->893 902 402a78 893->902 897 403903 932 4022dc 897->932 938 4028ba 902->938 904 402a9e 904->897 907 4026c0 904->907 905 402af0 CreateMutexW 905->904 952 4024f8 907->952 909 402729 909->897 913 402f18 909->913 910 4026e7 CreateFileW 910->909 911 40270b ReadFile 910->911 911->909 914 402f2e 913->914 914->914 956 40227c FindFirstFileExW 914->956 915 402f67 CreateFileW 917 402f57 915->917 920 402faf 915->920 916 402faa 919 4030c5 NtFreeVirtualMemory 916->919 921 4030ed 916->921 917->915 917->916 918 402fb4 NtAllocateVirtualMemory 918->920 927 402fe8 918->927 919->916 920->918 920->927 922 4030f3 NtClose 921->922 923 4030ff 921->923 922->923 958 402e10 923->958 925 40311f 925->897 926 40304b WriteFile 926->927 928 403068 SetFilePointerEx 926->928 927->916 927->926 929 403095 SetFilePointerEx 927->929 928->926 928->927 929->927 933 402303 932->933 934 402335 GetShortPathNameW 933->934 935 402330 27 API calls 933->935 934->935 936 40235e 934->936 936->935 937 40246d ShellExecuteW 936->937 937->935 939 4028dd 938->939 942 402760 CreateFileW 939->942 943 4027da 942->943 944 402797 942->944 945 402802 943->945 946 4027f6 NtClose 943->946 944->943 950 4020bc 944->950 945->904 945->905 946->945 947 4027b7 947->943 948 4027c0 ReadFile 947->948 948->943 951 4020c8 RtlAllocateHeap 950->951 951->947 953 402512 952->953 955 402760 4 API calls 953->955 954 402522 954->909 954->910 955->954 957 4022af 956->957 957->917 960 402e2e 958->960 959 402e37 DeleteFileW 959->925 960->959 960->960 961 402e7c MoveFileExW 960->961 961->959 961->960 962 403956 963 403963 962->963 964 403976 962->964 971 4019d4 963->971 1009 4016b4 971->1009 974 4016b4 9 API calls 975 4019f4 974->975 976 4016b4 9 API calls 975->976 977 401a05 976->977 978 4016b4 9 API calls 977->978 979 401a16 978->979 980 4016b4 9 API calls 979->980 981 401a27 980->981 982 4016b4 9 API calls 981->982 983 401a38 982->983 984 401b70 RtlCreateHeap 983->984 985 401ba6 RtlCreateHeap 984->985 995 401ba1 984->995 986 401bcb 985->986 985->995 986->995 1057 401a40 986->1057 988 401c03 989 401a40 RtlAllocateHeap 988->989 988->995 990 401c59 989->990 991 401a40 RtlAllocateHeap 990->991 990->995 992 401caf 991->992 993 401a40 RtlAllocateHeap 992->993 992->995 994 401d05 993->994 994->995 996 401a40 RtlAllocateHeap 994->996 1001 402812 995->1001 1005 402836 995->1005 997 401d55 996->997 997->995 1062 401d94 997->1062 998 401d7a 1065 401dc2 998->1065 1002 402836 1001->1002 1003 402850 RtlAdjustPrivilege 1002->1003 1004 40284e 1002->1004 1003->1002 1003->1004 1004->964 1006 402849 1005->1006 1007 402850 RtlAdjustPrivilege 1006->1007 1008 40284e 1006->1008 1007->1006 1007->1008 1008->964 1010 40176f 1009->1010 1011 4016cf 1009->1011 1010->974 1012 4016f5 NtAllocateVirtualMemory 1011->1012 1035 401000 1011->1035 1012->1010 1014 40172f NtAllocateVirtualMemory 1012->1014 1014->1010 1016 401752 1014->1016 1020 40152c 1016->1020 1018 40175f 1018->1010 1019 401000 3 API calls 1018->1019 1019->1018 1021 401540 1020->1021 1022 401558 1020->1022 1023 401000 3 API calls 1021->1023 1024 401000 3 API calls 1022->1024 1025 40157e 1022->1025 1023->1022 1024->1025 1026 401000 3 API calls 1025->1026 1029 4015a4 1025->1029 1026->1029 1027 4015ed FindFirstFileExW 1027->1029 1028 40166c 1028->1018 1029->1027 1029->1028 1030 401649 FindNextFileW 1029->1030 1031 40162a FindClose 1029->1031 1030->1029 1033 40165d FindClose 1030->1033 1043 401474 1031->1043 1033->1029 1034 401641 1034->1018 1036 401012 1035->1036 1037 40102a 1035->1037 1038 401000 3 API calls 1036->1038 1039 401000 3 API calls 1037->1039 1040 401050 1037->1040 1038->1037 1039->1040 1041 4010fb 1040->1041 1046 401394 1040->1046 1041->1012 1044 40148a 1043->1044 1045 4014b8 LdrLoadDll 1044->1045 1045->1034 1047 4013ee 1046->1047 1048 4013be 1046->1048 1047->1041 1048->1047 1049 401474 LdrLoadDll 1048->1049 1050 4013d2 1049->1050 1050->1047 1050->1050 1052 4014d8 1050->1052 1053 4014ee 1052->1053 1054 40150f LdrGetProcedureAddress 1052->1054 1056 4014fa LdrGetProcedureAddress 1053->1056 1055 401521 1054->1055 1055->1047 1056->1055 1058 401a5d RtlAllocateHeap 1057->1058 1059 401a79 1058->1059 1060 401a85 1058->1060 1059->988 1060->1058 1061 401b5b 1060->1061 1061->988 1063 401da8 NtSetInformationThread 1062->1063 1063->998 1066 401de9 1065->1066 1067 401e12 1066->1067 1068 401df2 NtProtectVirtualMemory 1066->1068 1067->995 1068->1067 1083 402126 1084 402141 1083->1084 1085 4020bc RtlAllocateHeap 1084->1085 1086 402158 1084->1086 1085->1086 1069 4019b7 1070 4019e0 1069->1070 1071 4016b4 9 API calls 1069->1071 1072 4016b4 9 API calls 1070->1072 1071->1070 1073 4019f4 1072->1073 1074 4016b4 9 API calls 1073->1074 1075 401a05 1074->1075 1076 4016b4 9 API calls 1075->1076 1077 401a16 1076->1077 1078 4016b4 9 API calls 1077->1078 1079 401a27 1078->1079 1080 4016b4 9 API calls 1079->1080 1081 401a38 1080->1081 1082 40286c NtSetInformationProcess NtSetInformationProcess NtSetInformationProcess

                              Callgraph

                              • Executed
                              • Not Executed
                              • Opacity -> Relevance
                              • Disassembly available
                              callgraph 0 Function_004026C0 38 Function_004024F8 0->38 1 Function_00401A40 39 Function_00401E78 1->39 2 Function_00401DC2 3 Function_004024C2 4 Function_00402B44 5 Function_00403144 6 Function_00401FC8 7 Function_00401F4C 8 Function_0040204C 9 Function_00402B50 10 Function_00401350 71 Function_00401130 10->71 11 Function_00402ED0 12 Function_004024D4 13 Function_004019D4 76 Function_004016B4 13->76 14 Function_00403956 14->13 33 Function_00401B70 14->33 54 Function_00402812 14->54 78 Function_00402836 14->78 15 Function_00403258 16 Function_004014D8 81 Function_00401438 16->81 17 Function_00401FDB 18 Function_004022DC 19 Function_0040205C 20 Function_00401F5C 21 Function_004020DE 22 Function_00402760 83 Function_004020BC 22->83 23 Function_004031E0 24 Function_00402264 25 Function_00401EE4 26 Function_004032E4 27 Function_004032E8 28 Function_00401868 29 Function_0040286C 30 Function_00401F6C 31 Function_00401B6E 32 Function_00401FEF 33->1 33->2 55 Function_00401D94 33->55 34 Function_00401472 35 Function_00401474 41 Function_004013F8 35->41 36 Function_004013F6 37 Function_00402A78 82 Function_004028BA 37->82 38->22 62 Function_00401E28 39->62 40 Function_00403478 42 Function_0040227C 43 Function_0040217C 44 Function_00402BFC 45 Function_00401000 45->7 45->10 45->25 45->45 56 Function_00401394 45->56 73 Function_00401EB0 45->73 46 Function_00402D80 47 Function_00403983 60 Function_0040389C 47->60 48 Function_00402003 49 Function_00402104 50 Function_00402C88 51 Function_00402E10 52 Function_00401190 52->71 53 Function_00401911 56->16 56->35 57 Function_00402017 58 Function_00402F18 58->42 58->51 59 Function_00401F9A 60->0 60->18 60->37 60->58 61 Function_00402126 61->83 63 Function_00402DA8 64 Function_0040152A 65 Function_0040202A 66 Function_0040152C 66->19 66->25 66->35 66->45 67 Function_00401F2C 66->67 68 Function_004018AD 69 Function_0040362E 70 Function_00401EAE 72 Function_00403230 74 Function_00401FB1 75 Function_004016B2 76->39 76->45 76->66 77 Function_00402234 79 Function_00401436 80 Function_004019B7 80->76 82->22 84 Function_00401A3E

                              Executed Functions

                              Function 00403983 Relevance: 40.5, APIs: 27, Instructions: 32windowlibraryloaderCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                              Memory Dump Source
                              • Source File: 00000008.00000002.2492737585.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000008.00000002.2492688612.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492788236.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492852667.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492909556.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_D4EC.jbxd
                              Similarity
                              • API ID: Text$Color$CreateWindow$Proc$CommandFontFreeHandleLibraryLineLoadMenuModule$AddressBitmapCharsetErrorExitInfoLastLocaleObjectProcessSelect
                              • String ID:
                              • API String ID: 3548022523-0
                              • Opcode ID: 75a7f395dfd15dd6a7f12e7587c497a330da91454d241e242464d6c2316bf13f
                              • Instruction ID: 44f13d8dc4ada08d969f55db554330e9d88bd117b0c18836a0928b418f5903af
                              • Opcode Fuzzy Hash: 75a7f395dfd15dd6a7f12e7587c497a330da91454d241e242464d6c2316bf13f
                              • Instruction Fuzzy Hash: 89F0B724B651416AC500BFFB9947A0D6E2C6E8472BB50657EB0C1344E74D3C87009EAF
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 00402F18 Relevance: 12.2, APIs: 8, Instructions: 184filenativememoryCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 3 402f18-402f2b 4 402f2e-402f33 3->4 4->4 5 402f35-402f5b call 40227c 4->5 7 402f67-402f8c CreateFileW 5->7 8 402f5d-402f61 5->8 9 402f8e-402f96 7->9 10 402faf-402fb1 7->10 8->7 11 4030bb-4030bd 8->11 12 402f98-402fa6 9->12 13 402faa 9->13 14 402fb4-402fe0 NtAllocateVirtualMemory 10->14 15 4030c0-4030c3 11->15 12->13 27 402fa8 12->27 13->11 16 402fe2-402fed 14->16 17 402fe8 14->17 18 4030c5-4030e4 NtFreeVirtualMemory 15->18 19 4030e7-4030eb 15->19 28 403000-403003 16->28 29 402fef-402ffe 16->29 22 40301b-403020 17->22 18->19 19->15 23 4030ed-4030f1 19->23 26 403023-40302e 22->26 24 4030f3-4030fc NtClose 23->24 25 4030ff-40311d call 402e10 DeleteFileW 23->25 24->25 36 403126-40312a 25->36 37 40311f 25->37 30 403030-40303a 26->30 31 40303c 26->31 27->7 32 403015-403019 28->32 33 403005-403010 28->33 29->32 35 403041-403048 30->35 31->35 32->14 32->22 33->32 38 40304b-403064 WriteFile 35->38 39 403138-403141 36->39 40 40312c-403132 36->40 37->36 41 403066 38->41 42 403068-403088 SetFilePointerEx 38->42 40->39 43 40308a-403091 41->43 42->38 42->43 44 403093 43->44 45 403095-4030b6 SetFilePointerEx 43->45 44->11 45->26
                              APIs
                              • CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,80000000,00000000), ref: 00402F82
                              • NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00010000,00001000,00000004), ref: 00402FDB
                              • WriteFile.KERNELBASE(000000FF,00000000,00010000,00010000,00000000), ref: 0040305F
                              • SetFilePointerEx.KERNELBASE(000000FF,00010000,?,00000000,00000001), ref: 0040307E
                              • SetFilePointerEx.KERNELBASE(000000FF,00010000,00000000,00000000,00000000,?,00000000,00000001), ref: 004030B3
                              • NtFreeVirtualMemory.NTDLL(000000FF,00000000,00010000,00008000,?,00000000,00000001), ref: 004030E4
                              • NtClose.NTDLL(000000FF,?,00000000,00000001), ref: 004030FC
                              • DeleteFileW.KERNELBASE(?,?,00000000,00000001), ref: 00403118
                              Memory Dump Source
                              • Source File: 00000008.00000002.2492737585.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000008.00000002.2492688612.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492788236.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492852667.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492909556.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_D4EC.jbxd
                              Similarity
                              • API ID: File$MemoryPointerVirtual$AllocateCloseCreateDeleteFreeWrite
                              • String ID:
                              • API String ID: 590822095-0
                              • Opcode ID: 52122dafd602033dbf0aaa267e6343e8fb4df09450a7f36494692c9b8865e816
                              • Instruction ID: 1b8bdb635f3090c090aca30f1047892238d11e79f8ef36d2dcee79009cce4089
                              • Opcode Fuzzy Hash: 52122dafd602033dbf0aaa267e6343e8fb4df09450a7f36494692c9b8865e816
                              • Instruction Fuzzy Hash: ED714871901209AFDB11CF90DD48BEEBB79FB08311F204266E511B62D4D3759E85CF99
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0040152C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 104fileCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              APIs
                              • FindFirstFileExW.KERNELBASE(C:\Windows\System32\*.dll,00000000,?,00000000,00000000,00000000), ref: 00401601
                              • FindClose.KERNELBASE(000000FF,?,00000000), ref: 0040162D
                              • FindNextFileW.KERNELBASE(000000FF,?,?,00000000), ref: 00401653
                              • FindClose.KERNEL32(000000FF), ref: 00401660
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.2492737585.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000008.00000002.2492688612.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492788236.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492852667.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492909556.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_D4EC.jbxd
                              Similarity
                              • API ID: Find$CloseFile$FirstNext
                              • String ID: C:\Windows\System32\*.dll
                              • API String ID: 1164774033-1305136377
                              • Opcode ID: bdb8730289e2ca857be386bc3c3ab385330ed8d95a663a52d2d02b9110bb0279
                              • Instruction ID: b8f602421e8d3e3309feb9384621a56ef9d54da146c7d7394d3b11ea37959a12
                              • Opcode Fuzzy Hash: bdb8730289e2ca857be386bc3c3ab385330ed8d95a663a52d2d02b9110bb0279
                              • Instruction Fuzzy Hash: 30418C71900608EFDB20AFA4DD48BAA77B4FB44325F608276E521BE1F0D7794A85DF48
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 00402760 Relevance: 4.6, APIs: 3, Instructions: 62filenativeCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 82 402760-402795 CreateFileW 83 4027f0-4027f4 82->83 84 402797-4027a9 82->84 85 402802-40280b 83->85 86 4027f6-4027ff NtClose 83->86 84->83 88 4027ab-4027be call 4020bc 84->88 86->85 88->83 90 4027c0-4027d8 ReadFile 88->90 91 4027e4-4027ea 90->91 92 4027da-4027e2 90->92 91->83 92->83
                              APIs
                              • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0040278B
                              • ReadFile.KERNELBASE(000000FF,00000000,00000000,00000000,00000000), ref: 004027D3
                              • NtClose.NTDLL(000000FF), ref: 004027FF
                              Memory Dump Source
                              • Source File: 00000008.00000002.2492737585.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000008.00000002.2492688612.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492788236.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492852667.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492909556.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_D4EC.jbxd
                              Similarity
                              • API ID: File$CloseCreateRead
                              • String ID:
                              • API String ID: 1419693385-0
                              • Opcode ID: da89fd3cbdd23a7ddbe5d8b9f381f279ea58f3e72d3b71a90626c9ff8252170d
                              • Instruction ID: da411bd40fb0d6d878d2d447c4e829303a7e8bd202b0d35ae7576ead56d2946b
                              • Opcode Fuzzy Hash: da89fd3cbdd23a7ddbe5d8b9f381f279ea58f3e72d3b71a90626c9ff8252170d
                              • Instruction Fuzzy Hash: CA211A35601209EBDB10CF94DD89B9EBB75FF08310F2082A5A510AB2E1D7719E51DF94
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0040286C Relevance: 4.5, APIs: 3, Instructions: 28nativeCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 94 40286c-4028b9 NtSetInformationProcess * 3
                              APIs
                              • NtSetInformationProcess.NTDLL(000000FF,00000021,?,00000004), ref: 00402888
                              • NtSetInformationProcess.NTDLL(000000FF,00000012,00000000,00000002,?,00000004), ref: 0040289D
                              • NtSetInformationProcess.NTDLL(000000FF,0000000C,00000000,00000004,?,00000004), ref: 004028B5
                              Memory Dump Source
                              • Source File: 00000008.00000002.2492737585.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000008.00000002.2492688612.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492788236.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492852667.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492909556.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_D4EC.jbxd
                              Similarity
                              • API ID: InformationProcess
                              • String ID:
                              • API String ID: 1801817001-0
                              • Opcode ID: b71ac733508e6e437ba76d930e61bde730921b23b00966883a2217b3d9eaec84
                              • Instruction ID: 48adbd17ca007e7691ff2066b81a5959555298f4bd9a539b6f325b5cfe831ef7
                              • Opcode Fuzzy Hash: b71ac733508e6e437ba76d930e61bde730921b23b00966883a2217b3d9eaec84
                              • Instruction Fuzzy Hash: 2BF0F871141610EBEB15DB84DDC9F9637A8FB09720F2403A1F2319E1E6D3B0A484CF96
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 00401DC2 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 38nativeCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 95 401dc2-401df0 97 401e21-401e27 95->97 98 401df2-401e10 NtProtectVirtualMemory 95->98 98->97 99 401e12-401e1f 98->99 99->97
                              APIs
                              • NtProtectVirtualMemory.NTDLL(000000FF,00000000,00000020,00000040,?), ref: 00401E0B
                              Strings
                              Memory Dump Source
                              • Source File: 00000008.00000002.2492737585.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000008.00000002.2492688612.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492788236.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492852667.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492909556.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_D4EC.jbxd
                              Similarity
                              • API ID: MemoryProtectVirtual
                              • String ID:
                              • API String ID: 2706961497-3916222277
                              • Opcode ID: 743ccc95185ac25335bad8a24ea2ffb6d91b2a6f6c30658889cc31c7cdbad58c
                              • Instruction ID: 836d3446d31acb3b31e0b6cd8f4ee088cd02c28435d2c0c4ff934eaabbb3754d
                              • Opcode Fuzzy Hash: 743ccc95185ac25335bad8a24ea2ffb6d91b2a6f6c30658889cc31c7cdbad58c
                              • Instruction Fuzzy Hash: 72F03176500109ABDB00CF95D988BDFB7BCEB44324F2042A9EA14A72D1D7355E458B94
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 004016B4 Relevance: 3.1, APIs: 2, Instructions: 130memorynativeCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 180 4016b4-4016c9 181 401859-401862 180->181 182 4016cf-4016d6 180->182 183 4016f5-401729 NtAllocateVirtualMemory 182->183 184 4016d8-4016f0 call 401000 182->184 183->181 186 40172f-40174c NtAllocateVirtualMemory 183->186 184->183 186->181 188 401752-40175a call 40152c 186->188 190 40175f-401761 188->190 190->181 191 401767-40176d 190->191 192 401774-401781 call 401000 191->192 193 40176f 191->193 196 401851-401854 192->196 197 401787-401798 call 401e78 192->197 193->181 196->191 200 4017c9-4017cc 197->200 201 40179a-4017c4 call 401e78 197->201 203 4017fa-4017fd 200->203 204 4017ce-4017f8 call 401e78 200->204 201->196 205 401815-401818 203->205 206 4017ff-401813 203->206 204->196 210 401830-401833 205->210 211 40181a-40182e 205->211 206->196 210->196 212 401835-40184b 210->212 211->196 212->196
                              APIs
                              • NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,?,00103000,00000040), ref: 0040171F
                              • NtAllocateVirtualMemory.NTDLL(000000FF,00000000,00000000,00000000,00103000,00000004), ref: 00401742
                              Memory Dump Source
                              • Source File: 00000008.00000002.2492737585.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000008.00000002.2492688612.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492788236.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492852667.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492909556.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_D4EC.jbxd
                              Similarity
                              • API ID: AllocateMemoryVirtual
                              • String ID:
                              • API String ID: 2167126740-0
                              • Opcode ID: 4a0fb159cb167e270aa132b3f88ebad20637f68d71e3a3db65f788631af4fc76
                              • Instruction ID: ad4b5e7ce53ce887a57ee0cc443bca07838dd3003dcb7b2c4dfa2ad75add82e8
                              • Opcode Fuzzy Hash: 4a0fb159cb167e270aa132b3f88ebad20637f68d71e3a3db65f788631af4fc76
                              • Instruction Fuzzy Hash: E3416031904204DADF10EF58C884B9AB7A4FF05314F14C1BAE919EF2E6D7788A41CB6A
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 00401474 Relevance: 1.5, APIs: 1, Instructions: 38libraryloaderCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 279 401474-401488 280 40148a-40148d 279->280 281 4014ac-4014b3 call 4013f8 279->281 282 401493-401498 280->282 285 4014b8-4014d2 LdrLoadDll 281->285 282->282 284 40149a-4014aa call 4013f8 282->284 284->285
                              APIs
                              • LdrLoadDll.NTDLL(00000000,00000000,00000000,?), ref: 004014C4
                              Memory Dump Source
                              • Source File: 00000008.00000002.2492737585.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000008.00000002.2492688612.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492788236.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492852667.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492909556.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_D4EC.jbxd
                              Similarity
                              • API ID: Load
                              • String ID:
                              • API String ID: 2234796835-0
                              • Opcode ID: cc821bb6490c49b643c0aee4c8a66cc2fb92e167f5171f05bab2522af16bb81c
                              • Instruction ID: 140de97a3c31e0856ca0b204e221eb1e366fb0b1d4fd9a07ba92ba20ce5f8dd4
                              • Opcode Fuzzy Hash: cc821bb6490c49b643c0aee4c8a66cc2fb92e167f5171f05bab2522af16bb81c
                              • Instruction Fuzzy Hash: F7F03C3690020DFADF10EAA4D848FDE77BCEB14314F0041A6E904B7190D238AA099BA5
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 0040227C Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 288 40227c-4022ad FindFirstFileExW 289 4022d2-4022d8 288->289 290 4022af-4022cf 288->290 290->289
                              APIs
                              • FindFirstFileExW.KERNELBASE(?,00000000,?,00000000,00000000,00000000), ref: 004022A4
                              Memory Dump Source
                              • Source File: 00000008.00000002.2492737585.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000008.00000002.2492688612.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492788236.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492852667.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492909556.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_D4EC.jbxd
                              Similarity
                              • API ID: FileFindFirst
                              • String ID:
                              • API String ID: 1974802433-0
                              • Opcode ID: cdec62c82a5867c9461e13d27f073131a42764883e1863d73d8ab6d37f0e38bf
                              • Instruction ID: 55f0629c3eadcc188d8749e42e063c0b49bca1bc4f8f265f590f61ae6da82bee
                              • Opcode Fuzzy Hash: cdec62c82a5867c9461e13d27f073131a42764883e1863d73d8ab6d37f0e38bf
                              • Instruction Fuzzy Hash: BBF0C974902608EFDB10DF94CD49B9DFBB4EB48310F2082A5A918AB2A0D7715E91CF84
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 00401D94 Relevance: 1.5, APIs: 1, Instructions: 19nativethreadCOMMON
                              Download Yara Rule
                              APIs
                              • NtSetInformationThread.NTDLL(00000000,?,00000000,00000000), ref: 00401DBB
                              Memory Dump Source
                              • Source File: 00000008.00000002.2492737585.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000008.00000002.2492688612.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492788236.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492852667.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492909556.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_D4EC.jbxd
                              Similarity
                              • API ID: InformationThread
                              • String ID:
                              • API String ID: 4046476035-0
                              • Opcode ID: 2ec57d8305034ae4dcd04f6f280aec29aa5e37325b0f502564d07dd60a6e8475
                              • Instruction ID: 482b214da63c1bafeb7c1bb62a0bbbc62c262419b9af6fea3894fce228737229
                              • Opcode Fuzzy Hash: 2ec57d8305034ae4dcd04f6f280aec29aa5e37325b0f502564d07dd60a6e8475
                              • Instruction Fuzzy Hash: FEE05E329A020DAFD710DB50DC45FBB376DEB55311F508236B5029A1E0D6B8F891DA98
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 00401B70 Relevance: 3.2, APIs: 2, Instructions: 156memoryCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 100 401b70-401b9f RtlCreateHeap 101 401ba1 100->101 102 401ba6-401bc4 RtlCreateHeap 100->102 103 401d8a-401d90 101->103 104 401bc6 102->104 105 401bcb-401be7 102->105 104->103 107 401be9 105->107 108 401bee-401c05 call 401a40 105->108 107->103 111 401c07 108->111 112 401c0c-401c3d 108->112 111->103 115 401c44-401c5b call 401a40 112->115 116 401c3f 112->116 119 401c62-401c93 115->119 120 401c5d 115->120 116->103 123 401c95 119->123 124 401c9a-401cb1 call 401a40 119->124 120->103 123->103 127 401cb3 124->127 128 401cb8-401ce9 124->128 127->103 131 401cf0-401d07 call 401a40 128->131 132 401ceb 128->132 135 401d09 131->135 136 401d0b-401d3c 131->136 132->103 135->103 139 401d40-401d57 call 401a40 136->139 140 401d3e 136->140 143 401d59 139->143 144 401d5b-401d80 call 401d94 call 401dc2 139->144 140->103 143->103 147 401d83 144->147 147->103
                              APIs
                              • RtlCreateHeap.NTDLL(00001002,00000000,00000000,00000000,00000000,00000000), ref: 00401B96
                              • RtlCreateHeap.NTDLL(00041002,00000000,00000000,00000000,00000000,00000000), ref: 00401BBB
                              Memory Dump Source
                              • Source File: 00000008.00000002.2492737585.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000008.00000002.2492688612.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492788236.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492852667.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492909556.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_D4EC.jbxd
                              Similarity
                              • API ID: CreateHeap
                              • String ID:
                              • API String ID: 10892065-0
                              • Opcode ID: 453bda9d08a0096fe53e6a5bcc4a475ef93f8d776735eeddf63228c397926240
                              • Instruction ID: eac1ce902914894448f3c06d12ced00cbe17960004271ddceb971b2a38276b5e
                              • Opcode Fuzzy Hash: 453bda9d08a0096fe53e6a5bcc4a475ef93f8d776735eeddf63228c397926240
                              • Instruction Fuzzy Hash: 34513034A80A04FBD7109B60ED09B5B7770FF18701F2086BAE6117A2F1D775A5859F8D
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 004022DC Relevance: 3.1, APIs: 2, Instructions: 133COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 150 4022dc-40232e 154 402330 150->154 155 402335-402347 GetShortPathNameW 150->155 156 402483-402487 154->156 157 402349-402359 155->157 158 40235e-402380 155->158 159 402495-402499 156->159 160 402489-40248f 156->160 157->156 168 402382 158->168 169 402387-402425 158->169 163 4024a7-4024ab 159->163 164 40249b-4024a1 159->164 160->159 165 4024b9-4024bf 163->165 166 4024ad-4024b3 163->166 164->163 166->165 168->156 175 402427 169->175 176 402429-402481 ShellExecuteW 169->176 175->156 176->156
                              APIs
                              • GetShortPathNameW.KERNELBASE(00000000,00000000,?), ref: 00402340
                              Memory Dump Source
                              • Source File: 00000008.00000002.2492737585.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000008.00000002.2492688612.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492788236.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492852667.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492909556.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_D4EC.jbxd
                              Similarity
                              • API ID: NamePathShort
                              • String ID:
                              • API String ID: 1295925010-0
                              • Opcode ID: a0a4f684a9d9108a63d91a30c19249ae39ae68594d14297edb71c581cb82e24b
                              • Instruction ID: 5bcac900e59d09c9622bdf940851d370624af246baed8abb1bc217228d1f7e1b
                              • Opcode Fuzzy Hash: a0a4f684a9d9108a63d91a30c19249ae39ae68594d14297edb71c581cb82e24b
                              • Instruction Fuzzy Hash: B6514E75900606EFDB00DF90E948B9EFB71FF48301F2082A9E6156B2A1C375AA91DFC5
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 004026C0 Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 213 4026c0-4026e5 call 4024f8 215 402730-402734 213->215 216 4026e7-402709 CreateFileW 213->216 218 402742-402746 215->218 219 402736-40273c 215->219 216->215 217 40270b-402727 ReadFile 216->217 217->215 220 402729 217->220 221 402754-40275a 218->221 222 402748-40274e 218->222 219->218 220->215 222->221
                              APIs
                              • CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004026FF
                              • ReadFile.KERNELBASE(000000FF,000000FF,0000021C,?,00000000), ref: 00402722
                              Memory Dump Source
                              • Source File: 00000008.00000002.2492737585.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000008.00000002.2492688612.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492788236.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492852667.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492909556.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_D4EC.jbxd
                              Similarity
                              • API ID: File$CreateRead
                              • String ID:
                              • API String ID: 3388366904-0
                              • Opcode ID: 64d441af2ae5f8cd80c02da2bb5cacaba4a8c0a7bb8fd120945ed4e9a720f5dc
                              • Instruction ID: dec784d2d3492f4c007a4c80bb83cd8b4abde05e7af7cfb80cb91198c32a9eba
                              • Opcode Fuzzy Hash: 64d441af2ae5f8cd80c02da2bb5cacaba4a8c0a7bb8fd120945ed4e9a720f5dc
                              • Instruction Fuzzy Hash: 7511D774910209EFDB10DF94DD48B9FBBB5FB08311F2046A9A524B62E1D7B15A91CF84
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 00401A40 Relevance: 1.6, APIs: 1, Instructions: 98memoryCOMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 224 401a40-401a5a 225 401a5d-401a77 RtlAllocateHeap 224->225 226 401a85-401a94 call 401e78 225->226 227 401a79-401a82 225->227 230 401ac5-401ac8 226->230 231 401a96-401ac0 call 401e78 226->231 233 401af6-401af9 230->233 234 401aca-401af4 call 401e78 230->234 239 401b4d-401b55 231->239 237 401b11-401b14 233->237 238 401afb-401b0f 233->238 234->239 241 401b16-401b2a 237->241 242 401b2c-401b2f 237->242 238->239 239->225 243 401b5b-401b6b 239->243 241->239 242->239 244 401b31-401b47 242->244 244->239
                              APIs
                              • RtlAllocateHeap.NTDLL(00000000,00000008,00000010), ref: 00401A6D
                              Memory Dump Source
                              • Source File: 00000008.00000002.2492737585.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000008.00000002.2492688612.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492788236.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492852667.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492909556.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_D4EC.jbxd
                              Similarity
                              • API ID: AllocateHeap
                              • String ID:
                              • API String ID: 1279760036-0
                              • Opcode ID: 3090814481001f51fad53404be7bb9f089635e5ecf5702693e45b6397da5dce2
                              • Instruction ID: 68c0462a3af62cc3e50a8e225ecc1fff045641083c52707b2e4de1a33f1d8fac
                              • Opcode Fuzzy Hash: 3090814481001f51fad53404be7bb9f089635e5ecf5702693e45b6397da5dce2
                              • Instruction Fuzzy Hash: 9F316935A14308DFDB10CF99C488E99F7F1BF24320F15D0AAD508AB2B2D7B59950DB4A
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 00402E10 Relevance: 1.6, APIs: 1, Instructions: 66COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 245 402e10-402e35 247 402e37 245->247 248 402e39-402e4e 245->248 249 402eab-402eb7 247->249 253 402e50 248->253 254 402e52-402e57 248->254 250 402ec5-402eca 249->250 251 402eb9-402ebf 249->251 251->250 253->249 255 402e5c-402e6d 254->255 257 402e70-402e7a 255->257 257->257 258 402e7c-402e8f MoveFileExW 257->258 259 402e91 258->259 260 402e93-402ea9 258->260 259->249 260->249 260->255
                              Memory Dump Source
                              • Source File: 00000008.00000002.2492737585.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000008.00000002.2492688612.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492788236.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492852667.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492909556.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_D4EC.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 2ec2b1c2d5d64686e5e6a52de2e159d7ebe58570cf782c44f0051c3652f2bf9a
                              • Instruction ID: 64be472d3da9365df722bb42b6a14b0a0006b9682bbf08d732ce7ada7e71b141
                              • Opcode Fuzzy Hash: 2ec2b1c2d5d64686e5e6a52de2e159d7ebe58570cf782c44f0051c3652f2bf9a
                              • Instruction Fuzzy Hash: 8A214C71940208EFDB109F90DE49B9ABB71FF18301F2081BAE505AA2E1D3759E91DF89
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 00402A78 Relevance: 1.6, APIs: 1, Instructions: 52COMMON
                              Download Yara Rule

                              Control-flow Graph

                              • Executed
                              • Not Executed
                              control_flow_graph 262 402a78-402a9c call 4028ba 264 402aa3-402ac2 262->264 265 402a9e 262->265 270 402ac4-402ad3 264->270 271 402ad5-402ae0 264->271 266 402b28-402b2c 265->266 267 402b3a-402b40 266->267 268 402b2e-402b34 266->268 268->267 270->266 274 402ae2-402ae8 271->274 275 402aea 271->275 276 402af0-402b1f CreateMutexW 274->276 275->276 276->266 277 402b21 276->277 277->266
                              Memory Dump Source
                              • Source File: 00000008.00000002.2492737585.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000008.00000002.2492688612.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492788236.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492852667.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492909556.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_D4EC.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 76ac4189c2e983f292498be2e35779ead737e5081f8c929ef40d6d428a78efce
                              • Instruction ID: 5f31ce468cef0475a522e9655e813cee8f96e501922e94d34a843d9ecc1c4f5f
                              • Opcode Fuzzy Hash: 76ac4189c2e983f292498be2e35779ead737e5081f8c929ef40d6d428a78efce
                              • Instruction Fuzzy Hash: A921F974901608EFDB00CF90EA8C79EBB71FF08301F6045A9E5017A2A0D7B95A85DF89
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 00402836 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                              Download Yara Rule
                              APIs
                              • RtlAdjustPrivilege.NTDLL(?,00000001,00000000,00000000), ref: 00402861
                              Memory Dump Source
                              • Source File: 00000008.00000002.2492737585.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000008.00000002.2492688612.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492788236.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492852667.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492909556.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_D4EC.jbxd
                              Similarity
                              • API ID: AdjustPrivilege
                              • String ID:
                              • API String ID: 3260937286-0
                              • Opcode ID: b838e4be5c385c0dc624d50355c604d381d153ee0a89857c9e86ae645bc67477
                              • Instruction ID: 70193a9dbc7aa9cd3770003b3bb97339f6e2972f30e24310785a39762e1cef45
                              • Opcode Fuzzy Hash: b838e4be5c385c0dc624d50355c604d381d153ee0a89857c9e86ae645bc67477
                              • Instruction Fuzzy Hash: B9E0263251821AABCB20A2189E0CBA7739DD744314F1043B6A805F71D1EAF69A0A87DA
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Function 004020BC Relevance: 1.5, APIs: 1, Instructions: 12memoryCOMMON
                              Download Yara Rule
                              APIs
                              • RtlAllocateHeap.NTDLL(?,00000008,?), ref: 004020D7
                              Memory Dump Source
                              • Source File: 00000008.00000002.2492737585.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000008.00000002.2492688612.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492788236.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492852667.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492909556.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_D4EC.jbxd
                              Similarity
                              • API ID: AllocateHeap
                              • String ID:
                              • API String ID: 1279760036-0
                              • Opcode ID: 37c2d1e8b064bb17fe79b9677c4ca25dfdae977e826a45f6764b5f2e7935cd48
                              • Instruction ID: 701e22a529f931561d5ec47da2ef603e250127bb9ab3ab4db12cbc5835053477
                              • Opcode Fuzzy Hash: 37c2d1e8b064bb17fe79b9677c4ca25dfdae977e826a45f6764b5f2e7935cd48
                              • Instruction Fuzzy Hash: 05D0C97A140609ABC6009F94E949D87F769FF58711B00C6A1BA045B222C630E890CFD4
                              Uniqueness

                              Uniqueness Score: -1.00%

                              Non-executed Functions

                              Function 00401E28 Relevance: .0, Instructions: 37COMMON
                              Download Yara Rule
                              Memory Dump Source
                              • Source File: 00000008.00000002.2492737585.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                              • Associated: 00000008.00000002.2492688612.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492788236.0000000000404000.00000002.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492852667.0000000000405000.00000004.00000001.01000000.00000008.sdmpDownload File
                              • Associated: 00000008.00000002.2492909556.0000000000406000.00000002.00000001.01000000.00000008.sdmpDownload File
                              Joe Sandbox IDA Plugin
                              • Snapshot File: hcaresult_8_2_400000_D4EC.jbxd
                              Similarity
                              • API ID:
                              • String ID:
                              • API String ID:
                              • Opcode ID: 6e9e9d037a559c25274071be2e09c2d3cf2f15b9f66fb5d997d9d64617e40bf4
                              • Instruction ID: 6136ad03b03fa54b1221fd779f858300ea63a7014db59c606017e409e14e0861
                              • Opcode Fuzzy Hash: 6e9e9d037a559c25274071be2e09c2d3cf2f15b9f66fb5d997d9d64617e40bf4
                              • Instruction Fuzzy Hash: B6E04FBB60D3025FF928851174533AB8387C780775E2584AFE906DF2C0EF1BE8A52099
                              Uniqueness

                              Uniqueness Score: -1.00%